---
type: concept
title: Shibboleth
tags: [authentication, sso, federated-identity]
related: [single-sign-on, central-authentication-and-authorization, identity-card, dfn-aai]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_shibboleth_loginvorgang.md", "output/rz_uni_greifswald_de_dienste_allgemein_shibboleth--dd34fl"]
---

# Shibboleth

**Shibboleth** is the central authentication and authorization system used at the Universität Greifswald to provide a [[single-sign-on]] (SSO) experience. It allows users to access various internal and external services (such as Moodle, LSF, and UB databases) using their [[zentraler-nutzeraccount]].

## Operational Workflow
The login process typically follows a federated path:
`Service Provider` $\rightarrow$ `DFN-AAI (Federation)` $\rightarrow$ `Universität Greifswald (Institution)` $\rightarrow$ `idp.uni-greifswald.de (IdP Server)`.

## Security Architecture
A critical security feature of the implementation is that user credentials are only ever entered on the university's own Identity Provider (IdP) server (`idp.uni-greifswald.de`). This ensures that external service providers never have access to the user's password.

## Data Transmission and Privacy
Shibboleth manages the transmission of user attributes to service providers:
- **External Services**: Use an [[identity-card]] to show users which personal attributes (e.g., name, email) are being sent, requiring explicit user consent.
- **Internal Services**: Data processing is based on university data protection statutes, so no ID-Card is displayed.
- **Automatic Attributes**: Technical attributes used for authorization (such as `eduPersonEntitlement` and `eduPersonAffiliation`) are sent to all providers automatically and are excluded from the ID-Card.

## Limitations
- The login page cannot be accessed directly; it requires a redirect from a service provider.
- Session termination is currently handled at the browser level (closing the browser or deleting cookies) rather than through a dedicated logout function.
