Caltech Shibboleth Identity Provider (InCommon)

aid: caltech:identity-federation
name: Caltech Shibboleth Identity Provider (InCommon)
x-operator: institution
x-operator-rationale: An identity federation entry is institution-operated by definition — the entityID,
  the signing keys and the attribute authority cannot be held by a vendor on the institution's behalf.
description: Caltech operates its own Shibboleth identity provider at idp.caltech.edu, asserting scoped
  attributes for caltech.edu. The SAML 2.0 metadata is machine-readable and publicly retrievable both
  from the IdP itself and, signed, from the InCommon metadata query service — registrationAuthority https://incommon.org,
  and therefore reachable through eduGAIN. Advertises SAML 1.1, SAML 2.0 and the Shibboleth-native AuthnRequest
  binding, with HTTP-POST, HTTP-Redirect and POST-SimpleSign SSO bindings and a SOAP attribute authority.
  Verified live 2026-08-19 from both sources. This is the single most under-catalogued class of university
  API surface.
humanURL: https://www.imss.caltech.edu/
baseURL: https://idp.caltech.edu/idp/shibboleth
tags:
- Identity Federation
- Shibboleth
- SAML
- InCommon
- eduGAIN
- Single Sign-On
properties:
- type: Metadata
  url: https://idp.caltech.edu/idp/shibboleth
  method: probed
- type: Metadata
  url: https://mdq.incommon.org/entities/https%3A%2F%2Fidp.caltech.edu%2Fidp%2Fshibboleth
  method: probed
- type: Example
  url: examples/caltech-shibboleth-metadata-example.yml
  method: probed
- type: Conformance
  url: conformance/caltech-education-standards.yml
  method: probed