Test a federated RP in Sweden Connect Sandbox

This guide applies the Management Center setup to Sweden Connect Sandbox. It covers the first RP connection and browser login; it does not change Access's generic OpenID Federation configuration model. Sweden Connect's published federation material currently describes OpenID Federation 1.0, so verify interoperability in the sandbox when using an Access implementation targeting 1.1. See the federation structure for the operator's current rules and endpoints.

Sandbox values to collect

Setting	Sandbox value or source
Trust Anchor Entity ID	https://fed.sandbox.swedenconnect.se/trustanchor
Trust Anchor Resolve Endpoint	https://fed.sandbox.swedenconnect.se/trustanchor/resolve
RP Registration Intermediate Entity ID	https://fed.sandbox.swedenconnect.se/im-reg-sc
First reference OP Entity ID	https://converter.sandbox.swedenconnect.se/proxy/realms/SwedenConnectSandboxReferenceIdP
Trust Anchor public federation keys	Obtain the current key from the official sandbox federation settings and confirm it with the operator's onboarding information before pinning it as a JWKS.

The sandbox OP page also lists an eIDAS test OP. Use its exact Entity ID if that is your intended test. Do not copy a historic Trust Anchor key from an example configuration: a pinned key must match the operator's current trust information.

Configure and register the RP

Prepare the public entity

Create a Federation Entity with a stable public HTTPS Entity ID and prepare a trusted TLS certificate for its route. Keep the Entity ID and redirect URI stable once the operator has registered the RP. The complete Entity Configuration, including the linked RP metadata, must be reachable by the Sweden Connect OP and Registration Intermediate before you request registration.

Set the Sweden Connect trust and metadata profile

On the entity's Federation trust tab, choose Single point of trust resolution. Set the Trust Anchor Entity ID, its verified public federation JWKS and the Resolve Endpoint from the sandbox settings. Add the RP Registration Intermediate Entity ID to Authority hints. On Relying party, choose the sweden_connect RP metadata profile. This profile applies Sweden Connect's additional validation; it does not replace operator onboarding.

Link an OIDC RP authenticator

Create an OIDC RP authenticator, set Provider discovery to OpenID Federation, select this Federation Entity and enter the reference OP's exact OP Entity ID. Select Automatic client registration and Private key JWT token endpoint authentication for the first test. Enter the public HTTPS Redirect URI for this authenticator, keep PKCE enabled and save. Management Center creates the RP signing key and links the two resources. The Federation Entity signing key and RP signing key remain separate.

On the RP's Advanced tab, fill Additional public RP metadata with your real presentation and contact information. For example, replace every example.org value before use:

{
  "client_name#sv": "Exempel på förlitande part",
  "client_name#en": "Example relying party",
  "contacts": ["[email protected]"],
  "logo_uri": "https://example.org/logo.svg",
  "client_uri": "https://example.org/"
}

These fields are published in metadata.openid_relying_party; the redirect URI, public JWKS and token endpoint authentication method are derived from the authenticator. Sweden Connect's metadata requirements describe what the resolved RP metadata must contain. The operator may add or pin other values in its Subordinate Statement.

Request sandbox registration

Deploy the linked entity and RP. Confirm that an external client can fetch <entity_id>/.well-known/openid-federation and that the payload contains metadata.openid_relying_party with the intended redirect URI and public RP keys. Then send the public Entity ID to [email protected] and ask to add the RP under the sandbox RP Registration Intermediate. The operator retrieves and checks the published Entity Configuration, then issues a Subordinate Statement. No sandbox contract is required; registration is currently handled by email until self-service is available. Allow time for the sandbox and OP to synchronize before interpreting a first login failure as a configuration defect. See the sandbox joining instructions and federation structure.

Run an end-to-end login

Connect the OIDC RP authenticator to an Access login flow and start it through a test application. Confirm that Access resolves the intended OP, sends a signed Request Object, receives the authorization response and completes token validation. For the initial automatic-registration test, use Request Objects by value; Sweden Connect's current OP metadata requirements require support for the request parameter. Confirm any request_uri or PAR requirements with the operator before depending on those flows.

If the OP cannot find the RP, check the public URL, TLS certificate, Entity ID, authority hint and subordinate registration first. If Access cannot resolve the OP, check the current Trust Anchor JWKS, Resolve Endpoint, OP Entity ID and outbound HTTP connectivity. Compare the published Entity Configuration with the Management Center verification steps.