CWRU Shibboleth Identity Provider (SAML 2.0 metadata)
CWRU's own Shibboleth Identity Provider, entityID urn:mace:incommon:case.edu. Every SingleSignOnService binding in the production descriptor is on CWRU's own registrable domain — https://login.case.edu/idp/profile/SAML2/Redirect/SSO, .../POST/SSO and .../POST-SimpleSign/SSO — and the descriptor asserts nine shibmd:Scope values, all case.edu subdomains (case.edu, artsci, dental, engineering, law, management, med, nursing, sass). The metadata is distributed unauthenticated through the InCommon per-entity metadata service (MDQ), registrationAuthority https://incommon.org, validUntil 2026-09-15. canvas.case.edu was observed redirecting into this IdP. This is the strongest institution-operated, machine-readable contract CWRU publishes. Caveat worth knowing: CWRU's own metadata URL https://login.case.edu/idp/shibboleth answers 200 but serves a stale DEV descriptor (entityID https://login-dev.case.edu/idp, "Still using old keypairs - fine for dev for now"), so the MDQ copy is the authoritative one.