Перейти до вмісту
Спробувати

Operations & Administration (Control)

Sign-in via your own university (SSO)

ДляАдміністраціяОператор

The university connects its sign-in system (SAML 2.0) itself and tests the connection right away — without waiting for us. The operator assigns the email domains to the customer; new accounts then automatically land with the right tenant.

Навіщо#

No additional password for students and staff — and no waiting for a set-up project: the university's IT enters our details, tests and enables. If it does not work that way, the contact route is prefilled with all technical details.

Як це працює#

Маршрут кліківAdministrationConnect university sign-in

  1. 1Operator: open “University sign-in (SSO)” in the administration's bar (address /admin/sso). Under “Assign domain” enter the “Email domain” (only the domain, without @) and the “Customer”, then “Assign” (Рис. 1).
    Рис. 1 “Assign domain”: email domain and customer.
    “Assign domain”: email domain and customer.

    Рис. 1 “Assign domain”: email domain and customer.

  2. 2The list “Assigned domains” shows per row domain, customer and “Sign-in” (Рис. 2). From here the university can continue on its own.
    Рис. 2 “Assigned domains” with customer and type of sign-in.
    “Assigned domains” with customer and type of sign-in.

    Рис. 2 “Assigned domains” with customer and type of sign-in.

  3. 3University administration: open “Connect university sign-in” (address /admin/sso/andocken). Step 1 shows our details for IT: metadata URL (to copy and as a file), entityID, Assertion Consumer Service (HTTP-POST), logout URL and the fingerprint of our certificate.
  4. 4Step 2 lists the attributes the sign-in system should release — with their usual OID names: eduPersonPrincipalName (persistent identifier), mail (required), givenName, sn, displayName, eduPersonScopedAffiliation.
  5. 5Step 3: enter the metadata URL of your own sign-in system or upload the metadata file, then “Save”.
  6. 6Step 4: “Test the connection now” opens the sign-in system in a new window. After signing in with a test account the page shows which attributes arrived and how the person is mapped (identifier, email, name, affiliation, domain) — or the error with an explanation and a suggested fix. A test creates no account.
  7. 7Step 5: after a successful test, “Enable”. From then on the sign-in page offers sign-in with the university account for all addresses of the assigned domains.
  8. 8If it does not work that way: at the bottom of the page a request with all technical details is already filled in — add what does not work and “Send request”.

Налаштування та перемикачі#

  • Вмикається для кожного клієнтаЗа замовчуванням: увімкненоМодуль: Schnittstellen
  • Sign-in started by the sign-in system itself (IdP-initiated) can be switched per connection and is off at first.
  • Test and preview environments have a built-in test identity provider: it behaves like a university's sign-in system, signs with its own test key and delivers the same attributes.

Two steps, two people in charge#

  • Assignment (operator) — the domain decides which customer an account belongs to. Takes effect immediately, also for password sign-in.
  • Connecting (university) — enter the sign-in system, test, enable. No project, no waiting.

What is checked at every sign-in#

  • Signature with the certificate from the stored metadata — never with a key from the message itself; only secure algorithms (RSA with SHA-256 or SHA-512).
  • Exactly one assertion; only the signed content is read further. This rules out wrapping of signed messages.
  • Issuer, consumer URL and audience; validity period with three minutes of permitted clock skew.
  • Reference to our request, bound to the browser that made it; every response is valid exactly once.
  • The email domain belongs to the tenant of the connection — otherwise no sign-in.
  • Encrypted responses are opened (AES-GCM or AES-CBC, key transport RSA-OAEP).

Who may do what — and why so strictly#

Only the operator assigns domains: whoever could enter someone else's domain would inherit another customer's users. The customer's administration enters the sign-in system itself — for its own organisation, on no other tenant. A connection that delivers addresses of a foreign domain is rejected.

Signing out#

Whoever is signed in via the university and signs out is also signed out at the sign-in system if it has a logout URL. If the sign-in system signs out, the session with us ends too.

Поради#

  • Exchanging metadata URLs is easiest: when the university renews its certificate, saving again on our page is enough.
  • Subdomains do not inherit: mail.example.org needs an entry of its own.
  • New accounts are created as learner accounts. Further permissions are granted by the administration — never by the university's sign-in system.

Пов’язані функції#

Довідкові знання