Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

In most cases your SAML SP software will work with the SAMLDS protocol that the OpenAthens discovery service expects and it is Wayfinder uses the SAML DS protocol and as long as your SP software does too it's just a case of configuring it to use Wayfinder as the discovery service. Some common SPs are covered below:

Table of Contents

OpenAthens

...

For both OpenAthens SP and OpenAthens Cloud SP, the procedure is the essentially the same.

Keystone

  1. Sign in to the publisher dashboard (https://sp.openathens.net) 

  2. Select the application in question and go to its configuration discovery tab

  3. Scroll to the  discovery method section and select the radio button for the central discovery service
    If it doesn't already say so in the box, enter https://discovery.openathens.net  
    Wayfinder

  4. Save changes

OpenAthens Cloud SP Keystone will start to use the discovery service immediately.

OpenAthens SP, as with any configuration change, will need a webserver restart to pick up and start using the new settings.

See also: Discovery

Shibboleth

You will need to do two things:

Add a discovery response binding to your metadata in the <Extensions> section- e.g:

...

hosted version of Wayfinder immediately. Keystone also has the option for you to embed Wayfinder into your site. See: Embedding OpenAthens Wayfinder

The OpenAthens federation will be updated automatically but if you are in any other federations they will have to update your metadata to include valid discovery return URLs before discovery will work: 

Code Block
languagexml
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="httpshttp://shibspconnect.yourdomainopenathens.com/Shibboleth.sso/DSnet/saml/2/auth" index="1"/>
   ...
</Extensions>

... and add the discovery service to your shibboleth.xml configuration file in the SSO section in place of any singular IdP definition:

Code Block
xmlxml
 <SSO
     discoveryProtocol="SAMLDS" discoveryURL="

See also: Discovery

OpenAthens SP

  1. Sign in to the publisher dashboard (https://

...

  1. sp.openathens.net

...

SimpleSAML.php

Set the options in authentication.php:

  • 'discoURL'  => 'https://discovery.openathens.net' 
  • 'idp' => null
Anything to watch out for?

...

  1. )

  2. Select the application in question and go to its configuration tab

  3. Scroll to the  discovery method section and select the radio button for the central discovery service

  4. If it doesn't already say so in the box, enter https://wayfinder.openathens.net  

  5. Save changes

As with any configuration change, OpenAthens SP will need a webserver restart to pick up and start using the new settings.  

The OpenAthens federation will be updated automatically but if you are in any other federations they will have to update your metadata to include valid discovery return URLs before discovery will work - e.g for OpenAthens SP it will need to contain something like:

Code Block
languagexml
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://yourdomain.com/oa/disco-ret" index="1"/>"

See also: Discovery

Shibboleth

Include Page
_wayfinderShib
_wayfinderShib

SimpleSAML.php

Include Page
_wayfinderSimpleSAML
_wayfinderSimpleSAML

Other SP software

...

Add according to their instructions and then update the federation metadata as with Shib or SimpleSAML above.

Troubleshooting

No entities appear in Wayfinder

You may not be live in any federations yet. To check that, you would download that federation's metadata and check that your entity appears. If it's there check that it includes a <idpdisc:DiscoveryResponse> section that specifies Wayfinder. The REFEDs metadata explorer tool is also an option but may be a day behind (https://met.refeds.org/)

Unexpected entities appear in Wayfinder

Your entity appears in one of the federations that Wayfinder is aware of, or you have debug mode turned on.

  • Federations -
    • The federation toggles on your connection in the dashboard do not affect your appearance in other federations. They only affect which metadata is available to your application, not Wayfinder
    • EduGAIN means that as well as only needing to join one Academic federation to appear in many, there can be a delay between updates to the metadata in the federation you registered in and the other federations that include it picking up the change. Timezones and weekends play a part in how long it could take
  • Debug mode - this will, when enabled on your browser, tell Wayfinder to include entities that have a hide from wayf entity category on them.