CESNET WAYF filter creation

Select groups

Select groups of IdPs. If you select at least one group, WAYF will show only IdPs from this list. If you leave this list empty, default list of groups will be used. Default list means all groups having your SP in metadata.

Select entity categories or Sirtfi

Filter entities by entity categories or Sirtfi. Available categories/Sirtfi may be activated by moving them to green or red boxes.

Having a selection in green box filters out entities not matching at least one of the selected categories.
Having a selection in red box filters out entities matching at least one of the selected categories.

The list of Idps may be further adjusted by selecting individual IdPs. When used together with individual IdP filtering, the list shown comprises of IdPs not filtered out by categories filter with possible additions of IdP allow list or possible deductions of IdP deny list.

Select individual IdPs

Filter IdPs either by allow list or deny list.

Having a allow list selection filters out IdPs not on it.
Having a deny list selection filters out IdPs on it.

The list of Idps may be further adjusted by selecting entity categories. When used together with entity categories filtering, the list shown comprises of IdPs not filtered out by categories filter with possible additions of IdP allow list or possible deductions of IdP deny list.

Add hostel IdP

if you want to allow access to users out of federations, you can use special identity provider Hostel IdP. Only valid email is required on Hostel IdP for LoA 1 account. If you want to allow Hostel IdP account creation from WAYF, check option Allow account creation on Hostel IdP.
Allow usage of Hostel IdP
Allow account creation on Hostel IdP


Filter was not generated yet. Generate filter using check boxes above.

Generated filter





Human readable form of filter (just for checking)

Filter was not generated yet. Generate filter using check boxes above.


An error occured during the decoding of your existing filter. Make sure you copied whole filter.
Entered filter differs from the builded one. It can be caused by using IdP, which is not in federation any more. Please, check filter's proper functionality.
Page is communicating with remote server. Please, be patient.