PurpleID Support

If you are having trouble signing into PurpleID or need assistance enrolling multi-factor authentication (MFA), please review the frequently asked questions or contact your local IT Service Desk for support.
 
If you are a FedEx app owner/developer and need assistance onboarding your app to PurpleID for single sign-on (SSO), please follow the procedures below. The procedures have been grouped into 3 buckets depending on the architecture of your app.


SaaS Apps



These are normally commercial vendor hosted applications that leverage the SAML 2.0 protocol for SSO. These applications are ready to use and do not involve any major software development. You can also choose this option for on-premise applications that support SAML 2.0.

Cloud Native Apps

These are normally apps written by FedEx software developers and hosted in either a public, private, or hybrid cloud. These apps are often developed as part of a Cloud Dojo engagement and normally leverage the OpenID Connect/OAuth2 protocol.

Legacy Apps



[ IN - CONTAINMENT / EXISTING APPS ONLY ]
These are normally apps running in a FedEx data center that can only leverage legacy authentication protocols such as header based and kerberos. These applications will need to be proxied by the PurpleID Access Gateway solution.

Software-as-a-Service (SaaS) App Onboarding Process

Step 1
IMAGE Groups

The initial step for onboarding your application is to request IMAGE managed groups. These groups will be used to assign the application access to end users. All applications are now required to tie the user access with IMAGE managed groups/roles. 

Step 2
App Metadata

FedEx requires certain information about the SaaS application to configure the security policies for the application access. An Excel template is provided for the SaaS vendor to fill in the required details about the application.

Step 3
Onboarding

This is the final step where the FedEx business team engages PurpleID team to on-board the application and provide us with the IMAGE groups and app metadata via a PDSM request. 

Step 1: IMAGE Groups 

Request IMAGE Groups 

If you already have existing IMAGE managed groups which can be used to authorize access to your SaaS application access, you can skip this step. If you do NOT have IMAGE managed groups, you will need to request the groups from Identity Management (IdM) team. You can also request the IdM to bulk load all the users at the time of group creation so that all of the application users are already provisioned to the group. Any new users who would like to be added to the group after initial bulk load will need to request the access from IMAGE > Manage User Access. There is no limitation on the number of groups you can associate with your application, but you should only request multiple groups if your application can utilize them for authorization purposes.

STEP 1: Download the PurpleID IMAGE Role Onboarding Template from here.

STEP 2: Complete the PurpleID IMAGE Role Onboarding template following the guidelines from the Role description conventions document. Include all of the end users that needs to be bulk assigned with the role in the tab 'Bulk Load Users' in the same Excel spreadsheet.

STEP 3: Submit the ePDSM request and attach the Onboarding template to your ePDSM request. You can access the IMAGE Request form directly from here. Select 'I Need to Integrate My Application or Maintain My Integrated Application' for the Topic and 'Role Onboarding/Maintenance' for Subtopics.

STEP 4: The IMAGE support team will work on your request and complete the initial bulk load of users. Once you hear that your request is complete, you can proceed for the next step - App Metadata. 

* * *

NOTE: If your application has an extremely large user base, your application can be dynamically assigned to users in PurpleID based on HR attribute patterns. This functionality is now managed by IMAGE and referred as IMAGE Birthright Role. 

Please use this IMAGE Request template for requesting a Birthright Role. 

If you intend to dynamically assign access to your applications using HR attribute patterns, please request IMAGE Birthright Role based on HR attributes and once the role is onboarded to IMAGE, include the same IMAGE Birthright Role name in the "Step 2: App Metadata - Request SaaS App Metadata" section below.

Step 2: App Metadata

Request SaaS App Metadata

FedEx requires certain application metadata (SAML 2.0 specific) from the SaaS provider to configure the application access from FedEx side. FedEx will be the Identity Provider (IdP) and the SaaS provider will act as Service Provider (SP). We have created a template with all the required information so that you can send the template to the SaaS provider/vendor to populate the configuration values. Once the vendor completes the information in the template you can simply attach the template to your PDSM request along with other information like IMAGE Groups. 

The template can be downloaded from here.

STEP 1: Please download the template and send to your SaaS provider/vendor and ask them to complete the information in the spreadsheet.

STEP 2: Once you receive the completed template from your SaaS provider/vendor, please populate the IMAGE group and EAI information in the spreadsheet. 

STEP 3: Please ensure you have populated all the information in the spreadsheet. Any missing information will add to the delays in information processing and onboarding.

Step 3: Onboarding

Onboarding Request Process

STEP 1: Please submit a PDSM request from here.

STEP 2: Enter the EAI# and select the type of the application as "Software-as-a-Service (SaaS)". Ensure you fill all the information on the PDSM request form.

STEP 3: Attach the SaaS App Metadata template to the PDSM Request Form. Please click on the paper-clip icon on the top of the form in PDSM to attach the template to your PDSM request.

STEP 4: The PurpleID support team will provide you with further instructions on the progress for application onboarding.

NOTE: All Production requests go through multiple PDSM approval workflows and the support team cannot see the request in the queue unless the request is fully approved. 

Important Note: Requests with missing information (especially the IMAGE role information) will be put on hold. Application assignments groups (IMAGE managed) are very essential for the overall security of the SaaS application. The IMAGE managed groups will be used to manage access so that only the members of the group will be able to access the SaaS application.

You can also consider this opportunity to define authorization roles for your SaaS application. This is totally optional based on the capability from the SaaS application/Service Provider. Please see below an idea on how you could request the roles to the SaaS application.

myapp_general_app353535 : Grants general access to the myapp application. Users who require general access should be part of this role.

myapp_admin_app353535 : Grants administrative access to the myapp application. Users who require administrative access should be part of this role.

myapp_manager_app353535 : Grants management level access to the myapp application. Users who require management level access should be part of this role. 

myapp_audit_app353535 : Grants auditor access to the myapp application. Users who require auditor access should be part of this role.

If you have authorization specific groups managed by IMAGE, we can send the group names to the SaaS application when the end-user successfully authenticates. Please notice that only the group names will be sent to the SaaS application and not the group membership details. The SaaS application can further read these group names from the assertion and decide what level of access to be shown to the end user.

Cloud Native App Onboarding Process

Step 1
IMAGE Groups

The initial step for onboarding your application is to request IMAGE managed groups. These groups will be used to assign the application access to end users. For application to application authentication where human users are not in the context, you can skip this step.

Step 2
Platform Integration Info

FedEx requires certain information about the cloud native application to configure the security policies for the application access. 

Step 3
Onboarding

This is the final step where the FedEx business team engages PurpleID team to on-board the application and provide us with the IMAGE groups and platform integration info via a PDSM request. 

Step 1: IMAGE Groups 

Request IMAGE Groups 

Note: For application to application authentication where human users are not in the context, you can skip this step. 

If you already have existing IMAGE managed groups which can be used to authorize access to your cloud native application access, you can skip this step. If you do NOT have IMAGE managed groups, you will need to request the groups from Identity Management (IdM) team. You can also request the IdM to bulk load all the users at the time of group creation so that all of the application users are already provisioned to the group. Any new users who would like to be added to the group after initial bulk load will need to request the access from IMAGE > Manage User Access. There is no limitation on the number of groups you can associate with your application, but you should only request multiple groups if your application can utilize them for authorization purposes.

STEP 1: Download the PurpleID IMAGE Role Onboarding Template from here.

STEP 2: Complete the PurpleID IMAGE Role Onboarding template following the guidelines from the Role description conventions document. Include all of the end users that needs to be bulk assigned with the role in the tab 'Bulk Load Users' in the same Excel spreadsheet.

STEP 3: Submit the ePDSM request and attach the Onboarding template to your ePDSM request. You can access the IMAGE Request form directly from here. Select 'I Need to Integrate My Application or Maintain My Integrated Application' for the Topic and 'Role Onboarding/Maintenance' for Subtopics.

STEP 4: The IMAGE support team will work on your request and complete the initial bulk load of users. Once you hear that your request is complete, you can proceed for the next step - Platform Integration Info. 

* * *

NOTE: If your application has an extremely large user base, your application can be dynamically assigned to users in PurpleID based on HR attribute patterns. This functionality is now managed by IMAGE and referred as IMAGE Birthright Role.

Please use this IMAGE Request template for requesting a Birthright Role.

If you intend to dynamically assign access to your applications using HR attribute patterns, please request IMAGE Birthright Role based on HR attributes and once the role is onboarded to IMAGE, include the same IMAGE Birthright Role name in the "Step 2: Platform Integration Info" section below. 

Step 2: Platform Integration Info

Platform Integration Info

In order to integrate Cloud Native applications with PurpleID. We need some information about the app. Depending on the type of app, please collect the following info:

• EAI# and friendly application name (all app types)
• Single Page App as front-end; REST API service as back-end
          o Front-end Application URLs(*)
          o Back-end API endpoints
          o Back-end EAI# if different from the App EAI#
• Native Mobile App
          o Login Redirect URIs(*)
• Traditional Web App
          o Application URLs(*)
• App to App Authentication
          o Client App EAI#(*):
          o Server App EAI#: if different from client EAI#
          o Scope: The scope named “Custom_Scope” will be                 used if no scope is specified.

Step 3: Onboarding

Onboarding Request Process

STEP 1: Please submit a PDSM request from here.

STEP 2: Enter the EAI# and provide brief description of the application. Select the type of the application as "FedEx developed application".

STEP 3: Ensure you fill all the information on the PDSM request form. 

STEP 4: The PurpleID support team will provide you with further instructions on the progress for application onboarding.

NOTE: All Production requests go through multiple PDSM approval workflows and the support team cannot see the request in the queue unless the request is fully approved.

Important Note: Requests with missing information (especially the IMAGE role information) will be put on hold. Application assignment groups (IMAGE managed) are very essential for the overall security of the Cloud Native applications. The IMAGE managed groups will be used to manage access so that only the members of the group will be able to access the Cloud Native application.

You can also consider this opportunity to define authorization roles for your Cloud Native application. The IMAGE roles can be used to authorize users to the Cloud Native application utlizing the group information included in the JWT tokens. 

myapp_general_app353535 : Grants general access to the myapp application. Users who require general access should be part of this role.

myapp_admin_app353535 : Grants administrative access to the myapp application. Users who require administrative access should be part of this role.

myapp_manager_app353535 : Grants management level access to the myapp application. Users who require management level access should be part of this role. 

myapp_audit_app353535 : Grants auditor access to the myapp application. Users who require auditor access should be part of this role.

Legacy App Onboarding Process

[ In CONTAINMENT ; Support for existing apps ONLY ]
- Not supported for new app on-boarding - 

Step 1
IMAGE Groups

The initial step for onboarding your application is to request IMAGE managed groups. These groups will be used to assign the application access to end users. For application to application authentication where human users are not in the context, you can skip this step.

Step 2
Application Integration Info

FedEx requires certain information about the legacy application to configure the security policies for the application access. 

Step 3
Onboarding

This is the final step where the FedEx business team engages PurpleID team to on-board the application and provide us with the IMAGE groups and application integration info via a PDSM request. 

Step 1: IMAGE Groups 

Request IMAGE Groups 

Note: For application to application authentication where human users are not in the context, you can skip this step. 

If you already have existing IMAGE managed groups which can be used to authorize access to your cloud native application access, you can skip this step. If you do NOT have IMAGE managed groups, you will need to request the groups from Identity Management (IdM) team. You can also request the IdM to bulk load all the users at the time of group creation so that all of the application users are already provisioned to the group. Any new users who would like to be added to the group after initial bulk load will need to request the access from IMAGE > Manage User Access. There is no limitation on the number of groups you can associate with your application, but you should only request multiple groups if your application can utilize them for authorization purposes.

STEP 1: Download the PurpleID IMAGE Role Onboarding Template from here.

STEP 2: Complete the PurpleID IMAGE Role Onboarding template following the guidelines from the Role description conventions document. Include all of the end users that needs to be bulk assigned with the role in the tab 'Bulk Load Users' in the same Excel spreadsheet.

STEP 3: Submit the ePDSM request and attach the Onboarding template to your ePDSM request. You can access the IMAGE Request form directly from here. Select 'I Need to Integrate My Application or Maintain My Integrated Application' for the Topic and 'Role Onboarding/Maintenance' for Subtopics.

STEP 4: The IMAGE support team will work on your request and complete the initial bulk load of users. Once you hear that your request is complete, you can proceed for the next step - Platform Integration Info. 

Step 2: Application Integration Info

Application Integration Info

In order to integrate legacy applications with PurpleID. We need some information about the app. Before you submit the ePDSM request in Step 3, please collect the following info:

• EAI# 
• Environment (Production or non-Production)
• Supporting OpCo
• Application URL(s) (Include VIP/GSS urls if applicble)
• Server Location (EDC/WTC/CoLo etc.)
• Is your application hosted on single or multiple servers? 
• Do you need us to do authorization at per URL level?
• Application Owner (Management level only)
• Technical Contact
• Any additional information

Step 3: Onboarding

Onboarding Request Process

STEP 1: Please submit a PDSM request from here.

STEP 2: Enter the EAI# and select the type of the application as "FedEx developed application". If the application is commercial off the shelf application, please do select as "FedEx developed application".

STEP 3: Provide a brief description of the application function and go live date. Select the type of the application as "Legacy Header-Based App (Formerly WSSO)" and provide all the information from Step 2: Application Integration Info.  

STEP 4: The PurpleID support team will provide you with further instructions on the progress for application onboarding.

NOTE: All Production requests go through multiple PDSM approval workflows and the support team cannot see the request in the queue unless the request is fully approved.

           Contact Us