First thing first: publish your SP metadata

To configure your Shibboleth SP to use the InCommon Federation Discovery Service, you must publish your SP's metadata in InCommon. To guard against security compromises, the Discovery Service will only direct users to the Discovery Response Endpoint in your published metadata. If you have not done so, update your metadata first before you configure your Shibboleth 2.x SP to use the InCommon Federation Discovery Service.

Determine your Discovery Response Endpoint

With Shibboleth SP version 2.4 and later, the location of your Discovery Response Endpoint is:

https://<i>host</i>/Shibboleth.sso/Login

where host is the hostname of your SP.

The same endpoint also applies for Shibboleth SP 2.3.1 or easier if you have configured your <SessionInitiator> according to the example provided in the Configure Shibboleth SP version 2.3.1 (or earlier) section below.

To add your Discovery Response Endpoint to your published SP metadata, follow the instruction in 2024-04-05_19-15-43_Configure a service provider to use the Discovery Service.

Configuring Shibboleth SP version 2.4 or later

For SP 2.4 and later, the <SSO> element in shibboleth2.xml should include the following:

<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.incommonfederation.org/DS/WAYF">
SAML2 SAML1
</SSO>

Configure Shibboleth SP version 2.3.1 (or earlier)

Modify your SP 2.3.1 (or earlier) configuration file (shibboleth2.xml) to include a <SessionInitiator> of type SAMLDS, and URL pointing to https://wayf.incommonfederation.org/DS/WAYF:

<SessionInitiator type="Chaining" Location="/Login" id="Login" isDefault="true" relayState="cookie">
     <SessionInitiator type="SAML2"
        defaultACSIndex="1" acsByIndex="false" template="bindingTemplate.html" />
     <SessionInitiator type="Shib1" defaultACSIndex="5" />
     <SessionInitiator type="SAMLDS" URL="https://wayf.incommonfederation.org/DS/WAYF" />
</SessionInitiator>

Additional information

Shibboleth 2.4 SP SSO https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO

Shibboleth 2.x SP SessionInitiator https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator

Get help