> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/flow-control/externalflow.md).

# ExternalFlow

Configuration and usage guidance for ExternalFlow in Fortified ID Access.

## Introduction

The ExternalFlow authenticator redirects the user to an external service, facilitating integration with third-party identity or policy providers. Data is exchanged between the platform and the external service using signed JWTs, transmitted within POST requests. This ensures integrity and authenticity of the exchanged information.

## Configuration

{% hint style="info" %}
**Authenticator type:** `ExternalFlow`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>location</code></td><td>Location to the external service</td><td><code>N/A</code></td><td>true</td></tr><tr><td><code>exec_if</code></td><td>An expression that determines if this authenticator should be executed or not.</td><td>N/A</td><td>false</td></tr><tr><td><code>key_store</code></td><td>Keystore used to sign the outgoing JWT</td><td>N/A</td><td>true</td></tr><tr><td><code>alias</code></td><td>Alias of the private key in the keystore</td><td></td><td>false</td></tr><tr><td><code>certificate</code></td><td>Certificate used to verify the incoming JWT data</td><td><code>N/A</code></td><td>true</td></tr><tr><td><code>attributes</code></td><td>Object containing data that is sent as payload to the external service.</td><td>{}</td><td>false</td></tr><tr><td><code>custom_identifier</code></td><td>Tag used for event separation</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
    "id": "externalflow01",
    "type": "ExternalFlow",
    "config": {
        "base_path": "/login",
        "location": "https://externalservice.com/",
        "attributes":
        {
            "attribute_username":"${state.username}",
            "attribute_info":"This is another attribute"
        },
        "key_store":
         {
           "type" : "PKCS12",
           "path" : "path/to/my.p12",
           "password" : "password",
           "private_key_password": "password"
         },
         "certificate":
         {
           "path" : "path/to/certificate.pem"
         }
    }
}
```

{% endtab %}
{% endtabs %}

## Logging

WEB\_100046("ExternalFlow request sent")

* IDENTIFIER (user trace id)
* CUSTOMER\_IDENTIFIER (if configured)
* SOURCE\_ADDRESS (ip of the remote session)
* AUTHENTICATOR\_ID (id + display\_name of authenticator)

WEB\_100047("ExternalFlow response received")

* IDENTIFIER (user trace id)
* CUSTOMER\_IDENTIFIER (if configured)
* SOURCE\_ADDRESS (ip of the remote session)
* AUTHENTICATOR\_ID (id + display\_name of authenticator)

## Data exposed to global state

Upon receiving the response from the external service, the authenticator is marked as completed. The payload contained in the JWT returned by the external service is extracted and propagated into the global state, making it available for subsequent authenticators and flow controllers.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/flow-control/externalflow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.