Shibboleth
frentix customers
The integration of Shibboleth is part of the server configuration. For frentix customers, their customer advisor at frentix takes care of the change.
Universities that belong to a Shibboleth federation check the login of their members themselves. A federation is an association of universities that recognise these logins mutually, for example the federation of SWITCH in Switzerland. With Shibboleth, these people log in to OpenOlat with the account of their home university. OpenOlat receives no password, only the attributes that the university releases, for example name, e-mail address and field of study. You manage no passwords in OpenOlat, and new members of the university receive their account at the first login.
If Shibboleth is switched on, system administrators find the page in the system administration under:
Administration > Login > Shibboleth
What the server configuration defines
The server configuration is the configuration file of the installation. This file is maintained by the body that operates OpenOlat. The basic configuration is there: the connection to the federation, which attributes OpenOlat takes over into which profile fields and to which organisation new accounts are assigned. The page in the administration only holds the optional authorization rules.
A change to the basic configuration applies only from the next restart. Without Shibboleth switched on, the entry "Shibboleth" is missing from the menu Administration > Login.
Depending on the server configuration, the login page shows a selection of the university via the selection service of SWITCH for Shibboleth, or a simple login form that forwards to the login at the university. The page in the administration is the same in both cases.
First login
When a person logs in via Shibboleth for the first time, OpenOlat guides them through a registration and creates their account. At every further login, OpenOlat matches the profile with the released attributes. If the account is inactive, OpenOlat reactivates it automatically at login, see Deactivation and reactivation.
Administrators see whether a single account logs in via Shibboleth in the "Authentications" tab of the account:
User management > "Account of the person" > Tab "Authentications"
More on this under Manage user settings.
Attribute access control
Not every person who can log in at their university should use OpenOlat. With "Activate attribute access control", you only let in people whose attributes carry an allowed value, for example only members of a certain university or field of study.
You define up to two attributes:
- Shibboleth attribute 1: the name of the attribute that OpenOlat checks, as the university delivers it to OpenOlat. The names are known to whoever connected Shibboleth in the server configuration.
- Allowed values for attribute 1: the allowed values, separated by line break, comma or semicolon. Upper and lower case do not matter.
- Shibboleth attribute 2 and Allowed values for attribute 2: a second attribute with its values, following the same pattern.
A person gets access if one of the two attributes carries one of the allowed values. To everyone else, OpenOlat shows the message "You are not authorized to log in OpenOlat."
Direct link for SSO access
If the login via Shibboleth should start directly from the website of your university, place the "Direct link for SSO access" there. SSO (single sign-on) means: the person logs in once at their university and is thereby also logged in to OpenOlat. The page shows this address. It leads to the login via Shibboleth without a detour via the login page of OpenOlat.
Shibboleth and Switch edu-ID
Switch edu-ID is a personal account at SWITCH that stays with a person even after a change of university. With Shibboleth, by contrast, the person logs in with the account of their university. You connect Switch edu-ID as a cloud login, not via Shibboleth, see Cloud login: Switch edu-ID. Shibboleth and Switch edu-ID can be switched on side by side.
Further information
Mentioned on this page
Life cycles - Overview >
Manage user settings >
Cloud login >
Further reading
Login: Overview >
LDAP >
Login Page >