Tsinghua University

Tsinghua University Identity Provider — SAML 2.0 Federation Metadata

Tsinghua operates its own Shibboleth Identity Provider and publishes machine-readable SAML 2.0 metadata about it at a public, unauthenticated URL on its own domain. The document declares entityID https://idp.tsinghua.edu.cn/idp/shibboleth, a Shibboleth shibmd:Scope of tsinghua.edu.cn, an IDPSSODescriptor advertising SAML 2.0, SAML 1.1 and urn:mace:shibboleth:1.0, four SingleSignOnService and four SingleLogoutService bindings, two ArtifactResolutionService endpoints and an AttributeAuthorityDescriptor with SOAP attribute query on port 8443. This is the surface class a university operates by definition, and it is the one where Tsinghua is stronger than several of its better-ranked peers in this cohort: every SSO and SLO location resolves to a Tsinghua host, so the institution runs the SAML service itself rather than fronting it with OpenAthens or a federation operator. The corresponding human-facing login estate (id.tsinghua.edu.cn, with an OAuth-shaped /thu-oauth/callback) publishes no client registration, scope list or discovery document, so the federation metadata is the only part of the identity estate an outside party can read. Gaps recorded honestly: the metadata carries no validUntil, no cacheDuration and no XML signature, so relying parties have no published refresh interval and no tamper check.

Documentation GitHub OpenAPI

OpenAPI Specification

openapi: 3.0.3
info:
  title: Tsinghua University Identity Provider — SAML 2.0 Federation Metadata API
  description: >-
    Tsinghua University operates its own Shibboleth Identity Provider at idp.tsinghua.edu.cn,
    on the university's own registrable domain, and publishes machine-readable SAML 2.0
    metadata about it at a public, unauthenticated URL. This is the surface class a
    university operates by definition, and for Tsinghua it is the only institution-operated
    machine-readable contract outside the student-run TUNA mirror.

    The metadata document declares entityID https://idp.tsinghua.edu.cn/idp/shibboleth, a
    Shibboleth shibmd:Scope of tsinghua.edu.cn, an IDPSSODescriptor supporting SAML 2.0,
    SAML 1.1 and urn:mace:shibboleth:1.0, and an AttributeAuthorityDescriptor. Signing and
    encryption KeyDescriptors are embedded in the document.

    This description was written from the live metadata document on 2026-08-19. Tsinghua
    publishes no OpenAPI for it — the metadata endpoint is the contract, and this file
    describes how to fetch and what comes back. The SSO, SLO, artifact-resolution and
    attribute-query endpoints below are transcribed from that metadata; they are SAML
    protocol endpoints, not REST resources, and they are listed so that the federation
    surface is machine-discoverable rather than to imply a callable JSON API.
  version: 1.0.0
  contact:
    name: Tsinghua University Information Technology Center
    url: https://its.tsinghua.edu.cn/
  termsOfService: https://www.tsinghua.edu.cn/
servers:
  - url: https://idp.tsinghua.edu.cn
    description: Tsinghua University Shibboleth Identity Provider (front channel)
  - url: https://idp.tsinghua.edu.cn:8443
    description: Tsinghua University Shibboleth Identity Provider (SOAP back channel)
tags:
  - name: Identity Federation
    description: SAML 2.0 identity federation metadata and single sign-on endpoints.
paths:
  /idp/shibboleth:
    get:
      operationId: getSamlFederationMetadata
      summary: Get SAML 2.0 federation metadata
      description: >-
        Returns the SAML 2.0 EntityDescriptor Tsinghua University publishes about its own
        Identity Provider. No authentication is required. Observed 2026-08-19: HTTP 200,
        Content-Type application/xml;charset=UTF-8, 14,622 bytes.
      tags:
        - Identity Federation
      responses:
        '200':
          description: SAML 2.0 metadata document for the Tsinghua University Identity Provider.
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/EntityDescriptor'
  /idp/profile/SAML2/Redirect/SSO:
    get:
      operationId: samlRedirectSingleSignOn
      summary: SAML 2.0 HTTP-Redirect single sign-on
      description: >-
        SAML 2.0 SingleSignOnService with the urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
        binding, as declared in the IdP's own metadata. Consumes a deflate-encoded SAML
        AuthnRequest from a registered service provider and answers with an authentication
        interaction, not with a machine-readable payload. Not callable without a federation
        relationship.
      tags:
        - Identity Federation
      parameters:
        - name: SAMLRequest
          in: query
          required: true
          description: Deflate-encoded, base64 SAML 2.0 AuthnRequest.
          schema:
            type: string
        - name: RelayState
          in: query
          required: false
          description: Opaque state echoed back to the service provider.
          schema:
            type: string
      responses:
        '200':
          description: Authentication interaction (HTML login flow at id.tsinghua.edu.cn).
          content:
            text/html:
              schema:
                type: string
        '302':
          description: Redirect into the university's electronic identity service.
  /idp/profile/SAML2/Redirect/SLO:
    get:
      operationId: samlRedirectSingleLogout
      summary: SAML 2.0 HTTP-Redirect single logout
      description: >-
        SAML 2.0 SingleLogoutService with the urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
        binding, as declared in the IdP's own metadata.
      tags:
        - Identity Federation
      parameters:
        - name: SAMLRequest
          in: query
          required: true
          description: Deflate-encoded, base64 SAML 2.0 LogoutRequest.
          schema:
            type: string
      responses:
        '200':
          description: Logout interaction.
          content:
            text/html:
              schema:
                type: string
components:
  schemas:
    EntityDescriptor:
      type: object
      description: >-
        SAML 2.0 metadata EntityDescriptor, namespace urn:oasis:names:tc:SAML:2.0:metadata.
        Modelled here only to name what the response carries; the authoritative schema is
        the OASIS SAML 2.0 metadata schema.
      properties:
        entityID:
          type: string
          description: Unique identifier of the entity.
          example: https://idp.tsinghua.edu.cn/idp/shibboleth
        IDPSSODescriptor:
          type: object
          description: Identity provider role descriptor.
          properties:
            protocolSupportEnumeration:
              type: string
              example: urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0
            Scope:
              type: string
              description: Shibboleth metadata extension (shibmd:Scope) asserting the identity namespace.
              example: tsinghua.edu.cn
        AttributeAuthorityDescriptor:
          type: object
          description: Attribute authority role descriptor, reachable over SOAP on port 8443.

Tsinghua University Identity Provider — SAML 2.0 Federation Metadata

Documentation

Specifications

Other Resources

OpenAPI Specification