# OpenAM Administration Guide
12.10. Managing Federated Accounts

Sidebar | Prev | Up | Next

### 12.10.1. Using Transient Federation Identifiers

OpenAM allows you to link accounts using transient name identifiers, where the identity provider shares a temporary identifier with the service provider for the duration of the user session. Nothing is written to the user profile.

Transient identifiers are useful where the service is anonymous, and all users have similar access on the service provider side.

To use transient name identifiers, specify the name ID format `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` when initiating single sign on.

The examples below work in an environment where the identity provider is `www.idp.example` and the service provider is `www.sp.example`. Both providers have deployed OpenAM on port 8080 under deployment URI `/openam`.

To initiate single sign on from the service provider, access the following URL with at least the query parameters shown.

    http://www.sp.example:8080/openam/saml2/jsp/spSSOInit.jsp?
     idpEntityID=http%3A%2F%2Fwww.idp.example%3A8080%2Fopenam
     &metaAlias=/sp
     &NameIDFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:transient

For a complete list of query parameters, see `spSSOInit.jsp` Parameters.

To initiate single sign on from the identity provider, access the following URL with at least the query parameters shown.

    http://www.idp.example:8080/openam/saml2/jsp/idpSSOInit.jsp?
     spEntityID=http%3A%2F%2Fwww.sp.example%3A8080%2Fopenam
     &metaAlias=/idp
     &NameIDFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:transient

For a complete list of query parameters, see `idpSSOInit.jsp` Parameters.

The accounts are only linked for the duration of the session. Once the user logs out for example the accounts are no longer linked.