Shibboleth

What Is It?

Shibboleth Single Sign-On (SSO) is a federated authentication service that enables UIC students, faculty, and staff to securely access university and third-party applications using their UIC credentials.

Managed by UIC Technology Solutions, Shibboleth provides standards-based authentication through Security Assertion Markup Language (SAML), allowing applications to verify user identities without requiring separate usernames and passwords.

Shibboleth is part of UIC's enterprise identity and access management (IAM) environment, which also includes Microsoft Entra ID. Together, these technologies support secure, centralized authentication across university services and external applications.

Other Service Names

Shibboleth

Single Sign-On (SSO)

Federated Authentication

SAML Authentication

Features

  • Secure Single Sign-On: Shibboleth allows users to authenticate with their UIC credentials to access supported applications, reducing the need to manage multiple usernames and passwords.
  • Federated Identity Management: Shibboleth supports secure authentication between UIC and trusted external organizations, enabling access to participating applications through established identity federation standards.
  • SAML-Based Authentication: Shibboleth uses the SAML 2.0 standard to securely exchange authentication information between UIC's Identity Provider (IdP) and applications acting as Service Providers (SPs).
  • Integration with Third-Party Applications: University departments can request Shibboleth integration for compatible vendor-hosted, cloud-based, and university-managed applications that require UIC authentication.
  • InCommon Federation Support: Shibboleth supports integration with organizations participating in the InCommon Federation, simplifying identity federation and supporting interoperability with higher education and research institutions.
  • Enterprise Identity Integration: Shibboleth complements Microsoft Entra ID within UIC's authentication environment. The appropriate authentication solution depends on application compatibility, security requirements, and university identity management standards.
  • Authentication and Authorization: Shibboleth supports two important identity and access management functions. Shibboleth primarily provides authentication and can release approved identity attributes that applications use to make authorization decisions.
    • Authentication — Verifying Identity: Authentication confirms a user's identity through UIC's centralized authentication environment.
    • Authorization — Determining Access: Authorization determines which applications, resources, or functions an authenticated user may access. Access decisions may depend on application configuration, assigned roles, organizational affiliation, or other authorized attributes.

Requirements

Shibboleth integration is intended for university departments, IT professionals, and application owners who implement or manage applications that require UIC authentication. If an individual or unit is capable of running their own Web server (i.e. physically secure room, maintain security patches, manage user accounts, run backups, install and troubleshoot software, keep, and inspect logs, or use a Technology Solutions’ Virtual Machine), they can make their web server into a Shibboleth Client application server. This will allow web scripts to authenticate clients, using their normal UIC NetID and password, in a very secure manner.

To request an integration, the application must meet the following requirements:

  • SAML 2.0 Compatibility: The application must support SAML 2.0 authentication.​​​​​​​
  • Application Ownership: A designated UIC department, technical contact, or application owner must be responsible for the integration.
  • Service Provider Information: The requester must provide the application's SAML metadata or configuration details, including the Entity ID, Assertion Consumer Service (ACS) URL, and other required endpoints.
  • Attribute Requirements: The application owner must identify the user attributes needed for authentication and access management.
  • Security Compliance: The application must comply with applicable university information security policies and identity management requirements.
  • Federation Participation: Third-party applications are encouraged to participate in the InCommon Federation when supported.

Technology Solutions will review the integration request and coordinate configuration and testing with the application owner or vendor.

Who Is Eligible To Use It?

Service Requestors

  • UIC IT professionals

  • University departments and units

  • Application owners and administrators

  • Authorized technical representatives

End Users

UIC students, faculty, staff, and other authorized individuals may use Shibboleth-enabled applications based on their university affiliation and application access permissions.

Where Can I Get It?

Select the Request Shibboleth button on this page.

How Do I Use It?

Once an application is integrated with Shibboleth, authorized individuals can access the application using their UIC credentials through the configured sign-in process.

For additional information, visit:​​​​​​​ How is Shibboleth used at UIC?

Additional Resources

How Much Does It Cost?

Shibboleth Single Sign-On is a university-funded service provided by UIC Technology Solutions. There are no direct charges for standard Shibboleth integration services.

How Can I Get Support?

If you are experiencing a problem with this service, please report it. If you just have a question, feel free to ask us.

When requesting support, please include the application name, a description of the issue, and any relevant error messages.

Service Levels

Service Request Fulfillment Time

4 business days
Incident Resolution Time 4 business days
Service Availability 24x7
Maintenance Window(s)

Approved Technology Solutions maintenance window(s)
Service Notification Channel(s) IT Service Notices