Skip to main content

Configure Identity Provider for TAMUFederation

tip

All identity providers must assert the tamuEduPersonUIN attribute in order to access Texas A&M System resources. See the Texas A&M University Identity Security Docs for more information.

A word of caution

The instructions below are not applicable for members that are already published in and consume the InCommon Federation metadata aggregate with their identity provider. See the InCommon Federation Library for more information and to get started.

Once InCommon service providers are populated in the member identity provider, configure the identity provider to release the tamuEduPersonUIN attribute to TAMUFederation's Authorized Discovery Service/WAYF Service Providers.

Prepare users for federating​

  1. Populate the Employee ID attribute for each user with the user's UIN
  2. Create groups as necessary for user roles to be asserted with InCommon via eduPersonScopedAffiliation attribute (e.g., faculty, staff, students, affiliates, etc. as defined by eduPersonAffiliation; most relevant for universities)

Create a service provider/enterprise application​

note

These instructions are for Entra ID only. Other identity provider procedures to create a service provider will vary.

  1. In the Azure Portal (portal.azure.com), under Microsoft Entra ID > Enterprise Applications, create a new application
  2. Under Manage > Properties, set Assignment Required? to No
  3. Under Manage > Single Sign-On, edit Basic SAML Configuration and configure with the Entity IDs and Reply URLs as shown below
  4. Under Manage > Single Sign-On, edit Attributes & Claims as shown below

Authorized Discovery Service/WAYF Service Providers​

DescriptionSP Identifier (Entity ID)Assertion Consumer Service (ACS) URL (Reply URL)
TAMUS SSO Productionhttps://sso.tamus.edu/shibbolethhttps://sso.tamus.edu/Shibboleth.sso/SAML2/POST
TAMUS SSO Testhttps://sso-test.tamus.edu/shibbolethhttps://sso-test.tamus.edu/Shibboleth.sso/SAML2/POST
TAMUS SSO Developmenthttps://sso-dev.tamus.edu/shibbolethhttps://sso-dev.tamus.edu/Shibboleth.sso/SAML2/POST
TAMUS Cirrus Proxyhttps://tamus.proxy.cirrusidentity.com/sphttps://tamus.proxy.cirrusidentity.com/module.php/saml/sp/saml2-acs.php/tamus_proxy
TAMU Cirrus Proxy Productionhttps://tamu.proxy.cirrusidentity.com/sphttps://tamu.proxy.cirrusidentity.com/module.php/saml/sp/saml2-acs.php/tamu_proxy
TAMU Cirrus Proxy UAThttps://tamu-uat.proxy.cirrusidentity.com/sphttps://tamu-uat.proxy.cirrusidentity.com/module.php/saml/sp/saml2-acs.php/tamu-uat_proxy
TAMU Transportation Services Productionhttps://tamu-parking.proxy.cirrusidentity.com/sphttps://tamu-parking.proxy.cirrusidentity.com/module.php/saml/sp/saml2-acs.php/tamu-parking_proxy
TAMU Transportation Services UAThttps://tamu-parking-uat.proxy.cirrusidentity.com/sphttps://tamu-parking-uat.proxy.cirrusidentity.com/module.php/saml/sp/saml2-acs.php/tamu-parking-uat_proxy

Authorized Metadata Aggregate Providers​

DescriptionMetadata URL
InCommon Federationhttps://mdq.incommon.org/entities
TAMU Cirrus Proxyhttps://federation.identity.tamu.edu/metadata.xml
TAMU Legacy Shibbolethhttps://idp.tamu.edu/tamufed-metadata.xml

Required Attributes​

Friendly NameURNEntra ID Source Attribute
mailurn:oid:0.9.2342.19200300.100.1.3user.mail
tamuEduPersonUINurn:oid:1.3.6.1.4.1.4391.0.12user.employeeid
eduPersonPrincipalNameurn:oid:1.3.6.1.4.1.5923.1.1.1.6user.userprincipalname
snurn:oid:2.5.4.4user.surname
givenNameurn:oid:2.5.4.42user.givenname
Friendly NameURNEntra ID Source Attribute
eduPersonUniqueIDurn:oid:1.3.6.1.4.1.5923.1.1.1.13ObjectID + UPN Suffix
eduPersonScopedAffiliationurn:oid:1.3.6.1.4.1.5923.1.1.1.9Derived from group membership + UPN Suffix
eduPersonAffiliationurn:oid:1.3.6.1.4.1.5923.1.1.1.1Derived from group membership

Add IdP to TAMUFederation​

Provide the following information in an email to identity@tamu.edu as a request to add a new IDP to TAMUFederation:

  • The metadata URL to the identity provider (or Azure Enterprise App’s Federation Metadata URL)
  • Your system member’s privacy statement URL
  • Your system member’s identity service information URL (e.g., user help page for account management or similar, if one exists)
  • The URL for a 100px x 100px image of your system member logo