> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to authenticate an application user with SuperOffice legacy federated authentication

> How to authenticate an application user with SuperOffice legacy federated authentication

Before introducing OAuth 2.0, our web services used SuperOffice legacy federated authentication. This is no longer the preferred method.

<Warning>
  This form of authentication is deprecated. **SAML is legacy.** You must use [standard OAuth 2.0 user authentication][1].
</Warning>

**Pre-requisites:**

* You have received a unique [client ID and secret][2]
* You have whitelisted your [redirect URL][3] (GET or POST) with SuperOffice
* You have set up a web page at your redirect URL
* The application user has a valid username and password

**Steps:**

1. Forward users to the SuperOffice online **sign-in page** to authenticate.

   `http://{env}.superoffice.com/login/?app_id=YOUR-APP-ID`

2. Receive the **authentication token** when the sign-in page redirects the user back to your application. The HTTP response contains a form in the body:

   ```html theme={null}
   <form action="redirecturl" method="post">
     <input type="hidden" name="key" value="<value>" />
   </form>
   ```

   The hidden input type has **name** set to SAML or JWT. The value is set to the security token of the corresponding type.

3. [Validate the authentication token][4]. This is required *each time* a token is received to ensure that no attacks happened between sending the authentication request and receiving the authentication response.

[1]: ./index

[2]: ../../../../developer-portal/getting-started/index#terminology

[3]: ../../../../developer-portal/create-app/config/redirects

[4]: ../validate-security-tokens


## Related topics

- [Online authentication](/en/online/identity/federated-auth.md)
- [How to override the certificate resolver](/en/api/authentication/online/certificates/override-resolver.md)
- [Register identity provider (domain name)](/en/online/identity/superid/howto/register-idp.md)
- [Complete user account transition from password to federated login](/en/online/identity/superid/howto/complete-user-transition.md)
- [Validating security tokens](/en/api/authentication/online/validate-security-tokens.md)
- [Federated ID and identity providers](/en/online/identity/federated-id-and-identity-providers.md)