diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWAuthProviderExternal.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWAuthProviderExternal.java
index 286726eb75..82b83e7725 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWAuthProviderExternal.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/DBWAuthProviderExternal.java
@@ -45,6 +45,17 @@ public interface DBWAuthProviderExternal<AUTH_SESSION extends DBASession> extend
         @NotNull Map<String, Object> authParameters // Passed auth parameters (e.g. user name or password)
     ) throws DBException;
 
+    /**
+     * Returns new identifying credentials which can be used to find/create user in database
+     */
+    @NotNull
+    Map<String, Object> authFederatedUser(
+        @NotNull DBRProgressMonitor monitor,
+        @NotNull Map<String, Object> providerConfig, // Auth provider configuration (e.g. 3rd party auth server address)
+        @NotNull String faProvider,
+        @NotNull Map<String, Object> faParameters // Passed federated auth parameters (e.g. assertion ID, session token, etc)
+    ) throws DBException;
+
     /**
      * Validates that external user may be associated with local user
      * @param userCredentials credentials from authExternalUser
diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/auth/provider/AbstractExternalAuthProvider.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/auth/provider/AbstractExternalAuthProvider.java
index 606357882e..a4f089836a 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/auth/provider/AbstractExternalAuthProvider.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/auth/provider/AbstractExternalAuthProvider.java
@@ -18,9 +18,14 @@ package io.cloudbeaver.auth.provider;
 
 import io.cloudbeaver.DBWAuthProviderExternal;
 import io.cloudbeaver.model.user.WebUser;
+import org.jkiss.code.NotNull;
+import org.jkiss.dbeaver.DBException;
 import org.jkiss.dbeaver.model.access.DBASession;
+import org.jkiss.dbeaver.model.runtime.DBRProgressMonitor;
 import org.jkiss.utils.CommonUtils;
 
+import java.util.Map;
+
 /**
  * Abstract external auth provider
  */
@@ -34,4 +39,9 @@ public abstract class AbstractExternalAuthProvider<SESSION extends DBASession> i
         }
     }
 
+    @NotNull
+    @Override
+    public Map<String, Object> authFederatedUser(@NotNull DBRProgressMonitor monitor, @NotNull Map<String, Object> providerConfig, @NotNull String faProvider, @NotNull Map<String, Object> faParameters) throws DBException {
+        throw new DBException("Federated authorization not supported");
+    }
 }