What is SAML and what do we use it for? How to set-up a new application with SAML

What is SAML?

SAML is an acronym used to describe the Security Assertion Markup Language (SAML). Its primary role in online security is that it enables you to access multiple web applications using one set of login credentials. It works by passing authentication information in a particular format between two parties, usually an identity provider (idP) and a web application.

What is Shibboleth?

Shibboleth is a web-based software tool that supports single sign-on (SSO) between two applications or between two organizations. It is an open-source tool and mainly used for Single Sign-On (SSO) using SAML protocol.

What is an SP, IdP and Attribute?

  • Service Provider (SP) - An SP is a web service that provides services/resources to a user that has been authorized to use it (Alma, LibGuides, etc.)

  • Identity Provider (IdP) - An IdP acts as a data source for user information and acts as an authenticator to validate users before they can access the SP

  • SAML Attribute - An Attribute is a means for delivering information to the Service Provider about the authenticated user after logging into the application/resource

Minimum SAML Attributes Required

  • Minimal Attribute Bundle

    • Name Identifier: SAML2 Transient NameID

    • User Attribute: eduPersonScopedAffiliation

This translates to using these two attributes:

User attribute #1: eduPersonTargetedID
User attribute #2: eduPersonScopedAffiliation 

Found here: under Default Attribute Release For Wisconsin Federation.

We use eduPersonTargetedID because it is a persistent, non-reassigned, opaque identifier for a principal.  We want to limit passing PII (Personal Indentifiable Information) to our SPs. Using eduPersonTargetedID the adminstrators of the system cannot trace that value back to a person.

EPPN alone may not be Sensitive or Restricted, but in combination with first/last name it could be classified as Sensitive or Restricted.  We recommend not using EPPN because of this.

DoIT has also created a base32-encoded version (no special characters) of the eduPersonTargetedID; the name is urn:oid: / wiscEduPairwiseID, an example value is "G3O3UG6KOFXHXTIKVNJ4B3BCSL57XYQM".

Internal Application (Staff use only) Set-up:  can use email and eduWisconsinLibraryPatronID

External Set-up:  Use Minimal Attribute Bundle

Set-up a new Application with SAML

NetID Login Service and Wisconsin Federation Attribute Information


Keywordssaml, sso, single-sign on, shibboleth, authentication, attributes,   Doc ID129415
OwnerKyle S.GroupLibraries
Created2023-06-29 12:59:01Updated2024-03-21 15:05:05
SitesUW-Madison Libraries
Feedback  0   0