For your IT team · Universities

Connecting Shibboleth

Shibboleth IdP v3/v4/v5 · SAML 2.0 · Last updated 4 August 2026. · Running Entra ID, Okta or Google Workspace? Use the standard guide instead.

CaseConduit's SAML details — everything you need

Entity ID / Audienceurn:amazon:cognito:sp:eu-west-2_MznWmZtsy

ACS locationhttps://eu-west-2mznwmztsy.auth.eu-west-2.amazoncognito.com/saml2/idpresponse

BindingHTTP-POST, SP-initiated sign-in

NameID formatAny persistent format

Attributes to releasemail (required), givenName, sn

Send back to usYour IdP metadata URL (preferred) or metadata XML file, plus the email domain(s) to connect

Before you start: this is a bilateral registration

CaseConduit's service provider is not a member of a national federation (UK federation, InCommon or eduGAIN), so it won't appear in federation metadata. Instead, you register us directly as a local metadata source — a standard bilateral SP, the same way you'd add any non-federated service. Everything needed for that is on this page.

Once connected, your people go to caseconduit.io, choose "Sign in with your organisation", enter their university email, and are sent to your normal Shibboleth login. Accounts are created automatically on first sign-in — no user list to upload, no passwords ever stored with us.

1 — Register our SP metadata

Save the following as a local metadata file (e.g. caseconduit-sp.xml) and add it to your IdP's metadata providers:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="urn:amazon:cognito:sp:eu-west-2_MznWmZtsy">
  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
      protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <AssertionConsumerService index="0" isDefault="true"
        Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://eu-west-2mznwmztsy.auth.eu-west-2.amazoncognito.com/saml2/idpresponse"/>
  </SPSSODescriptor>
</EntityDescriptor>

Referenced from metadata-providers.xml in the usual way:

<MetadataProvider id="CaseConduit" xsi:type="FilesystemMetadataProvider"
    metadataFile="%{idp.home}/metadata/caseconduit-sp.xml"/>

2 — Release three attributes

We need email (required), first name and last name. A minimal attribute-filter.xml policy:

<AttributeFilterPolicy id="releaseToCaseConduit">
  <PolicyRequirementRule xsi:type="Requester"
      value="urn:amazon:cognito:sp:eu-west-2_MznWmZtsy"/>
  <AttributeRule attributeID="mail"><PermitValueRule xsi:type="ANY"/></AttributeRule>
  <AttributeRule attributeID="givenName"><PermitValueRule xsi:type="ANY"/></AttributeRule>
  <AttributeRule attributeID="sn"><PermitValueRule xsi:type="ANY"/></AttributeRule>
</AttributeFilterPolicy>

We map attributes on our side per connection, so it doesn't matter whether your assertion carries them as friendly names or OID names (urn:oid:0.9.2342.19200300.100.1.3 for mail, 2.5.4.42 for givenName, 2.5.4.4 for sn) — just tell us which your IdP emits if you've customised the defaults. If your institution prefers not to release mail, a scoped eduPersonPrincipalName in email form also works — mention it in your email and we'll map accordingly.

3 — Send us your metadata

Email your IdP metadata URL (preferred — certificate rotations then need nothing from either side) or metadata XML file, plus the email domain(s) your users sign in with (e.g. university.ac.uk), to hello@caseconduit.io. We connect it the same working day and confirm when it's live, usually with a quick joint test.

Good to know: single sign-on is included in the CaseConduit Institution plan — see pricing. Password sign-in keeps working alongside SSO, so staff and students without directory accounts aren't locked out.