Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

VersionDateNotes
0.12025-Q1First pilot draft
0.22026-02-05

Explicit target handling added
Introduced target_value to explicitly define the value sent via target_parameter. If either field is present, both are now required.

Support for relative target paths
target_value now supports absolute URIs as well as absolute-path references starting with /, optionally including query and fragment.

Improved validation of link map login URLs
In link_mapping, login URLs are now strictly required to be HTTPS, while IdP entityID keys may be any non-empty string (e.g. HTTPS URIs or URNs), due to legacy SAML entityID requirements.

0.32026-03-01

IntroducedIdP Discovery Metadata feed. Refactored document structure for consistency and clarity.

0.3.12026-03-09

Updating JSON schemas to version 2020-12 and examples

Table of Contents
maxLevel3

...

  • link_mapping REQUIRED (object)

    • A mapping where each IdP’s entity ID is used as a key, and the value is the specific login URL for that IdP.
    • Example:
      Code Block
      languagejs
      "link_mapping": {
      	"https://idp.example1.com": "https://example.com/bjj/login?idp=example1-idp",
      	"https://idp.example2.com": "https://example.com/bjj/login?idp=example2-idp",
      	"https://idp.example3.com": "https://example.com/bjj/login?idp=example3-idp"
      }, 

Example metadata

Code Block
languagejs
[
  {
    "organization_info": {
      "description": "An example description of the service provider organization",
      "display_name": "Example Service Provider",
      "logotype": "https://example.com/logo.svg",
      "name": "Example Service Provider AB",
      "url": "https://example.com"
    },
    "sso_links": [
      {
        "description": "Example Digital Math Service is the number one digital math companion in Schengen",
        "disabled": false,
        "display_name": "Math Rocket",
        "entity_id": "https://example.com/math",
        "idp_parameter": "entityID",
        "logo": "https://example.com/math/logo.svg",
        "sp_init": "https://example.com/math/Shibboleth.sso/Login?",
        "sso_type": "entity_id",
        "target_parameter": "Target",
        "target_value": "https://example.com/math/resource"
      },
      {
        "description": "Example Digital Brazilian Jiu-Jitsu Service is the number one digital BJJ teacher in Schengen",
        "disabled": false,
        "display_name": "Example Digital Brazilian Jiu-Jitsu Service",
        "entity_id": "https://example.com/bjj",
        "link_mapping": {
          "https://idp.example1.com": "https://example.com/bjj/login?idp=example1-idp",
          "https://idp.example2.com": "https://example.com/bjj/login?idp=example2-idp",
          "https://idp.example3.com": "https://example.com/bjj/login?idp=example3-idp"
        },
        "logo": "https://example.com/bjj/logo.png",
        "sso_type": "link_map"
      }
    ]
  }
]

JSON schema

The SSO links metadata MUST validate against the JSON schema found at https://fed.skolfederation.se/pilot/schemas/sso-links-metadata-schema-0_1.json.

Code Block
languagejs
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://fed.skolfederation.se/pilot/schemas/sso-links-metadata-schema-0_1.json",
  "title": "Skolfederation SSO Links Metadata",
  "type": "array",
  "minItems": 1,
  "items": {
    "type": "object",
    "properties": {
      "organization_info": {
        "type": "object",
        "properties": {
          "description": {
            "type": "string",
            "minLength": 1
          },
          "display_name": {
            "type": "string",
            "minLength": 1
          },
          "logotype": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://"
          },
          "name": {
            "type": "string",
            "minLength": 1
          },
          "url": {
            "type": "string",
            "format": "uri",
            "pattern": "^https://"
          }
        },
        "required": [
          "description",
          "display_name",
          "logotype",
          "name",
          "url"
        ],
        "additionalProperties": false
      },
      "sso_links": {
        "type": "array",
        "minItems": 1,
        "items": {
          "type": "object",
          "properties": {
            "description": {
              "type": "string",
              "minLength": 1
            },
            "disabled": {
              "type": "boolean",
              "default": false
            },
            "display_name": {
              "type": "string",
              "minLength": 1
            },
            "entity_id": {
              "type": "string",
              "format": "uri"
            },
            "idp_parameter": {
              "type": "string",
              "minLength": 1
            },
            "logo": {
              "type": "string",
              "format": "uri",
              "pattern": "^https://"
            },
            "sp_init": {
              "type": "string",
              "format": "uri",
              "pattern": "^https://"
            },
            "sso_type": {
              "type": "string",
              "enum": [
                "entity_id",
                "link_map"
              ]
            },
            "target_parameter": {
              "type": "string",
              "minLength": 1
            },
            "target_value": {
              "$ref": "#/$defs/uriOrRelativePath"
            },
            "link_mapping": {
              "type": "object",
              "minProperties": 1,
              "patternProperties": {
                "^.+$": {
                  "type": "string",
                  "format": "uri",
                  "pattern": "^https://"
                }
              },
              "propertyNames": {
                "type": "string",
                "minLength": 1
              },
              "additionalProperties": false
            }
          },
          "required": [
            "description",
            "display_name",
            "entity_id",
            "logo",
            "sso_type"
          ],
          "dependentRequired": {
            "target_parameter": [
              "target_value"
            ],
            "target_value": [
              "target_parameter"
            ]
          },
          "oneOf": [
            {
              "properties": {
                "sso_type": {
                  "const": "entity_id"
                }
              },
              "required": [
                "idp_parameter",
                "sp_init"
              ],
              "not": {
                "required": [
                  "link_mapping"
                ]
              }
            },
            {
              "properties": {
                "sso_type": {
                  "const": "link_map"
                }
              },
              "required": [
                "link_mapping"
              ],
              "not": {
                "anyOf": [
                  {
                    "required": [
                      "idp_parameter"
                    ]
                  },
                  {
                    "required": [
                      "sp_init"
                    ]
                  }
                ]
              }
            }
          ],
          "additionalProperties": false
        }
      }
    },
    "required": [
      "organization_info",
      "sso_links"
    ],
    "additionalProperties": false
  },
  "$defs": {
    "uriOrRelativePath": {
      "anyOf": [
        {
          "type": "string",
          "format": "uri"
        },
        {
          "type": "string",
          "pattern": "^/(?!/)[^\\s]*$"
        }
      ]
    }
  }
}

IdP Discovery Metadata

...

The IdP Discovery Metadata feed provides a structured JSON representation of Identity Providers intended for consumption by:

...

The IdP Discovery Metadata feed may be generated from one or more authoritative sources, including but not limited to federation SAML metadata.


...

IdP Discovery

...

Metadata Data Model

The IdP Discovery Metadata feed MUST be a JSON array containing one object per Identity Provider.

...