Shibboleth Identity Provider 5 on Ubuntu 24.04 LTS | Support by cloudimg
by cloudimg
SAML 2.0 single sign on for research, education and public sector federations.
A SAML 2.0 identity provider, ready to federate
Shibboleth Identity Provider is the SAML 2.0 identity provider used across research and education federations worldwide, and widely in the public sector. It authenticates your users against your own directory and issues signed SAML assertions to the services they sign in to, so one sign in works across every service you federate with. This image ships version 5.2.3, released 18 June 2026, installed from the official distribution with its checksum verified at build time.
Your signing key is yours
An identity provider signs assertions with a private key, and every service that trusts it trusts that key. A key baked into a machine image would be shared by everyone who deployed that image, and any of them could forge assertions for any other. This image therefore does not contain an installed identity provider at all. It carries the pinned upstream distribution, and your first boot runs Shibboleth's own installer, which mints this machine's signing key, encryption key, back channel keystore, sealer keystore and published metadata. Two virtual machines launched from this image were measured side by side before release: all nineteen per machine secrets differed, including every key, the sealer, the keystore passwords, the TLS certificate, the host keys and the machine id.
What is on it
Shibboleth Identity Provider 5.2.3 on Ubuntu 24.04 LTS, with OpenJDK 21 and Eclipse Jetty 12.1 as the servlet container. Shibboleth 5.2 declares Jakarta Servlet 6.1, so it needs a Jakarta EE 11 container; Jetty 12.0 and Tomcat 10.1 are both too old, and this image ships a container that is not. NGINX terminates TLS on port 443 with a certificate generated on your machine at first boot. OpenLDAP runs as a co-located directory holding one test user, so you can prove a sign in immediately, and a self test service provider is registered out of the box for exactly that purpose. Both are documented and removable once your own directory and service providers are in place.
Exposed surface
Off machine, this image listens on port 22 and port 443, and nothing else. The directory listens only on the loopback interface and so does the servlet container. There is deliberately no port 80 listener. Shibboleth's unauthenticated administrative endpoints are refused at the reverse proxy, and the proxy overwrites the forwarded client address rather than appending to it, so a remote caller cannot present a loopback address and reach them.
Licence and trademark
Shibboleth Identity Provider is published under the Apache License, Version 2.0, and the licence text is copied onto the image from the distribution at build time. Shibboleth is a registered trademark of Internet2. cloudimg is not affiliated with, endorsed by, or sponsored by Internet2 or the Shibboleth Consortium; the name is used only to identify the software this image runs, and the Shibboleth logo is not used.
Support
24/7 support from cloudimg, and a step by step deployment guide covering first boot, proving a sign in, registering your first service provider, pointing the identity provider at your own directory, and moving to a real hostname and certificate.