Overview

The Shibboleth IdP UI is an easy-to-use management dashboard to work with the latest releases of the Shibboleth IdP. The new Shibboleth IdP UI dashboard allows users to create and update new service providers to be integrated with IdPs using a friendly graphical user interface. IdP operators can come up to speed and integrate services quickly with minimal training and provides you with an opportunity to delegate IdP management more broadly throughout your organization.

Key Features of IdP UI

Setup Wizard

The Shibboleth IdP UI provides a wizard for adding or modifying creating service providers, metadata providers, and filters, which gives IdP staff and administrators the flexibility to modify existing IdPs. IdP staff will no longer need to understand the intricacies of multiple complex XML files and edit them just to integrate one new service.

Administrative Management

You can accomplish a significant portion of the IdP’s administrative management through Shibboleth IdPUI’s intuitive user interface, including post-installation modifications to Shibboleth IdP.

Integration Management

The Shibboleth IdP UI’s easy-to-understand dashboard and wizard provide the capability to integrate new service providers into the IdP, including managing the initial metadata setup and specifying special settings such as SP authentication overrides and attributes to be released.

Consistency with Shibboleth IdP Modifications

The most common and complex task IdP administrators need to deal with is the metadata and filter information that represent custom configurations of their IdP. Shibboleth IdP UI makes this easy, allowing staff to execute a onetime setup for the modification of selected IdP(s). This helps reduce the long-term maintenance and reduces operational costs.

Integrated Help

The Shibboleth IdP UI dashboard and wizard guide users to choose the right options by providing helpful information and tooltips throughout the setup process.

Security and Privacy Control

The Shibboleth IdP UI allows for the configuration of security policies for service providers such as encryption, signing and multi-factor configuration.

Dashboard

The Shibboleth IdP UI has five dashboard functions: 

• Metadata Source 
• Metadata Provider
• Dynamic Registration
• Admin
• Action Required

A Shibboleth IdP UI Administrator (Administrator) has the ability to view all of these.

Non-Administrator (ROLE_USER and ROLE_ENABLE) only have access to Metadata Source and Dynamic Registration dashboards. These users can only view sources and registration associated with their group.

Users belonging to groups that approve metadata sources and dynamic registrations created by other groups will have the Actions Required tab, but only have access to Approve Metadata Source and Approve Dynamic Registrations and only the sources and registrations created by the approvee's groups will be displayed.

Metadata Source Dashboard

Metadata sources in Shibboleth IdP UI are individual metadata artifacts describing single entities, typically relying parties. The Metadata Source Dashboard displays the metadata sources that have been created using the Shibboleth IdP UI application and with the following information:

• Title of metadata source
• Entity ID
• Authentication Protocol
• Author
• Creation Date
• Approval status
• Enabled status
• Group association

On this screen the Administrator can perform the following functions:

• Search for a specific metadata source
• Access a metadata source configurations 
• Enable or disable a metadata source
• Assign the metadata source to a group
• Delete a metadata source

Metadata Source Search

Users can search for metadata sources by their title, entity ID, authentication code, or author. To perform a search:

1. Log into Shibboleth IdP UI as an Administrator or user with ROLE_USER or user with ROLE_ENABLE.
2. Navigate to the Dashboard → Metadata Sources tab.
3. Click in the Search Files field and start typing your search term.

NOTE: As you start typing in the search field, the list will reduce to show only those metadata sources that match what you have typed.

Enable Metadata Source

Administrators and users with ROLE_ENABLE can enable/disable metadata source. If the metadata source is added by a User, a request will be sent to enable the source. To enable a source from the Metadata Source Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator or user with ROLE_ENABLE.
2. Navigate to the Dashboard → Metadata Sources tab.
3. Toggle the Enabled switch ON. 

NOTE: You can also disable the metadata source by toggling the Enable switch to OFF.

Metadata Source Group Association

Administrators can edit a metadata source's group association. To change a source's group association from the Metadata Source Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Metadata Sources tab.
3. Click in the Group dropdown menu for the corresponding source and select the new group.

Delete Metadata Source

Administrators can delete metadata sources that are currently disabled. To delete a source from the Metadata Source Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Metadata Sources tab.
3. Click delete icon for the corresponding source.
4. Click the Delete button on the confirmation modal.

NOTE: Once a metadata source has been enabled, it cannot be deleted. You will need to disable the source prior to deleting it.

Metadata Provider Dashboard

The application can generate a metadata-providers.xml configuration appropriate for use in the Shibboleth IdP. The Metadata Provider Dashboard displays the metadata provider that have been created using the Shibboleth IdP UI application and with the following information:

• Order
• Title of metadata provider
• Provider Type
• Author
• Creation Date
• Enabled Status

On this screen the Administrator can perform the following functions:

• Search for a specific metadata provider
• Reorder metadata provider list
• Access a metadata provider configuration 
• Enable or disable a metadata provider

Metadata Provider Search

Administrators can search for metadata providers by their title, provider type, or author. To perform a search:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Metadata Providers tab.
3. Click in the Search Files field and start typing your search term.

NOTE: As you start typing in the search field, the list will reduce to show only those metadata providers that match what you have typed.

Reorder Metadata Providers

Administrators can reorder the metadata providers list by following the steps below:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Metadata Providers tab.
3. Click either the UP or DOWN arrow to move a corresponding metadata provider.

Enable Metadata Provider

Administrators can enable/disable metadata source. To enable a provider from the Metadata Provider Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Metadata Providers tab.
3. Toggle the Enabled switch ON. 

NOTE: You can also disable the metadata provider by toggling the Enable switch to OFF.

Dynamic Registration Dashboard

The Dynamic Registration Dashboard displays the registrations that have been created using the Shibboleth IdP UI application and with the following information:

• Title of dynamic registration
• Author
• Creation Date
• Approval status
• Enabled Status
• Group association 

On this screen the Administrator can perform the following functions:

• Search for a specific dynamic registration
• Access a dynamic registration configuration 
• Enable a dynamic registration
• Assign the dynamic registration to a group
• Delete a dynamic registration

Dynamic Registration Search

Users can search for dynamic registrations by their title, entity ID, authentication code, or author. To perform a search:

1. Log into Shibboleth IdP UI as an Administrator or user with ROLE_USER or user with ROLE_ENABLE.
2. Navigate to the Dashboard → Dynamic Registration tab.
3. Click in the Search Files field and start typing your search term.

NOTE: As you start typing in the search field, the list will reduce to show only those metadata sources that match what you have typed.

Enable Dynamic Registration

Administrators and users with ROLE_ENABLE can enable/disable dynamic registrations. If the dynamic registrations is added by a User, a request will be sent to enable the registration. To enable a source from the Dynamic Registration Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator or user with ROLE_ENABLE.
2. Navigate to the Dashboard → Dynamic Registration tab.
3. Toggle the Enable switch ON. 

NOTE: Once a dynamic registration has been enabled, it cannot be switch to OFF or disabled.

Dynamic Registration Group Association

Administrators can edit a dynamic registration's group association. To change a registration's group association from the Dynamic Registration Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Dynamic Registration tab.
3. Click in the Group dropdown menu for the corresponding source and select the new group.

NOTE: Once a dynamic registration's group association has changed, the registration is removed from the view of the original group's members, including the author.

Delete Dynamic Registration

Administrators can delete dynamic registrations that are currently disabled. To delete a registration from the Metadata Source Dashboard: 

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Dynamic Registration tab.
3. Click delete icon for the corresponding registration.
4. Click the Delete button on the confirmation modal.

NOTE: Once a dynamic registration has been enabled, it cannot be deleted. 

Admin Dashboard

The Admin dashboard displays the Shibboleth IdP UI users and the following information about them:

• UserId
• Name
• Email
• Role
• Group

There are three basic user roles in Shibboleth IdP UI:

• ROLE_ADMIN: A user with ROLE_ADMIN, Administrator, is able to view, approve, enable, and modify all metadata sources, metadata providers, and dynamic registrations. They also have access to all administrative functions including the Admin dashboard, Action Required dashboard, and Advanced features.  
• ROLE_ENABLE: A user with ROLE_ENABLE has the ability to create, edit, and enable metadata sources belonging to their group.
• ROLE_USER: A user with ROLE_USER has the ability to create and edit metadata sources belonging to their group, but cannot enable them.

On this screen the Administrator can perform the following functions:

• Assign roles to users

• Assign users to groups

• Delete users

Assigning a Different Role to a User

The Administrator can assign users to different role. To reassign a user to a new role:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Admin tab.                                                                                               
3. Click in the Role dropdown menu for the corresponding user and select the desired role from the list. The role is assigned to the user and a success message is displayed.

NOTE: The Role dropdown menu is populated with the roles in the system, including any custom roles the Administrator has defined.

Assigning users to a group

The Administrator can assign users to different groups. To reassign a user to a new group:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Admin tab.                                                                                         
3. Click the Group dropdown menu for the corresponding user and select the desired group from the list. The user is assigned to the group and a success message is displayed.

NOTE: The Group dropdown is populated with the groups in the system, including any custom group the Administrator has defined. 

Delete a user from Shibboleth IdP UI

The Administrator can delete a user account from Shibboleth IdP UI. To remove a user:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Admin tab.                                                                                         
3. Locate the user you want to remove and click the corresponding delete icon. 
4. Click the Delete button on the confirmation modal.

Action Required Dashboard

The Action Required Dashboard provides the Administrator with five types of notifications:

• Enable Metadata Sources: Displays requests when a user creates a new metadata source.
• Approve Metadata Sources: Displays requests when a user creates a new metadata source for a group that requires an approval.
• Enable Dynamic Registrations: Displays requests when a user creates a new dynamic registration.
• Approve Dynamic Registrations: Displays requests when a user creates a new dynamic registration for a group that requires an approval.
• User Access Requests: User Access Requests prompts administrators to assign roles for new users

Enable Metadata Sources

The Enable Metadata Sources section within the Action Required tab is only available to the Administrators. Administrators can perform the following actions from the Enable Metadata Sources section:

• Access a metadata source configurations
• Enable a metadata source
• Delete a metadata source

To access a metadata source configurations from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab. 
3. Click the Enable Metadata Sources button
4. Click on the title of the source.

To enable a metadata source from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab.                                                                                                                                                                              
3. Click the Enable Metadata Sources button.
4. Toggle the Enabled switch to On for the corresponding metadata source.

A success message is displayed and the items is removed from the list. Return to the Metadata Source Dashboard to verified the metadata source has been enabled. 

NOTE: If the metadata source has not been approved, enabling it will do both, approve and enable it.

To delete a metadata source from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab.                                                                              
3. Click the Enable Metadata Sources button.
4. Click delete icon for the corresponding source.
5. Click the Delete button on the confirmation modal.

A success message is displayed and the items is removed from the list. Return to the Metadata Source Dashboard to verified the metadata source has been deleted. 

Approve Metadata Sources

The Approve Metadata Sources section within the Action Required tab is available to the Administrators and members of groups with the authority to approve other groups' metadata source. Users can perform the following actions from the Approve Metadata Sources section:

• Access a metadata source configurations
• Approve the metadata source

Administrators can also perform the following action from the Approve Metadata Sources section:

• Delete a metadata source

To access a metadata source configurations from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator or members of groups with the authority to approve other groups' metadata source .
2. Navigate to the Dashboard → Action Required tab. 
3. Click the Approve Metadata Sources button.
4. Click on the title of the source.

To approve a metadata source from the Action Required dashboard:

1. Log into Shibboleth IdP UI as the Administrator or members of groups with the authority to approve other groups' metadata source.
2. Navigate to the Dashboard → Action Required tab.
3. Click the Approve Metadata Sources button.
4. Click on the Approve button for the corresponding metadata source.

A success message is displayed and the items is removed from the list. Return to the Metadata Source Dashboard to verified the metadata source has been approved. 

To delete a metadata source from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab.                                                                              
3. Click the Approve Metadata Sources button.
4. Click delete icon for the corresponding source.
5. Click the Delete button on the confirmation modal.

A success message is displayed and the items is removed from the list. Return to the Metadata Source Dashboard to verified the metadata source has been deleted. 

Enable Dynamic Registrations

The Enable Dynamic Registrations section within the Action Required tab is only available to the Administrators. Administrators can perform the following actions from the Enable Dynamic Registrations section:

• Access a dynamic registration configurations
• Enable a dynamic registration

To access dynamic registration configurations from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab. 
3. Click the Enable Dynamic Registration button
4. Click on the title of the registration.

To enable a dynamic registration from the Action Required dashboard:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigate to the Dashboard → Action Required tab.                                                                                                                                                                              
3. Click the Enable Dynamic Registration button
4. Toggle the Enabled switch to On for the corresponding registration.

A success message is displayed and the items is removed from the list. Return to the Dynamic Registration Dashboard to verified the registration has been enabled. 

NOTE: If the dynamic registration has not been approved, enabling it will do both, approve and enable it.

Approve Dynamic Registrations

The Approve Dynamic Registrations section within the Action Required tab is available to the Administrators and members of groups with the authority to approve other groups' dynamic registration. Users can perform the following actions from the Approve Dynamic Registrations section:

• Access a dynamic registration configurations
• Approve the dynamic registration

To access a dynamic registration configurations from the Action Required dashboard:

1. Log into Shibboleth IdP UI as the Administrator or members of groups with the authority to approve other groups' metadata source.
2. Navigate to the Dashboard → Action Required tab. 
3. Click the Approve Dynamic Registration button
4. Click on the title of the registration.

To approve a dynamic registration from the Action Required dashboard:

1. Log into Shibboleth IdP UI as the Administrator or members of groups with the authority to approve other groups' metadata source.
2. Navigate to the Dashboard → Action Required tab.
3. Click the Approve Dynamic Registration button.
4. Click on the Approve button for the corresponding registration.

A success message is displayed and the items is removed from the list. Return to the Dynamic Registration Dashboard to verified the registration has been approved. 

User Access Request

Users can be added using two methods.  The first method is to include the users in the user file during application deployment.  The second method is to insert your IdP in front of the Shibboleth IdP UI application.  You can publish a link to individuals you would like to use the application.  When they receive the link, they can sign in to the application.  The first time a user accesses the application, the user will see a "user request received" notification as shown below, and the new user will be displayed on the administrator Action Required dashboard as shown below:

Once a new user request has been received, the Administrator can assign a role or delete the request.

The User Access Request section within the Action Required tab is only available to the Administrators. Administrators can perform the following actions from the User Access Request section:

• Assign a new role to a user
• Delete the request

To assign a new role to a user from the Action Required dashboard: 

1. Log into Shibboleth IdP UI as the Administrator.
2. Navigate to the Dashboard → Action Required tab. A red circle with a number will appear on the Administrator's Action Required tab on their Dashboard. 
3. Click the User Access Request button. 
4. Locate the new user and click the Role dropdown menu to display the available roles.    
5. Select the desired role from list. 

The role will be assigned to the user, the User Access Request is removed from the list, and a success message is displayed.

To delete the user request from the Action Required dashboard:

1. Log into Shibboleth IdP UI as the Administrator.
2. Navigate to the Dashboard → Action Required tab. A red circle with a number will appear on the Administrator's Action Required tab on their Dashboard. 
3. Click the User Access Request button.
4. Click Delete Request button for the corresponding request. A confirmation message will be displayed as shown below.                                                                                                                                                                                                          
5. Click the Delete button. 

The request is deleted, the User Access Request is removed from the list, and a confirmation message is displayed.

Add New

The Shibboleth IdP UI provides capabilities for the creation of metadata sources, metadata providers, and dynamic registrations. The Administrator has the ability to create all of these while non-Administrator users can only create metadata sources and dynamic registrations.

Add Metadata Source

There are three method for adding a metadata source:

• Create (default option): This option requires the user to enter information manually by following the Create Metadata Source wizard and entering all pertinent information for the metadata source.  Following the last page of the wizard (Attribute Release) the metadata configuration page will be displayed.
• Upload/URL: This option provides the user the ability to bring in existing metadata source information by uploading the information from either a file or a URL. Once the information has been saved, the metadata configuration page will be displayed to allow for modifications to be made to the information uploaded.
• Copy - This option provides the user the ability to bring in existing metadata source information by copying a metadata source that already exists in the Shibboleth IdP UI application.  Once the information has been saved, the metadata configuration page will be displayed to allow for modifications to be made to the information uploaded.

Create metadata source using Security Assertion Markup Language protocol

To create a metadata source using Security Assertion Markup Language (SAML) protocol:

1. Select the Add a new metadata source option from the Add New menu in the upper right navigation.
2. Enter values in the Service Provider Name and Entity ID fields and the Common Attributes button is activated. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

   
   

      

   Each input on the form has a tooltip that provides additional information about the corresponding item: 

   
3. Click the Common Attributes button to continue through the wizard. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the metadata source information: 

   Organization information:                                                                                                                                                                                                   
   User Interface / MDUI information:                                                                                                                                               
   SP SSO descriptor information:                                                                                                                                                    
   Logout endpoints:                                                                                                                                                                     
   Security information:                                                                                                                                                                                                             
   Assertion consumer services:                                                                                                                                                       
   Relying party overrides:                                                                                                                                                                         
   Attribute release:                                                                                                                                                                                   

4. The final page of the wizard displays all of the values enter for the metadata source. You can either change the metadata source configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata source to the database.                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Create metadata source using OpenID Connect protocol

To create a metadata source using OpenID Connect (OIDC) protocol:

1. Select the Add a new metadata source option from the Add New menu in the upper right navigation.                                  
2. Select the OIDC (OpenID Connect) option from the Authentication Protocol dropdown menu.                                                              
3. Enter values in the Service Provider Name and Entity ID fields and the Common Attributes button is activated. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item: 

    
4. Click the Common Attributes button to continue through the wizard. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the metadata source information: 

   Organization information:                                                                                                                                                                                            
   User Interface / MDUI information:                                                                                                                                               
   SP SSO descriptor information: 

                                            

   

5. Logout endpoints:                                                                                                                                                                     
   Security information:                                                                                                                                                                         
   Assertion consumer services:                                                                                                                                                        
   Relying party overrides: 

                                            

                                            

   Attribute release:                                                                                                                                                                                  

6. The final page of the wizard displays all of the values enter for the metadata source. You can either change the metadata source configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata source to the database.                                   

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Upload a metadata source                                                                                                                                                   

To upload a metadata source:

1. Select the Add a new metadata source option from the Add New menu in the upper right navigation.                                  
2. Click on the Upload/URL button.                                                                                                                                                          
3. Enter values in the Service Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    
4. Click the Choose File button and select a file. 

   Note: You can only import a file with a single entityID (EntityDescriptor element) in it. Anything more in that file will result in an error.

    
5. Click the Save button.                                                                                                                                                                          

   All data will be retrieved from the metadata file and the newly uploaded source will appear on the Metadata Source Dashboard.

Create metadata source from a URL

To create a metadata source using a URL:

1. Select the Add a new metadata source option from the Add New menu in the upper right navigation.                                  
2. Click on the Upload/URL button.                                                                                                                                                          
3. Enter a value in the Service Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

   
4. Enter values in the Service Provider Metadata URL and click the Save button.                                                                                      

Copy a metadata source

To copy an existing metadata source:

1. Select the Add a new metadata source option from the Add New menu in the upper right navigation.                                  
2. Click on the Copy button.                                                                                                                                                                    
3. Select the metadata source to copy from the Select the Entity ID to copy dropdown menu.                                                  
4. Enter values in the Service Provider Name and Entity ID fields.                                                                                                        
5. Check the boxes for the corresponding sections of the metadata source to be copied.                                                                      
6. Click the Finished button.                                                                                                                                                                      

7. Click the Save button.                                                                                                                                                                              

Add New Metadata Providers

There are five types of metadata providers:

• FileBackedHTTPMetadataProvider
• FileSystemMetadataProvider
• LocalDynamicMetadataProvider
• DynamicHTTPMetadataProvider
• ExternalMetadataResolver 

Create a File Backed HTTP Metadata Provider

To create a file backed HTTP metadata provider:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Add a new metadata provider  option from the Add New menu in the upper right navigation.                                                                                                                                  
3. Enter a value in the Metadata Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                    

4. Select the FileBackedHTTPMetadataResolver option from the Metadata Provider Type dropdown menu then click the Common Attributes button to continue through the wizard.      
5. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the File Backed HTTP metadata provider information:  

   Common Attributes:                                                                                                                                                                                                                                                                         
   Reloading Attributes:                                                                                                                                                                                                                                                                        
   Metadata Filter Plugins:                                                                                                                                                                                                                                                                   

6. The final page of the wizard displays all of the values enter for the metadata provider. You can either change the metadata provider configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata provider to the database.                                                                                                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Once saved, an Administrator also has the ability to enable the metadata provider for use in an IdP.

Create a File System Metadata Provider

To create a file system metadata provider:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Add a new metadata provider  option from the Add New menu in the upper right navigation.                                                                                                                                  
3. Enter a value in the Metadata Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                    

4. Select the FilesystemMetadataResolver option from the Metadata Provider Type dropdown menu then click the Common Attributes button to continue through the wizard.                
5. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the File Backed HTTP metadata provider information:  

   Common Attributes:                                                                                                                                                                                                                                                                         
   Dynamic Attributes:                                                                                                                                                                                                                                                                          

6. The final page of the wizard displays all of the values enter for the metadata provider. You can either change the metadata provider configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata provider to the database.                                                                                                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Once saved, an Administrator also has the ability to enable the metadata provider for use in an IdP.

Create a Local Dynamic Metadata Provider

To create a local dynamic metadata provider:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Add a new metadata provider  option from the Add New menu in the upper right navigation.                                                                                                                                  
3. Enter a value in the Metadata Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                    

4. Select the LocalDynamicMetadataResolver option from the Metadata Provider Type dropdown menu then click the Common Attributes button to continue through the wizard.          
5. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the File Backed HTTP metadata provider information:  

   Common Attributes:                                                                                                                                                                                                                                                                         
   Dynamic Attributes:                                                                                                                                                                                                                                                                          

6. The final page of the wizard displays all of the values enter for the metadata provider. You can either change the metadata provider configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata provider to the database.                                                                                                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Once saved, an Administrator also has the ability to enable the metadata provider for use in an IdP.

Create a Dynamic HTTP Metadata Provider

To create a dynamic HTTP metadata provider:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Add a new metadata provider  option from the Add New menu in the upper right navigation.                                                                                                                                  
3. Enter a value in the Metadata Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                          

4. Select the DynamicHTTPMetadataResolver option from the Metadata Provider Type dropdown menu then click the Common Attributes button to continue through the wizard.          
5. Navigation through the wizard is controlled by either moving to the previous screen by clicking the Back button or moving to the next screen by clicking the Next button. The wizard guides the user through the following pages to capture the File Backed HTTP metadata provider information:  

   Common Attributes:                                                                                                                                                                                                                                                                         
   Dynamic Attributes:                                                                                                                                                                                                                                                                          
   Metadata Filter Plugins:                                                                                                                                                                                                                                                                   

6. The final page of the wizard displays all of the values enter for the metadata provider. You can either change the metadata provider configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata provider to the database.                                                                                                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Once saved, an Administrator also has the ability to enable the metadata provider for use in an IdP.

Create a External Metadata Resolver

To create an external metadata resolver:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Add a new metadata provider  option from the Add New menu in the upper right navigation.                                                                                                                                  
3. Enter a value in the Metadata Provider Name field. 

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                    

4. Select the ExternalMetadataResolver option from the Metadata Provider Type dropdown menu then click the Common Attributes button to continue through the wizard.                    
5. Enter values in the Metadata Resolver ID and Description fields.                                                                                                                                                                                                    
6. Click the Finish button.                                                                                                                                                                                                                                                                      
7. The final page of the wizard displays all of the values enter for the metadata provider. You can either change the metadata provider configuration details by clicking the Edit link for a section or If no edits are needed, click the Save button to add the information for the metadata provider to the database.                                                                                                                       

   NOTE: If the user navigates away from the wizard prior to saving, the user will be notified that any unsaved changes will be discarded. Therefore, it is necessary to complete the new metadata source wizard in order to save a new metadata source to the database.

Once saved, an Administrator also has the ability to enable the metadata provider for use in an IdP.

Add Dynamic Registration

The Shibboleth IdP UI has been configured to communicate to the Shibboleth OIDC plugin's API using dynamic registration.

Dynamic registration supports the following standard client metadata fields are currently supported:

• Redirect Uris
• Application Type
• Contacts
• Logo Uri
• Policy Uri
• Response Types
• Grant Types
• Jwks
• Scope
• Subject Type
• Token Endpoint Auth Method
• TOS Uri
• Add Dynamic Registration

For additional information regarding Dynamic Registrations visit the OPDynamicClientRegistration Confluence page.

Create a Dynamic Registration

To create a dynamic registration in the Shibboleth IdP UI:

1. Select the Add a new dynamic registration option from the Add New menu in the upper right navigation.                                                                                                                                                                                          
2. Enter values for the Name and Redirect Uris fields. 

   NOTE: On this page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                                                                                                                                

3. The remaining fields are optional and can be left blank or values can be added. For additional information regarding the standard client metadata fields that are currently supported visit Supported Client Metadata.                    
4. Click the Save button to add the information for the dynamic registration to the database.

Configurations

Metadata Source Configuration

When you click a metadata source's title, the Source Configuration screen is opened. This page displays the following common information for the metadata source: 

• Date and time of last saved update
• Author
• Group association
• Enabled status
• Current/Not Current version status
• Options values

On this screen the Administrator can perform the following functions:

• Assign the metadata source to a group
• Enable or disable a metadata source
• Delete a metadata source
• Access version history
• View the source's XML
• Edit the source's options

Assign the Metadata Source to a Group

Administrators can edit a metadata source's group association. To change a source's group association from the Metadata Source Configuration page: 

1. Click in the Group dropdown menu to display the group list.                                                                                                                                                                                
2. Click on the name of the new group from the list.                                                                                                                                                                                              

NOTE: Once a metadata source group association has changed, the source is removed from the view of the original group's members, including the author.

Enable/Disable Metadata Source

To enable a source from the Metadata Source Configuration page:

1. Click the Enable button.                                                                                                                                                                                                                                

   NOTE: The source will show Enabled now and the button has changed to Disable.

2. Click the Disable button to disable the source.                                                                                                                                                                                          

Deleting a Metadata Source

To delete a source from the Metadata Source Configuration page: 

1. Click Delete button located in the upper-right corner.                                                                                                                                                                                  

   NOTE: A confirmation modal is displayed.

2. Click the Delete button on the confirmation modal.                                                                                                                                                                                              

   NOTE: Once a metadata source has been enabled, it cannot be deleted. You will need to disable the source prior to deleting it.

Metadata Source Version History

The Version History page displays all of the versions that were saved for the metadata source. To access a source's version history from Metadata Source Configuration page:  

1. Click on the Version History link.                                                                                                                                                                                                                

The Version History screen is displayed:                                                                                                                                                                                                                  

The following actions can be initiated from this page: 

• Compare versions 
• Display/edit versions
• Restore versions

Compare Versions

To compare versions of a metadata source from the Version History page: 

1. Select two or more boxes for the corresponding versions you want to compare.                                                                                                                                        
2. Click the Compare Selected button.                                                                                                                                                                                                      

Full Data Display

When two or more versions are selected to compare, the Compare Source Configuration will be displayed.  This display shows all data fields for the metadata source and highlights the fields that are different between the versions.  

Changes Only Display

An additional option is available by toggling the View Only Changes field.  The page displayed will display only the fields that have changed.

Restore Version

To restore a metadata source to a previous version from the Version History page: 

1. Click the Restore link for the corresponding version you want to restore.                                                                                                                                                            
2. Click the Restore button.                                                                                                                                                                                                                              
3. Click the Save button.                                                                                                                                                                                                                                              

Once you click the Save button, a new version is created and the configuration page is displayed. The new version contains the information that was saved for the version selected.

Metadata Source XML 

To display a source's  XML version from Metadata Source Configuration page:

1. Click the XML link.                                                                                                                                                                                                                                                        
2. To return to the Options view, click the Options link.                                                                                                                                                                                            

Edit Metadata Source

To edit the source's options from Metadata Source Configuration page:

1. Click on the Edit link for one of the source's section.                                                                                                                                                                                              

   When you click the Edit link in the Source Configuration page, the section you selected to edit is displayed on the page. The link in the left navigation is highlighted indicating the section displayed.                             

2. Make your desired edits for this section and or click on other sections to make edits to their fields.

3. Click the Save button.                                                                                                                                                                                                                                

   NOTE: Multiple sections can be modified prior to selecting Save and the modifications for all sections will be saved.

Metadata Provider Configuration

When you click a metadata provider's title, the Provider Configuration screen is opened. This page displays the following common information for the metadata provider: 

• Date and time of last saved update
• Author
• Enabled status
• Current/Not Current version status
• Options values
• Filters 

On this screen the Administrator can perform the following functions:

• Access version history
• View the source's XML
• Edit the source's options
• Add/Edit/Delete filters:

Metadata Provider Version History

The Version History page displays all of the versions that were saved for the metadata provider. To access a source's version history from Metadata Provider Configuration page:  

1. Click on the Version History link.                                                                                                                                                                                                 

The Version History screen is displayed:                                                                                                                                                                                                         

The following actions can be initiated from this page: 

• Compare versions 
• Display/edit versions
• Restore versions

Compare Versions

To compare versions of a metadata source from the Version History page: 

1. Select two or more boxes for the corresponding versions you want to compare.                                                                                                                          
2. Click the Compare Selected button.                                                                                                                                                                                          

Full Data Display

When two or more versions are selected to compare, the Compare Provider Configuration will be displayed.  This display shows all data fields for the metadata provider and highlights the fields that are different between the versions.  

Changes Only Display

An additional option is available by toggling the View Only Changes field.  The page displayed will display only the fields that have changed.

Restore Version

To restore a metadata provider to a previous version from the Version History page: 

1. Click the Restore link for the corresponding version you want to restore.                                                                                                                                        
2. Click the Restore button.                                                                                                                                                                                                               
3. Click the Save button.                                                                                                                                                                                                                               

Once you click the Save button, a new version is created and the configuration page is displayed. The new version contains the information that was saved for the version selected.

Metadate Provider Filters

There are three types of filters you can add to a metadata providers:

• EntityAttributes
• NameIDFormat
• Algorithm

Add Filter with Search Type: Entity ID

To add an EntityAttributes filter to a metadata provider from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the page.                                                                                                                                                            
2. Click the + Add Filter link.                                                                                                                                                                                                                            
3. Select the desired filter option from the Metadata Filter Type menu.                                                                                                               

   NOTE: Each input on the form has a tooltip that provides additional information about the corresponding item:                                          

4. Once the filter type is selected, the page will expand to display the data fields that can be entered for that filter type.  The interface is similar to the provider edit interface in that there is a left-hand navigation for the different sections of the filter's definition.  
   

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

   Filter Target:                                                                                                                                                                                                                                                                                
   Options:                                                                                                                                                                                                                                                               
   Attributes: 

5. Enter a value in the Filter Name field.                                                                                                                                                                                                            
6. Select the search criteria from the Search Criteria by Entity ID menu or enter a new criteria then click the Add Entity ID + button.                             
7. Once you have completed all the screens, click the Save button.                                                                                                                                                                      

Add Filter with Search Type: Regex

To add an EntityAttributes filter to a metadata provider from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the page.                                                                                                                                                            
2. Click the + Add Filter link.                                                                                                                                                                                                                            
3. Select the desired filter option from the Metadata Filter Type menu.                                                                                                               

   NOTE: Each input on the form has a tooltip that provides additional information about the corresponding item:                                          

4. Once the filter type is selected, the page will expand to display the data fields that can be entered for that filter type.  The interface is similar to the provider edit interface in that there is a left-hand navigation for the different sections of the filter's definition.  
   

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

   Filter Target:                                                                                                                                                                                                                                                                                
   Options:                                                                                                                                                                                                                                                               
   Attributes:                                                                                                                                                                                                                                                                                                                                                        

5. Enter a value in the Filter Name field.                                                                                                                                                                                                            
6. Select the Regex option from the Search By menu.                                                                                                                                                                                                  
7. Enter a value in the Regex field.                                                                                                                                                                                                                          
8. Once you have completed all the screens, click the Save button.                                                                                                                                                                            

Add Filter with Search Type: Script

To add an EntityAttributes filter to a metadata provider from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the page.                                                                                                                                                              
2. Click the + Add Filter link.                                                                                                                                                                                                                              
3. Select the desired filter option from the Metadata Filter Type menu.                                                                                                               

   NOTE: Each input on the form has a tooltip that provides additional information about the corresponding item:                                          

4. Once the filter type is selected, the page will expand to display the data fields that can be entered for that filter type.  The interface is similar to the provider edit interface in that there is a left-hand navigation for the different sections of the filter's definition.  
   

   NOTE: On each page, fields that require information to be entered are denoted by a '*' at the end of the description for the field.

   Filter Target:                                                                                                                                                                                                                                                                                
   Options:                                                                                                                                                                                                                                                               
   Attributes:                                                                                                                                                                                                                                                                                                                                                        

5. Enter a value in the Filter Name field.                                                                                                                                                                                                                      
6. Select the Regex option from the Search By menu.                                                                                                                                                                                                                                                                                                                                                                                                 
7. Enter a value in the Script field.                                                                                                                                                                                                                                    
8. Once you have completed all the screens, click the Save button.                                                                                                                                                                                                       

Reorder Filters

To reorder filters from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the page.
2. Click either the UP or DOWN arrow to move a corresponding filter.                                                                                                                                                            

Enable Filters

To enable filters from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the
2. Toggle the Enabled switch ON for the corresponding filter.                                                                                                                                                                            

NOTE: You can also disable the metadata provider by toggling the Enable switch to OFF.

Edit Filters

To delete filters from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the
2. Click on the title of the desired filter to be deleted.                                                                                                                                                                                          
3. Click on the Edit link.                                                                                                                                                                                                                                                                                                                                                                                                                                                  

4. Make your desired edits for this section and or click on other sections to make edits to their fields.

5. Click the Save button.                                                                                                                                                                                                                                 

   NOTE: Filters do not have a separate version number to select from version history.  When metadata provider versions are selected, the filters corresponding to each metadata provider version selected are displayed below the metadata provider data at the bottom of the page.     

Metadata Filter Comparison selection

The order of the filters may not be the same for each metadata provider. Click the checkbox next to the corresponding filters (same filter name) to compare the values for the filter.  The differences will the be displayed.   

Delete Filters

To delete filters from Metadata Provider Configuration page:

1. Either click the Filters link or scroll to the bottom of the
2. Click on the title of the desired filter to be deleted.                                                                                                                                                                                                                                                                                      
3. Click on the Delete link.                                                                                                                                                                                                                                                                                                                                  
4. Click the Delete button on the confirmation message.   

Metadata Provider XML 

To display a source's  XML version from Metadata Source Configuration page:

1. Click the XML link.                                                                                                                                                                                                                                                                                                                                          
2. To return to the Options view, click the Options link.                                                                                                                                                                                                                                                                                          

Edit Metadata Provider

To edit the source's options from Metadata Source Configuration page:

1. Click on the Edit link for one of the source's section.                                                                                                                                                                                                                                                                                    

   When you click the Edit link in the Source Configuration page, the section you selected to edit is displayed on the page. The link in the left navigation is highlighted indicating the section displayed.                                            

2. Make your desired edits for this section and or click on other sections to make edits to their fields.

3. Click the Save button.                                                                                                                                                                                                                                                                                                                                    

   NOTE: Multiple sections can be modified prior to selecting Save and the modifications for all sections will be saved.

When you click the Edit link in the Provider Configuration page, the section you selected to edit is displayed on the page.  The link in the left navigation is highlighted indicating the section displayed.  The following functions can be performed on this page:

• Modifications can be made to the data on the page
• Data can be saved by clicking the Save button.  All modifications for the metadata source will be saved and the Source Configuration page will be displayed.  Note:  Multiple sections can be modified prior to selecting Save and the modifications for all sections will be saved.
• Clicking the Cancel button will cause the Source Configuration to be displayed and all modifications made since the last Save will be ignored.
• Clicking the link for another section in the left navigation will initiate the display of a new page containing the data for that section.

In addition to editing the information that was included during the add process for a metadata provider, Advanced Settings may also be modified.  Click the Advanced Settings link in the left navigation and toggle the switch at the top of the page to unlock the fields for editing.

Note:  Advanced Settings are an advanced function and should not normally need to be modified.

Dynamic Registration Configuration

When you click a dynamic registration's title, the Dynamic Registration Configuration screen is opened. This page displays the following common information for the Dynamic Registration: 

• Date and time of last saved update
• Author
• Group association
• Enabled status
• Options values

On this screen the Administrator can perform the following functions:

• Assign the registration to a group
• Enable the registration
• Delete the registration
• Edit the source's options

Administrators can edit a dynamic registration's group association. To change a registration's group association from the Dynamic Registration Configuration page: 

Assign the Dynamic Registration to a Group

Administrators can edit a dynamic registration's group association. To change a registration's group association from the Dynamic Registration Configuration page: 

1. Click in the Group dropdown menu to display the group list.                                                                                                                                                            
2. Click on the name of the new group from the list.                                                                                                                                                                                                                                                                                                                                                                                                                                        

NOTE: Once a dynamic registration group association has changed, the registration is removed from the view of the original group's members, including the author.

Enable a Dynamic Registration from the Configuration screen

To enable a registration from the Dynamic Registration Configuration page:

1. Click the Enable button.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                

   NOTE: The source will show Enabled now and the button has changed to Disable.

Deleting a Dynamic Registration from the Configuration screen

To delete a registration from the Dynamic Registration Configuration page: 

1. Click the Delete button located in the upper-right corner.                                                                                                                                                         

   NOTE: A confirmation modal is displayed.

2. Click the Delete button on the confirmation modal.
   
   

   NOTE: Once a dynamic registration has been enabled, it cannot be deleted. 

1. Edit a Dynamic Registration

   To edit a registration from the Dynamic Registration Configuration page: 

   1. Click the Edit link located in the upper-right corner.                                                                                                                                                                

   2. Make your desired edits for this section and or click on other sections to make edits to their fields.

   3. Click the Save button.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

   Advanced Features

   The Shibboleth IdP UI has five Advanced functions: 

   • Custom entity attributes
   • Attribute bundles
   • Groups
   • Roles
   • Shibboleth Configurations

   Custom Entity Attributes

   Custom Entity Attributes can be added by an administrator. These attributes become options on the Relying Party Overrides section when configuring a Metadata Source or an Entity Attributes Filter. The Custom Entity Attributes screen displays the custom entity attributes created in the Shibboleth IdP UI application and has the following information about them:

   • Attribute Name
   • Type
   • Help Text
   • Default Value

   On this screen the Administrator can perform the following functions:

   • Create a new attribute

   • Edit an existing attribute 
   • Delete an attribute

Add new custom entity attribute

To create a custom entity attribute:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Custom entity attribute  option from the Advanced menu in the upper right navigation.                                                                                  
3. Click the Add new attributes button.                                                                                                                                                                                                  

   NOTE: The fields that require information to be entered are denoted by a '*' at the end of the description for the field. 

                                                                                                                                                                         
4. Enter a values for the Custom Entity Attribute Name field. 

   Name: The name of the entry used to uniquely identify this entry.

    

   Each input on the form has a tooltip that provides additional information about the corresponding item:                                                                                             

5. Select an option from the Attribute Type menu. 

   Attribute Type: The type to use when displaying this option.

     

   It is possible to create the following types of Entity Attributes:

   -String (simple plain text)                                                                                                                                                                                                                                            
   -Boolean (allows options to store as a string or boolean value)                                                                                                                                                                                                        
   -List (list of strings with a default option)                                                                                                                                                                                                                                            
   -Long (stored as a string)                                                                                                                                                                                                                                                                  
   -Double (stored as a string)                                                                                                                                                                                                                                      
   -Duration (stored as a string in the ISO-8601 duration format) example: PT1H                                                                                                                                                                            
   -Spring Bean ID (stored as a string)                                                                                                                                                                                                                                                  

6. After the attribute type has been select, enter the attribute value for the type: 

   -Default Value: One or more values to be displayed as default options in the UI
   -Persist Type: Optional. If it is necessary to persist something different than the override's display type, set that type here. For example, display a boolean, but persist a string.
   -Persist Value: Required only when Persist Type is used. Defines the value to be persisted.

7. Enter a values for the Friendly name field. 

   Attribute Friendly Name: This is the friendly name associated with the above attributeName.

   
8. Enter a values for the Attribute name field. 

   Attribute Name: This is the name of the attribute to be used in the xml. This is assumed to be a URI.

   
9. Enter a values for the Display name field.  

   Display Name: This will normally be the label used when displaying this override in the UI.

   
10. Optional: Enter a values for the Help Text field. 

    Help Text: This is the help-icon hover-over text.

    
11. Click the Save button.                                                                                                                                                                                                                                                                        

Once the custom entity attribute has been created, the attributes will appear as an option on:

1. Relying Party Overrides screen for Metadata Source using the SAML protocol.                                                                                                                                                                                
2. Options screen for Entity Attributes Filter.                                                                                                                                                                                                                                          

Edit a custom entity attribute

To edit a custom entity attribute:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Custom entity attribute  option from the Advanced menu in the upper right navigation.                                                                                                                                            
3. Click on the Edit icon.                                                                                                                                                                                                                                                                        

4. Make your desired edits and click the Save button.                                                                                                                                                                                                                          

Delete a custom entity attribute

To create a custom entity attribute:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Custom entity attribute  option from the Advanced menu in the upper right navigation.                                                                                                                                            
3. Click on the Delete icon.                                                                                                                                                                                                                                                                      
4. Click the Delete button on the confirmation modal.

Attributes bundles

The Attributes Bundles screen displays the attributes bundles created in the Shibboleth IdP UI application and has the following information about them:

• Bundle Name
• Bundle Attributes

On this screen the Administrator can perform the following functions:

• Create a new bundle attribute 

• Edit an existing bundle attribute 
• Delete a bundle attribute 

Create an Attribute Bundle

Attribute Release bundles can be created as a convenience feature for metadata creators. This allows an administrator to select from the list of custom attributes defined in the `application.yml` file.

To create an attribute bundle:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Attribute bundle option from the Advanced menu in the upper right navigation.                                                        
3. Click on the Add bundle button.                                                                                                                                              
4. Enter a values for the Bundle Name field, used only to identify the bundle to the user in the UI.                                                                                                                                                  
5. Check the boxes for the attributes you want to add to the bundle. This is a list of available attributes defined in the system.            
6. Click the Save button.                                                                                                                                                                                                                                                                                                                                                                                                                                             

7. Mouse over the list of bundled attributes will display the full list of attributes defined in the bundle, in case the list is too long to display in the bundle list table.                                                  

   
   

Once the attributes bundle has been created, a user can select these bundles when creating a new metadata source, dynamic registration, or entity attributes Filter. On the Attribute Release page, the bundles are displayed above the list of attributes. Clicking the Select Bundle button to the right of the bundle name will select the checkboxes below for the attributes in that bundle. This allows the user to select multiple attributes:

1. Attributes Release screen for metadata source or dynamic registration.                                                                                                                                                                                                                                                       
2. Attributes screen for entity attributes filter.                                                                                                                                                                                                                                                                                                                                           
3. Clicking the check button to the right of the bundle name will select the checkboxes below for the attributes in that bundle.                                                                                                                                                                                                                   

Groups

Groups can be defined by an administrator using the Groups page. Metadata sources, dynamic registrations, and users can belong to a group, and each user may have a role within the context of that group. When a user is created in the system, they are added by default to their own user group which is generated at the same time, unless a specific group is specified. When a metadata source or dynamic registration is created, that source or registration is added to the creator's group.

On the Groups Management screen, the Administrator can perform the following functions:

• Create a group
• Edit a group
• Delete a group - except the ADMIN-GROUP; this group is required by the system

Creating a group

To create a group:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Groups  option from the Advanced menu in the upper right navigation.                                                                                                                                                                         
3. Click the Add group role button.                                                                                                                                                                                                                                                      
4. Enter values in the Group Name and Group Description fields.                                                                                                                                                                                                       

   NOTE: The URL validation regular expression and Approvers sections are optional.

5. OPTIONAL: Enter a value in the URL validation regular expression field. The URL validation regex field is for administrators to define what entity IDs and assertion consumer service URLs can be targeted by members of that group.                                                                                                                                                                                                                                        

   NOTE: During the metadata source creation process, the Entity ID and any assertion consumer service endpoint URLs will be restricted to matching the URL validation regular expression defined for the members's group. For example, here is a failed validation on the Entity ID:                                                                   

                                               Once it has been corrected, the user can proceed with their metadata source definition:

   

   Similarly, when defining Assertion Consumer Service Endpoints, the URL will be validated against the group's RegEx:

   

   And once it is successful, the user can proceed with their metadata source definition

   

6. OPTIONAL: Select an option from the Approvers menu.                                                                                                                                                                                                                  

   NOTE: This provides an additional level of approval for metadata sources and dynamic registrations, granting the approver group(s) the authority to approve an un-enabled Metadata Source. 

   Metadata sources and dynamic registrations belonging to a group that has approval groups assigned to it cannot be enabled by a delegated enabler until it has been approved by a user from one of the approval groups.

7. Click the Save button.                                                                                                                                                                                                                                                                         

The Groups Management page is displayed, the new group has been added to the list, and a success message is displayed.

Roles

There are three basic user roles in Shibboleth IdP UI:

• ROLE_ADMIN: A user with ROLE_ADMIN, Administrator, is able to view, approve, enable, and modify all metadata sources, metadata providers, and dynamic registrations. They also have access to all administrative functions including the Admin dashboard, Action Required dashboard, and Advanced features.  
• ROLE_ENABLE: A user with ROLE_ENABLE has the ability to create, edit, and enable metadata sources belonging to their group.
• ROLE_USER: A user with ROLE_USER has the ability to create and edit metadata sources belonging to their group, but cannot enable them.

On the Role Management screen the Administrator can perform the following functions:

• Create a new role

• Edit an existing role - except the ROLE_ADMIN; this role is required by the system
• Delete a role  - except the ROLE_ADMIN; this role is required by the system

Creating a Role

The Administrator can create custom roles to apply to users. These custom roles define the user's capability within the group. 

To create a custom role:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Roles option from the Advanced menu in the upper right navigation.                                                                              
3. Click the Add new role button.                                                                                                                                              
4. Enter a value in the Role Name field.                                                                                                                                                
5. Click the Save button.                                                                                                                                                                          

The Role Management page is displayed, the new role has been added to the list, and a success message is displayed. 

At this point, if the Administrator navigates to the Dashboard → Admin tab and clicks in one of the Role menu, the new role will be displayed: 

Edit a Role

To Edit  a role:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Roles option from the Advanced menu in the upper right navigation.                                                                            
3. Click the Edit icon for the desired role.                                                                                                                                                
4. Edit the Role Name field and click the Save button. 

   NOTE: ROLE_ADMIN cannot be edited or deleted as this role is required by the system.

Delete a Role

To create a role:

1. Log into Shibboleth IdP UI as an Administrator.
2. Navigates to the Dashboard → Admin tab and verify the role you will be deleting is NOT assigned to any of the users. If it is, you will need to assign those users a new role prior to deleting their existing role.
3. Select the Roles option from the Advanced menu in the upper right navigation.                                                                              
4. Click Delete icon for the desired role.                                                                                                                                            
5. Click the Delete button on the confirmation popup.                                                                                                                

Configuration Sets 

The Shibboleth IdP UI has built a registry of all supported properties. Administrator can create Shibboleth configuration sets to group these properties for different Shibboleth instances/environments. For example: Development, QA, Productions.

On the Manage Shibboleth configurations screen the Administrator can perform the following functions:

• Create a new configuration set 

• Edit an existing configuration set 
• Delete a configuration set 

Create Configuration Sets

To create a configuration set:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Shibboleth Configurations option from the Advanced menu in the upper right navigation.
3. Click the Create Shibboleth configuration set button.                                                                                                          
4. Enter a value for the Name field.                                                                                                                                              
5. Click in the Add properties dropdown menu to display the available properties.                                        
6. Select one or more properties and click the Add button.                                                                                                 

   NOTE: Once a property has been added, the option is removed from the Add properties menu.

7. OPTIONAL: Populate the Value fields for the properties added in the previous step.                                                                  
8. Click the Save button.                                                                                                                                                            

Download Configuration Set Files

Once a configuration set has been created, the files from the set can be downloaded in two ways:

• Single File
• Separated Files

Edit Shibboleth Configurations

To edit a configuration set:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Shibboleth Configurations option from the Advanced menu in the upper right navigation.
3. Click the corresponding Edit button for the configuration set to be edited.                                                                                  

   The Edit configuration set screen is displayed. Here the Administrator can:

   -Edit the Name field
   -Add or remove properties
   -Edit the Value field for the selected properties

4. Once the changes have been made, click the Save button.

Delete Shibboleth Configurations

To edit a configuration set:

1. Log into Shibboleth IdP UI as an Administrator.
2. Select the Shibboleth Configurations option from the Advanced menu in the upper right navigation.
3. Click the corresponding Delete button for the configuration set to be deleted.                                                                    
4. Click the Delete button on the confirmation popup.                                                                                                            

End of User Guide