Custom Entree Federatie integration
Entree Federatie is the Kennisnet service that gives pupils and teachers in primary, secondary and vocational education access to digital learning resources and educational services with a single login. The school logs in through its own electronic learning environment (ELO) or school account, and Entree passes on who is logging in. For a provider of teaching materials or an educational app, that means one integration instead of one per school. Appfront builds that integration: your service connected as a service provider, with the right attributes and roles, tested and ready for production.
What is an integration with Entree Federatie?
An Entree Federatie integration connects your service to the Kennisnet federation. A pupil or teacher starts at your service, chooses their school, logs in through that school's ELO or school account, and returns with a set of attributes. By default these are an encrypted user ID, first name, role (student, employee, staff or affiliate), the BRIN number and the name of the institution, and optionally the ECK iD. Additional attributes, such as surname, email address, class or group, are only provided if the school explicitly gives permission for this via Mijn Entree Federatie.
Without an integration, you manage accounts and passwords per school. Pupils forget their passwords, teachers create classes by hand, and every new school means a new list. With Entree Federatie, a user logs in once for the whole day, using the account the school already has. According to Kennisnet, Magister, SOMtoday, itslearning, Moodle environments and school environments on Azure AD or ADFS, among others, are already connected as identity providers.
We build this custom because every service needs different data and is built differently. Which attributes you actually need, how you link a user to a school, class or licence, whether you use SAML or OpenID Connect, and whether your service serves multiple customers in a single environment all determine how the integration works. Kennisnet publishes the technical documentation for service providers openly on the Developers wiki, with metadata for staging and production and a Reference Identity Provider for testing. That is what we build on.
One login
The school's account.
Minimal
Only the attributes you need.
Thoroughly tested
Staging first, then production.
How we build your Entree Federatie integration
We start with your service: how users currently log in, what data you need from them, how you manage schools and licences, and what technology your service runs on. Then we build the integration on the Entree Federatie staging environment and test with the Reference Identity Provider, with standard and additional attributes and with different roles. Once that checks out, you register the service for production and the first schools go live. After that, we maintain the integration, for example when certificates are renewed and when the federation changes.
Users, data, technology.
Testing with the reference IdP.
Registration and first schools.
Go-live, monitoring, and maintenance when things change.
What an Entree Federatie integration actually does
The components below appear in almost every Entree Federatie integration. Which ones you need depends on your service and on the data you request from schools.
Logging in
SAML or OpenID Connect.
Attributes
Standard and additional.
Rolls
Student, teacher, staff member.
Classes
Groups from the school.
ECK iD
Optional pseudonym.
Metadata
Certificates maintained.
Who we build an Entree Federatie integration for
The integration is intended for providers who want to make their service available to schools in primary, secondary and vocational education, without managing accounts school by school. The more schools you serve, the more it pays off.
Publishers
Digital learning materials.
Educational apps
Practice and testing.
Platforms
Multiple customers in one environment.
New providers
From the very first school.
Technology and integrations
This page is about Entree Federatie for primary, secondary and vocational education. For higher education and research, see our page on the SURFconext integration; if you need data from the student administration system, see our pages on the Magister integration and the Somtoday integration, and for messaging between systems in education, our page on Edukoppeling. You can read about our approach on building software.
Why Appfront for your Entree Federatie integration?
A student who can't log in on a Monday morning, a service that asks for more personal data than necessary, or an integration that stops when a certificate is renewed: each costs a provider the trust of schools. That is what we build on: only the attributes you need, thoroughly tested on staging, and an integration that is maintained when the federation changes.
Minimal
Only necessary data.
Tested
Staging first.
Kept up to date
Including certificate changes.
Security and privacy in an Entree Federatie integration
The integration processes personal data of students and teachers, often minors, which falls under the GDPR and the Privacyconvenant onderwijs (the Dutch education privacy covenant). It requests only the attributes your service needs, stores no more than necessary and records every login with time and outcome.
The integration runs in a European data centre, with encrypted connections. Keys and certificates are kept secured and are not visible to staff. After registration, you as a supplier sign Kennisnet's terms of use; we will go through with you what other agreements you make with schools.
Frequently asked questions about an Entree Federatie integration
Questions that publishers, learning-resource providers and product managers in education ask before getting started.
A Kennisnet service that gives pupils and teachers in primary, secondary and vocational education (po, vo and mbo) access to digital learning resources and educational services with a single login. Users sign in with their school account or an Entree account, and Entree passes on who is signing in.
SURFconext is SURF's federation for higher education and research. Entree Federatie serves primary, secondary and vocational education. A service that caters to both audiences connects to both; the approach is similar, but the attributes and agreements differ.
Entree Federatie supports both. According to Kennisnet, OpenID Connect is easier to integrate, especially in mobile apps. SAML is the obvious choice if your service already uses a SAML library, such as SimpleSAMLphp or Shibboleth.
By default, an encrypted user ID, the first name, the role, the BRIN number and the name of the school, and optionally the ECK iD. You only receive additional attributes, such as surname, email address or class, if the school has explicitly given permission for this.
Kennisnet provides a staging environment and a Reference Identity Provider, which you can use to simulate a user logging in and choose the attributes that are returned yourself. This is how we test roles and additional attributes before the first school goes live.
The user sees a clear message instead of a technical error, and the integration logs the failed login together with the reason. This lets you see whether the problem lies with your service, the school or the federation.
For providers with many schools or a service with its own rules for licences, classes and roles, and for platforms that serve multiple customers in a single environment. If your service already uses a standard package with built-in Entree support, configuring it is often enough.
Want to connect your service to Entree Federatie?
Tell us how users currently log in and what data you need from schools. We will show you how an Entree Federatie integration handles this.