...

• MUST use application/json

• MUST use UTF-8 encoding

• MUST validate against their respective JSON Schemas defined in this document

SP SSO Links Metadata

The SP SSO Links Metadata feed provides information about how SSO can be initiated for Service Providers within the federation.

It supports two SSO types:

• EntityID-based login: Relies on the identity provider’s entityID and parameters such as idp_parameter, target_parameter, and an SP-initiated login URL.

• Link map-based login: Uses explicit mappings between known IdP entityIDs and proprietary login URLs.

Each metadata entry includes descriptive and branding information about the organization and its services, including display names, logos, and landing pages, facilitating consistent presentation in discovery services and login portals.

SP SSO Links Data Model

The SP SSO Links Metadata feed MUST be a JSON array.

Each array element MUST be a JSON object containing organization_info and sso_links.

Organization Information (organization_info)

This section contains metadata about the organization offering the SSO services.

...

All properties are REQUIRED.
Additional properties MUST NOT be included.

Example

{
	"description": "An example description of the service provider organization",
	"display_name": "Example Service Provider",
	"logotype": "https://example.com/logo.svg",
	"name": "Example Service Provider AB",
	"url": "https://example.com"
}

List of SSO Links (sso_links)

This section contains a list of services that support SSO authentication.

sso_links MUST be an array containing one object per service.

...

Elements in each SSO link

Each SSO link object MUST contain the following properties unless otherwise specified:

...

Field Details

description (REQUIRED, string)

A short description of the service.

Example:
"Example Digital Math Service is the number one digital math companion in Schengen"

...

display_name (REQUIRED, string)

The name of the service displayed to users.

Example:
"Math Rocket"

...

entity_id (REQUIRED, string, URI)

The entity ID of the service in the SAML federation.

Example:
"https://example.com/math"

...

logo (REQUIRED, string, URI)

The URL of the service’s logo.

Example:
"https://example.com/math/logo.svg"

...

sso_type (REQUIRED, string)

Defines how SSO is initiated for the service.

...

Example:

"sso_type": "entity_id"

...

disabled (OPTIONAL, boolean)

Indicates whether the SSO link is disabled.

...

• true – The service is disabled and MUST NOT be presented to users.

• false – The service is active.

Example:

"disabled": false

...

target_parameter (OPTIONAL, string)

The parameter used to pass a target address after authentication.

...

"target_parameter": "Target"

...

target_value (OPTIONAL, string)

The value used to pass a target address after authentication.

...

• An absolute URI, or

• An absolute-path reference beginning with /, optionally including query and fragment components, interpreted relative to the service’s own origin.

If sso_type is "entity_id"

These fields are required for a standard SAML SSO setup using the entity ID as parameter for identifying the IdP.

• idp_parameter REQUIRED (str)

  • The parameter used to pass the IdP’s entity ID in the SSO request.
  • Example: "entityID".

• sp_init REQUIRED (str, URL)

  • The URL for SP-initiated authentication.
  • Example: "https://example.com/math/Shibboleth.sso/Login?".

If sso_type is "link_map"

Fields used when the service uses direct mapping between IdPs and specific login URLs 

• link_mapping REQUIRED (object)

  • A mapping where each IdP’s entity ID is used as a key, and the value is the specific login URL for that IdP.
  • Example:

    Code Block
    language js
    "link_mapping": { "https://idp.example1.com": "https://example.com/bjj/login?idp=example1-idp", "https://idp.example2.com": "https://example.com/bjj/login?idp=example2-idp", "https://idp.example3.com": "https://example.com/bjj/login?idp=example3-idp" },

Example metadata

[
  {
    "organization_info": {
      "description": "An example description of the service provider organization",
      "display_name": "Example Service Provider",
      "logotype": "https://example.com/logo.svg",
      "name": "Example Service Provider AB",
      "url": "https://example.com"
    },
    "sso_links": [
      {
        "description": "Example Digital Math Service is the number one digital math companion in Schengen",
        "disabled": false,
        "display_name": "Math Rocket",
        "entity_id": "https://example.com/math",
        "idp_parameter": "entityID",
        "logo": "https://example.com/math/logo.svg",
        "sp_init": "https://example.com/math/Shibboleth.sso/Login?",
        "sso_type": "entity_id",
        "target_parameter": "Target",
        "target_value": "https://example.com/math/resource"
      },
      {
        "description": "Example Digital Brazilian Jiu-Jitsu Service is the number one digital BJJ teacher in Schengen",
        "disabled": false,
        "display_name": "Example Digital Brazilian Jiu-Jitsu Service",
        "entity_id": "https://example.com/bjj",
        "link_mapping": {
          "https://idp.example1.com": "https://example.com/bjj/login?idp=example1-idp",
          "https://idp.example2.com": "https://example.com/bjj/login?idp=example2-idp",
          "https://idp.example3.com": "https://example.com/bjj/login?idp=example3-idp"
        },
        "logo": "https://example.com/bjj/logo.png",
        "sso_type": "link_map"
      }
    ]
  }
]

JSON schema

JSON schema for validating SP SSO links metadata:

...

Each IdP object MUST contain the following fields:

All properties are REQUIRED.

...