Philip Durbin 🚀 (May 09 2026 at 09:39): Philip Durbin 🚀 (May 09 2026 at 09:39):Does anyone have experience configuring Dataverse to use institutional login via Shibboleth/SAML connected to eduGAIN? I've only connected to InCommon (and that's how we document it in the guides) but I hope it's similar.
Philip Durbin 🚀 (May 09 2026 at 09:39):I'm asking for a friend here in Riga (#community > DataverseLV (Latvia) event on May 6th) and I believe we'll probably try the feed at https://laife.lanet.lv/metadata/laife-edugain-metadata.xml which I found at https://refeds.org/federations
Thomas van Erven (May 10 2026 at 06:33):I connected an instance to Belnet recently, which I believe couples against Edugain
Thomas van Erven (May 10 2026 at 06:33):(By no means an expert, but I know this specific trauma to some extent)
Oliver Bertuch (May 10 2026 at 08:47):Just a note: @Philip Durbin 🚀 mentions the metadata XML, so he might be talking about setting up the Shib daemon itself, as it would need to consume the IdP list to become part of the federation.
Philip Durbin 🚀 (May 10 2026 at 14:32):Yeah, shibd. We'll need at least 11 IdPs to be able to log in.
Thomas van Erven (May 10 2026 at 14:33):So you would need to define a metadata filter in Shib to filter out your institutions, if I'm not mistaken.
Thomas van Erven (May 10 2026 at 14:34):(Don't know the exact XML tag but I know it's possible)
Philip Durbin 🚀 (May 10 2026 at 14:36):Ok, good. It was late on a Friday but we'll pick this up soon. Glad to know who to ask! :smile:
Kristaps Oškalns (Jun 16 2026 at 06:44):Hi everyone, I am the “friend from Riga” :blush: We have now set up eduGAIN login for our Dataverse instance at dv.dataverse.lv, and we would like to configure Shibboleth groups so that users can receive permissions based on their institutional affiliation.
Our national identity federation, LAIFE, uses a hub-and-spoke SAML architecture where all authentication goes through a central IdP gateway. As a result, all institutions share the same Shib-Identity-Provider EntityID.
From what we understand, Dataverse currently relies on the Shib-Identity-Provider header to resolve and manage Shibboleth groups. Because this header is the same for all institutions in our federation, we cannot separate users into institution-specific Shibboleth groups.
Has anyone found a workaround for this setup, given that users can still be distinguished by other SAML attributes, such as entitlement or the domain part of eppn? Alternatively, is there any plan to support Shibboleth group mapping based on custom SAML attributes or headers instead of only the IdP EntityID?
Any examples or advice would be very helpful.
Thomas van Erven (Jun 16 2026 at 08:20):My first thought would be using mail domain groups
Thomas van Erven (Jun 16 2026 at 08:22):That way you sidestep the header issue and just go by institution based on email.
Philip Durbin 🚀 (Jun 16 2026 at 11:43):@Kristaps Oškalns awesome that you got eduGAIN login working! I know the docs weren't perfect when we were looking at them. If you have any suggestions, we can definitely improve them!
Philip Durbin 🚀 (Jun 16 2026 at 11:44):I agree with @Thomas van Erven that mail domain groups might be a good workaround for you: https://guides.dataverse.org/en/6.10.1/admin/mail-groups.html
Philip Durbin 🚀 (Jun 16 2026 at 12:51):After we implemented Institution-Wide Shibboleth Groups we opened #1401 about more granularity but we never worked on it. These days, because of the new SPA frontend, auth is changing and I'm not sure what this means for more granular groups.
Kristaps Oškalns (Jun 17 2026 at 08:32):Thanks @Thomas van Erven we tried the email groups and it seams to work. We are going to set up them in our production instance.
Hi @Philip Durbin 🚀 I think we have some suggestions from our sysadmin on the the documentation. I will get back to you on that later.
Last updated: Aug 18 2026 at 08:27 UTC