SSO AuthenticationSAML 2.0
Shibboleth
Configure a Shibboleth Identity Provider as a SAML 2.0 identity provider for Safeguard.
Shibboleth
Example values
The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.
In Shibboleth — the relying party / attribute-filter config (you enter these at the IdP):
| Field | Example value |
|---|---|
| ACS URL (Safeguard's SP endpoint, registered as the relying party) | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde/broker/shibboleth/endpoint |
| SP Entity ID (relying party ID) | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde |
| Name ID format | EmailAddress |
email attribute | released mail attribute, aliased to email |
In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):
| Field | Example value |
|---|---|
| Alias | shibboleth |
| Display Name | Sign in with Shibboleth |
| SSO Service URL | https://<idp-host>/idp/profile/SAML2/POST/SSO |
| Entity ID | https://<idp-host>/idp/shibboleth |
| X.509 Certificate | the PEM block below |
-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE------ Add a relying party entry for Safeguard's SP metadata on your Shibboleth Identity Provider (
metadata-providers.xml, or publish Safeguard's Metadata URL where your IdP can fetch it). - Configure an attribute-filter policy releasing the
mailattribute to Safeguard's entity ID as the NameID. - Ensure the released attribute's SAML attribute name (or an attribute-resolver alias for it) is exactly
email— separate from the NameID transform above; Safeguard reads this named attribute. - Note your IdP's SSO endpoint (typically
/idp/profile/SAML2/POST/SSO) and Entity ID (typically/idp/shibboleth), and export the IdP signing certificate. - In Safeguard, click Add Provider → SAML 2.0 → Shibboleth, and enter the SSO endpoint, Entity ID, and certificate.
- Reload the Shibboleth IdP service so the new relying party takes effect.
- Click Test in Safeguard to confirm.
Common errors: an assertion that arrives with no email attribute means the attribute-filter policy isn't releasing mail to Safeguard's entity ID — check attribute-filter.xml.