This action requires a user to be a Site Administrator.

To designate To assign a Delegated Administrator (DA) , a site administrator and to assign access, logs into the Federation Manager , clicks the menu item and select the options from the   "Delegated Administrators" along the left hand side of the page.top navigation menu:

Image Added

Add a new Delegated Administrator

On the Deleted Administrators page, click the ">ADD NEW" link below the section title: 

Image RemovedSelect "Add Delegated Administrator" from the "Delegated Administrators" drop down menu.

On the Add a Delegated Administrator page, enter the person's ePPN, first and last name, email address, phone number, and job title.

Image RemovedImage Added

Federation Manager will an email invitation to the supplied email address (copying all other site administrators as well). The prospective delegated administrator DA clicks the link in the email to continue with the process.

Once the delegated administrator has successfully logged into the Federation Manager via SAML Web Browser SSO, a local account is provisioned. No local credentials are issued---the delegated administrator always logs in with a federated credential.

About ePPN

A DA always logs into Federation Manager using a federated single sign-on identity provider. There is no local accounts/password for a DA.

About ePPN

ePPN (eduPersonPrincipalName) is a standard attribute in the InCommon Federation. ePPN is typically a human-readable user identifier. Federation Manager uses ePPN connects that person's access to Federation Manager with your IdP. By supplying the ePPN for the perspective DADelegated Administrator, you are asserting that your IdP always asserts that ePPN for the same individual. Further, you are asserting that the ePPN always belongs to the intended individual. If you don't trust the IdP to guarantee an ePPN's uniqueness, don't provision a Delegated Administrator with that ePPN.Changing a user's ePPN can cause the user to lose access or inadvertently reassign access to the wrong person.  

What if my organization does not have an Identity Provider published in InCommon?

Federation Manager can support supports Delegated Administrator sign in using Google accounts via the Google Gateway. Because a Google account address does not always end in “@gmail.com”, enter the user's ePPN in the following format:

    username+domain@google.incommon.org

For example,  if the user has a Google account address of 

    foo@gmail.com

enter the user's ePPN in the following form:

    foo+gmail.com@google.incommon.org

See the Google Gateway wiki page for more information.

View and update a Delegated Administrator's profile

Select "Manage Delegated Administrators" from the "Delegated Administrators" drop down menu.

Click On the Deleted Administrators page, click a Delegated Administrator's name to see his/her profile. The profile , including includes a listing list of Service Providers s/he can manage.

Click the "Edit" link to the right for quick access to edit the DA's profile (name, email, phone, title) information.

Assigning

management of an existing SP to a Delegated Administrator

Select "Assign SP Metadata" from the "Delegated Administrators" drop down menu.

To allow a DA to manage an existing SP, you need to explicit grant the DA the ability to manage that SP. If you don't assign a delegated administrator to an SP, that delegated administrator will only be able to create new SP metadata.

To grant a DA the ability to manage an SP, on the Delegated Administrator page, click the ">ASSIGN SP METADATA" link:

Image Removed

Be aware of update contention in the Delegated Administration module

The Delegated Administrator module in Federation Manager does not perform record locking when a user edits metadata. If you assign multiple DAs the ability to manage the same SP , be aware that they may simultaneously edit and submit metadata without being aware that another DA has already submitted an update request for the same entity descriptor. For this reason, we recommend assigning at most one Delegated Administrator per SP.

A note about managing those ancient Delegated Administrator assignments

If you provisioned one or more delegated administrators prior to November 19, 2012 (when an upgrade to delegated administration occurred), please do the following:

1. Log into the Federation Manager and click the link “Delegated Administrators”
2. On the delegated administration page, click the link "Assign Metadata to Delegated Administrators"
3. Next to the entityID of some SP, select the desired delegated administrator from the drop-down menu and press the “Add” button
4. Repeat the previous step for every delegated administrator that needs to edit SP metadata

Each delegated administrator assigned as described above should now be able to edit SP metadata.