---
type: source
title: "Shibboleth: Login Process"
tags: [authentication, sso, shibboleth, privacy]
related: [shibboleth, identity-card, dfn-aai]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_shibboleth_loginvorgang.md"]
---

# Shibboleth: Login Process

This source describes the practical operational workflow of the Shibboleth authentication process at the Universität Greifswald.

## Login Workflow
The authentication process typically follows these steps:
1. **Service Provider (SP) Initiation**: The user accesses a service that supports Shibboleth (often labeled as "Institutional Login").
2. **Federation Selection**: The user selects **DFN-AAI** as the federation.
3. **Institution Selection**: The user selects **Universität Greifswald** as their home institution.
4. **Authentication**: The user is redirected to the university's Identity Provider (IdP) server at `idp.uni-greifswald.de`.

## Security and Privacy
- **Credential Isolation**: User credentials are entered exclusively on the university's own server (`idp.uni-greifswald.de`). External service providers never receive the user's password.
- **ID-Card Mechanism**: For external services, an "ID-Card" is presented, listing all personal attributes to be transmitted. Users must provide explicit consent to share this data.
- **Consent Management**: Users can revoke attribute consent for a specific service during the login process.
- **Internal Services**: University-internal services do not display an ID-Card, as data processing is governed by the university's data protection statutes.

## Technical Attributes
Certain standardized attributes are transmitted to all service providers automatically for authorization purposes and are **not** listed on the ID-Card:
- `eduPersonEntitlement`: (Value: `urn:mace:dir:entitlement:common-lib-terms`) Confirms the user has a valid university account.
- `eduPersonAffiliation` and `eduPersonScopedAffiliation`: Used to distinguish between roles such as `staff`, `student`, `member`, or `affiliate`.

## Constraints and Limitations
- **No Direct Access**: The login page cannot be accessed directly; it requires a redirect from a service provider.
- **Session Termination**: There is currently no formal logout button; sessions are ended by closing the browser or deleting browser cookies.
