Guideline for Service Owners

We provide you with the flexibility to connect your services to our IdP solutions through two protocols: SAML and OIDC. These protocols ensure a secure and smooth integration, allowing for seamless authentication and authorization processes for your applications.

SAML allows for secure single sign-on (SSO) and federation across different applications and platforms. It enables the exchange of user authentication and authorization information in a standardized way, ensuring smooth communication between your services and our IdPs.

SimpleSAMLphp (https://simplesamlphp.org) is an open-source software package for providing IAM functionalities and features. It is written in PHP and supports straightforward integration of new customizable modules. SimpleSAMLphp is often used to provide authentication and authorization services for web-based applications; however, it also supports native mobile apps and APIs using different protocols, including SAML, OIDC, and OAuth. It is designed to be easy to install and configure and can be used as a standalone application or as a module within other applications.

Shibboleth (https://www.shibboleth.net) is a type of open-source SAML implementation developed by the Shibboleth Consortium. It provides content personalization, secure authentication, and authorization and enables SSO functionality for accessing services in multiple domains. Shibboleth has been designed to be compatible with many organizational domains' infrastructures to support general FIM requirements.

To connect your services to our SAML SSO solution, we request the following information from you:

• SP Metadata (Mandatory): Provide us with the metadata of your service, which typically includes information about your organization, entity ID, and SAML endpoints.
• Authorization Policies (Optional): Provide us with the information and conditions on whom and how they can access your services. Example: Only students from the University “ABC” are authorized to access our resources.

Once you have collected this information, please submit it to our support team at sso-support@gwdg.de.

We will provide you with the necessary SAML metadata, which is an XML document containing important configuration details about the IdP you requested to connect. The metadata includes information such as URLs of endpoints, supported bindings, identifiers, and public keys. Depending on your application framework or platform, you will need to locate the appropriate configuration file or settings where you can specify the IdP's metadata. This step ensures that your application recognizes and trusts our IdP. If your application doesn't have built-in SAML support, you can leverage external libraries specifically designed for SAML communication. These libraries provide pre-built functionalities and utilities for SAML authentication, simplifying the integration process. Choose a library that suits your programming language and framework.Please note that the specific implementation details may vary depending on your application framework, platform, and the chosen library. It is recommended to consult the documentation and resources specific to your application or chosen library for detailed instructions. After completing the configuration, thoroughly test the integration by initiating SSO requests and validating the SAML responses. Ensure that the authentication flow is seamless and that user attributes and assertions are correctly processed.