# Test a federated RP in Sweden Connect Sandbox

Documentation owner: product `access`; documentation version: `next`.
Source: `content/products/access/next/authenticators/protocol-managers/oidc/openid-federation-sweden-connect-sandbox.md` at commit `eaf7a020437971baeee95e87eaf963636040ac71`.

This guide applies the [Management Center setup](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-management-center/) to Sweden Connect Sandbox. It covers the first RP connection and browser login; it does not change Access's generic OpenID Federation configuration model. Sweden Connect's published federation material currently describes OpenID Federation 1.0, so verify interoperability in the sandbox when using an Access implementation targeting 1.1. See the [federation structure](https://docs.swedenconnect.se/federation/oidf-structure.html) for the operator's current rules and endpoints.

## Sandbox values to collect

| Setting | Sandbox value or source |
| --- | --- |
| Trust Anchor Entity ID | `https://fed.sandbox.swedenconnect.se/trustanchor` |
| Trust Anchor Resolve Endpoint | `https://fed.sandbox.swedenconnect.se/trustanchor/resolve` |
| RP Registration Intermediate Entity ID | `https://fed.sandbox.swedenconnect.se/im-reg-sc` |
| First reference OP Entity ID | `https://converter.sandbox.swedenconnect.se/proxy/realms/SwedenConnectSandboxReferenceIdP` |
| Trust Anchor public federation keys | Obtain the current key from the [official sandbox federation settings](https://docs.swedenconnect.se/federation/oidf-structure.html) and confirm it with the operator's onboarding information before pinning it as a JWKS. |

The [sandbox OP page](https://docs.swedenconnect.se/sandbox-pages/oidc.html) also lists an eIDAS test OP. Use its exact Entity ID if that is your intended test. Do not copy a historic Trust Anchor key from an example configuration: a pinned key must match the operator's current trust information.

## Configure and register the RP

### Prepare the public entity

Create a Federation Entity with a stable public HTTPS **Entity ID** and prepare a trusted TLS certificate for its route. Keep the Entity ID and redirect URI stable once the operator has registered the RP. The complete Entity Configuration, including the linked RP metadata, must be reachable by the Sweden Connect OP and Registration Intermediate before you request registration.

### Set the Sweden Connect trust and metadata profile

On the entity's **Federation trust** tab, choose **Single point of trust resolution**. Set the Trust Anchor Entity ID, its verified public federation JWKS and the Resolve Endpoint from the sandbox settings. Add the RP Registration Intermediate Entity ID to **Authority hints**. On **Relying party**, choose the **sweden_connect** RP metadata profile. This profile applies Sweden Connect's additional validation; it does not replace operator onboarding.

### Link an OIDC RP authenticator

Create an **OIDC RP** authenticator, set **Provider discovery** to **OpenID Federation**, select this Federation Entity and enter the reference OP's exact **OP Entity ID**. Select **Automatic** client registration and **Private key JWT** token endpoint authentication for the first test. Enter the public HTTPS **Redirect URI** for this authenticator, keep PKCE enabled and save. Management Center creates the RP signing key and links the two resources. The Federation Entity signing key and RP signing key remain separate.

On the RP's **Advanced** tab, fill **Additional public RP metadata** with your real presentation and contact information. For example, replace every `example.org` value before use:

```json
{
  "client_name#sv": "Exempel på förlitande part",
  "client_name#en": "Example relying party",
  "contacts": ["oidc@example.org"],
  "logo_uri": "https://example.org/logo.svg",
  "client_uri": "https://example.org/"
}
```

These fields are published in `metadata.openid_relying_party`; the redirect URI, public JWKS and token endpoint authentication method are derived from the authenticator. Sweden Connect's [metadata requirements](https://docs.swedenconnect.se/federation/oidc-metadata-requirements.html) describe what the resolved RP metadata must contain. The operator may add or pin other values in its Subordinate Statement.

### Request sandbox registration

Deploy the linked entity and RP. Confirm that an external client can fetch `<entity_id>/.well-known/openid-federation` and that the payload contains `metadata.openid_relying_party` with the intended redirect URI and public RP keys. Then send the **public Entity ID** to `operations@swedenconnect.se` and ask to add the RP under the sandbox RP Registration Intermediate. The operator retrieves and checks the published Entity Configuration, then issues a Subordinate Statement. No sandbox contract is required; registration is currently handled by email until self-service is available. Allow time for the sandbox and OP to synchronize before interpreting a first login failure as a configuration defect. See the [sandbox joining instructions](https://docs.swedenconnect.se/sandbox-pages/oidc.html) and [federation structure](https://docs.swedenconnect.se/federation/oidf-structure.html).

### Run an end-to-end login

Connect the OIDC RP authenticator to an Access login flow and start it through a test application. Confirm that Access resolves the intended OP, sends a signed Request Object, receives the authorization response and completes token validation. For the initial automatic-registration test, use Request Objects by value; Sweden Connect's current [OP metadata requirements](https://docs.swedenconnect.se/federation/oidc-metadata-requirements.html) require support for the `request` parameter. Confirm any `request_uri` or PAR requirements with the operator before depending on those flows.

If the OP cannot find the RP, check the public URL, TLS certificate, Entity ID, authority hint and subordinate registration first. If Access cannot resolve the OP, check the current Trust Anchor JWKS, Resolve Endpoint, OP Entity ID and outbound HTTP connectivity. Compare the published Entity Configuration with the [Management Center verification steps](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-management-center/#deploy-and-verify).