SSO With Shibboleth

This guide explains how to configure Shibboleth as an OpenID Connect (OIDC) single sign-on (SSO) provider for StrongDM.

Steps

These instructions vary based on your organization's StrongDM region (not your individual location).

US

Create an application in Shibboleth

1. Sign in to your Shibboleth Identity Provider (IdP) admin console.

   • For Shibboleth IdP version 4 and higher, OIDC configuration is managed through the OIDC OP Extension.

2. Register a new OIDC client:

   • Redirect URI:

     https://app.strongdm.com/sso/callback

   • Grant type: Authorization Code

   • Response type: code

   • Scopes: openid email profile

3. Record the generated Client ID and Client Secret.

4. Configure the attribute release consent so that the ID Token or UserInfo endpoint includes:

   • email (required)

   • name (recommended)

   • groups (optional, for role mapping)

UK

Follow instructions in the tab for the region of your organization's StrongDM control plane, not your own location. The default control plane region is US.

Create an application in Shibboleth

1. Sign in to your Shibboleth Identity Provider (IdP) admin console.

   • For Shibboleth IdP version 4 and higher, OIDC configuration is managed through the OIDC OP Extension.

2. Register a new OIDC client:

   • Redirect URI:

     https://app.uk.strongdm.com/sso/callback

   • Grant type: Authorization Code

   • Response type: code

   • Scopes: openid email profile

3. Record the generated Client ID and Client Secret.

4. Configure the attribute release so that the ID Token or UserInfo endpoint includes:

   • email (required)

   • name (recommended)

   • groups (optional, for role mapping)

EU

Follow instructions in the tab for the region of your organization's StrongDM control plane, not your own location. The default control plane region is US.

Create an application in Shibboleth

1. Sign in to your Shibboleth Identity Provider (IdP) admin console.

   • For Shibboleth IdP version 4 and higher, OIDC configuration is managed through the OIDC OP Extension.

2. Register a new OIDC client:

   • Redirect URI:

     https://app.eu.strongdm.com/sso/callback

   • Grant type: Authorization Code

   • Response type: code

   • Scopes: openid email profile

3. Record the generated Client ID and Client Secret.

4. Configure the attribute release so that the ID Token or UserInfo endpoint includes:

   • email (required)

   • name (recommended)

   • groups (optional, for role mapping)

Configure in StrongDM

1. Log in to the StrongDM Admin UI.

2. Go to Settings > User Management > Single Sign-on.

3. Set Enable single sign-on? to Yes.

4. Choose Shibboleth from the Provider dropdown.

5. Enter the following information:

   • Single sign-on URL: Your Shibboleth IdP’s authorization endpoint. For example:

     https://idp.example.org/idp/profile/oidc/authorize

   • Client ID: Your client ID from Shibboleth

   • Client Secret: Your client secret from Shibboleth

6. (Optional) Configure additional settings as desired, and then Save.