Register for Federated SSO

Important: If you’re migrating to the new Equinix authentication system for Federated SSO login, refer to Federated SSO Migration instead.

To register your organization for federated SSO:

1. From the Administration menu in the Customer Portal, click Account & Security Management.

   

2. Click Federated Single Sign-On.

   

3. On the Federation Registration page, read the instructions for the set-up process and click Next.

4. On the Metadata Details page:

   1. Enter your organization's email address domain. If you have multiple domains, separated them with a comma.

      Example: acme.com, eu.acme.com
      

   2. Provide the metadata in one of two ways:

      Upload your SAML file

      This method automatically enters the required information.

      Note: With this method, the Entity ID, SSO URL, and Identity Location fields are disabled and you cannot edit them. To change these fields, click Discard, then import an updated SAML file (or enter the information manually, as described below).

      Important: Equinix requires a user email address in the SAML response. All other attributes are ignored.

      or

      Manually enter SAML information

      • Entity ID – Enter the entity ID for your organization. Ask your company's identity administrator for the value for this field.

      • Single-Sign-On URL – Enter the IdP URL where Equinix will post the SAML request. Ask your company's identity administrator for the value for this field.

5. Click Next.

6. On the Technical Contact page, indicate the Point of Contact between your organization and Equinix. Select either Internal or External:

   • Internal (default) – Select an existing Equinix-registered user within your organization.

   • External – Add a user as the point of contact who is not a registered user; enter the first name, last name, email address, and phone number.

     Note: Typically, the Identity Administrator from your organization may be interested in setting up this SAML configuration with Equinix.

7. Click Next.

8. On the Certificate Upload page, if your certificate is not part of the SAML data, then upload it here:

   

   Note: Equinix uses this certificate to validate the authenticity of the SAML requests that originate from your organization.

   Important: Equinix verifies the certificate end date; expired certificates are not accepted.

9. Click Submit.

   The Federation Details page shows the Provisioned Status as Submitted.

   Tip: You can update your request for as long as the Equinix administrator doesn't process and approve it.

   Note:

   • The Equinix Administrator reviews your submitted information and contacts you if further information is required.

   • You can see the comments entered by the Equinix Administrator on your request page.

   • During this process, you will receive emails to update you on the progress.

   List of Federation Statuses:

   Provisioning statuses that you might see during the process:

   • SUBMITTED – The application registration request has been submitted and is being reviewed by the Equinix Administrator.
   • AWAITING RESPONSE – The Equinix Administrator needs additional information to process the request.
   • IN-PROGRESS – Provisioning is in progress.
   • PROVISIONED – The application is provisioned in all systems.
   • COMPLETED – You have tested the application and the request is closed.

10. Click Equinix SAML Metadata to download Equinix metadata and follow your identity provider's instructions to set up federated SSO integration.

11. Once you receive an email that your federated SSO request has been approved, verify that you can log in to Equinix portal.

When the federated SSO configuration is ready and your request is in PROVISIONED status, validate your federated SSO setup:

1. Go to portal.equinix.com.

2. Click Sign In with SSO, then provide your email address and click Continue.

3. Enter your login credentials to authenticate and access the Equinix portal.

   Important: If you're unable to log in, add a comment to your federation request to engage with Equinix administrator and troubleshoot your login issues.

4. Go to your federation portal (using the link in the email or through the Customer Portal).

5. Under Portal URLs, click I have verified that the federation single sign-on is working for all applications.

6. Click Confirm.

   Note: An email notification is sent with a confirmation that the processing of your federated SSO request has been completed.

After your organization is successfully on-boarded, you can use the Self Service Federation application request page if you need to upload a new certificate or to change point-of-contact information:

• To upload a new certificate:

  From the List of Certificates tab, click Upload Certificate.

  

• To update the point of contact:

  From the Technical Contact tab, click Change Point of Contact.

  

This feature replaces the provisioning of user profiles via Federated SSO with System for Cross-domain Identity Management (SCIM) API calls. Shifting from Federated SSO to SCIM involves changing from a trust-based authentication model to a standardized provisioning and deprovisioning model.

To enable provisioning of user profiles via SCIM API calls:

1. From the Administration menu in the Customer Portal, click Account & Security Management.

   Note: The Administration menu is visible only to Administrators.

   

2. Click Federated Single Sign-On. Federation details screen will be displayed. Alternatively, you can access via https://federation.equinix.com/.

3. Select the Provisioning tab. This will be available if you have successfully setup federated connection, and login via federated authentication.

   

4. Click on the toggle to turn on using SCIM API for provisioning user profiles. You will be prompted with a series of confirmation to turn on this feature. Turning on SCIM API management will turn off the Automatic Provisioning of user profiles via Federated SSO.

   

   

5. Details such as Endpoint URL for provisioning user profiles via SCIM API will be displayed. You will need to generate tokens to access the API endpoint.

   Note: A maximum of two tokens are allowed.

   

   Click Generate New Token.

6. Token details will be displayed. Copy and save the token in a secure location. You will need the token in order access the API endpoint.

   Note: This is the only time this token details will be displayed. If you lose the token, you will need to delete an existing token and regenerate a new one.

For more details on how to configure EntraID and Okta, refer to:

• Configuring Microsoft Entra ID for Equinix Federated SSO

• Configuring Okta for Equinix Federated SSO

In critical situations, Equinix offers this feature to ensure you have account access without compromising security. This feature is available to federated customers. An emergency authentication method (in case SSO login is compromised) will be made available to users to log into Equinix.

Set up Break-glass Access

1. Log in to an Equinix portal, as a federated customer with Administrator access.

2. From the Administration menu, choose Account and Security Management.

   Note: The Administration menu is visible only to Administrators.

   

3. Click on Federated Single Sign-On. Federation details screen will be displayed. Alternatively, you can access via https://federation.equinix.com/.

4. Select the Break-glass Access tab. This will be available if you have successfully setup federated connection, and login via federated authentication.

   

5. You can enable Multi-Factor Authentication (MFA) for Break-glass Access. Click on MULTI-FACTOR AUTHENTICATION to display options for MFA.

   

   • To enable/disable WebAuthn with FIDO Security Keys, click to toggle this MFA option on or off.

   • To enable/disable Authenticator Applications, click to toggle this MFA option on or off.

6. You can define email addresses who will be notified when Break-glass Access is used.

   

7. Input up to 10 emails for emergency use. An email message will be sent to these users to inform them that they are designated Break-glass Access users. It will also prompt them to create passwords for Break-glass Access.

   Note: Emails must belong to existing Equinix users. Email link will expire after a week.

   

8. Click on Create Password in the email.

   Password requirements:

   • Must be at least 26 characters long

   • Must contain at least 3 of the following:

     • one lower-case letter (from a-z)

     • one upper-case letter (from A-Z)

     • one numeral (from 0-9)

     • one special character (e.g. ! @ # $ % ^ & * )

   • Must not include spaces

   • Must not contain two identical characters consecutively

   Note: This feature is meant for use only in emergencies when SSO login is not working. The password will be valid for 72 hours from the first login (unlimited logins during such time).

9. Click on Resend Link to resend the Create Password email to the user. This is for cases where the password has expired, or the user failed to create a password before the expiration of the first email.

10. Click on Revoke Access to remove access from the user. An email will be sent to the user to inform them that their Break-glass Access has been revoked.

Accessing Equinix via Break-glass Access

During critical situations where SSO login is not working, you can log into Equinix portal if you are a designated Break-glass Access user.

1. After creating your password for Break-glass Access, the following email will be sent to you with links to access Equinix. Click on the links to access Equinix Customer Portal or Metal portal.

   

2. Use your email address and password associated with Break-glass Access to log in.

   

How do you know if you have Break-glass access?

You can find out if you have Break-glass access from your User Account. If you were enabled for Break-glass Access, you would have received an email informing you.

1. Log in to an Equinix portal.

2. Click your user name and select User Account.

3. From the left menu, select Authentication and Security.

4. If you have Break-glass Access, you will see the following screen.

   

Before Registration

During Registration

After Registration