Identity Providers

Identity Providers configure OIDC/SSO authentication for each institute. Students and staff authenticate through these providers.

Creating an Identity Provider

1. Navigate to /<institute>/admin/sso/identityprovider/ → Add
2. Fill in:

Basic Settings

• Institute: The institute this provider belongs to
• Name: Display name (e.g., "SURFconext", "Entra ID")
• Provider Type: OIDC (SAML support planned)
• Is Active: Enable this provider

OIDC Endpoints

• Authorization Endpoint: OAuth authorization URL
• Token Endpoint: Token exchange URL
• Userinfo Endpoint: User info URL
• JWKS Endpoint: JSON Web Key Set URL
• End Session Endpoint: Logout URL
• Issuer: OIDC issuer for ID token validation

Client Credentials

• Client ID: OAuth client identifier
• Client Secret: Encrypted at rest

Claim Mapping

Field	Default	Purpose
Username Claim	sub	Claim used as student number
Role Claim	roles	Claim containing role information
Teacher Role Value	ses-teacher	Value that grants teacher access
Admin Role Value	ses-admin	Value that grants admin/staff access
Faculty Claim	(blank)	Claim for teacher faculty assignment

Role Mapping

OIDC Role	Django is_superuser	Django is_staff	Django Groups
ses-superuser	True	True	ses-superuser, ses-admin, ses-teacher
ses-admin	False	True	ses-admin, ses-teacher
ses-teacher	False	True	ses-teacher
ses-student	False	False	—

SSO Session Management

SSO sessions are tracked in the database with: - User, identity provider, student number, role - Encrypted refresh token - Expiration time

Tenant-Specific Authentication

Each institute uses its own IdentityProvider. The login URL is:

https://<domain>/<institute>/auth/sso/login/?provider=<idp-pk>

The callback URL is:

https://<domain>/<institute>/auth/sso/callback/