Automate Federated Certificate Enrollment for Shibboleth

The SecureW2 JoinNow platform integrates with Shibboleth to transform institutional SSO credentials into phishing-resistant network certificates. Users authenticate once via their existing directory to receive a phishing-resistant identity, and the platform automates the entire lifecycle, eliminating manual configuration and help desk tickets.

Schedule a demoContact Sales

Overview

Federated Identity for Automated Network Access

The SecureW2 JoinNow platform transforms your Shibboleth IdP into a secure foundation for passwordless network authentication. By acting as a SAML 2.0 service provider, the platform authenticates users via your institutional SSO and leverages returned identity attributes such as UID and affiliation to provision phishing-resistant X.509 certificates.

Cloud RADIUS then utilizes these encoded attributes to enforce role-based access policies and dynamic VLAN steering in real-time. This eliminates the need for on-premises PKI infrastructure while ensuring network access is automatically revoked the moment a Shibboleth-backed account is deprovisioned, maintaining a secure lifecycle without manual IT intervention.

Use Cases
SAML SP Configuration in JoinNow
Automated Eduroam Onboarding
Video Overview

See the Integration in Action

Want to See More Demos, Click Here
How It Works

Two Integration Flows: Enrollment and Enforcement

Identity-Driven Segmentation

Shibboleth EAP-TLS Integration Documentation

Automatically assign users to secure VLANs or restricted network segments by mapping Shibboleth attributes to real-time Cloud RADIUS access policies. Faculty with “staff” affiliation are on the full corporate VLAN, students on “student” affiliation, and unrecognized identities are blocked at the RADIUS layer. Affiliation changes in the Shibboleth directory take effect at the next connection without certificate reissuance, as the policy is evaluated at every 802.1X authentication.

Lifecycle Automation

Shibboleth Enrollment Integration Documentation

Link network access to the institutional directory to eliminate manual deprovisioning. When an account is suspended in Shibboleth, JoinNow detects the change and automatically revokes the associated certificate. The revocation is recorded in the SecureW2 Dynamic PKI’s CRL, and Cloud RADIUS checks CRL status at every EAP-TLS authentication event. At the next connection attempt, Cloud RADIUS returns a RADIUS Reject, closing network access without IT helpdesk intervention.

Use Cases

Deployment & Architecture Detail

SAML SP Configuration in JoinNow

SecureW2 JoinNow, a SAML 2.0 service provider, connects to Shibboleth by exchanging SAML metadata and configuring Shibboleth’s attribute release policy to send user attributes to JoinNow during enrollment. To set up, register JoinNow SP metadata (Entity ID and assertion consumer service URL) in Shibboleth, upload Shibboleth IdP metadata (Entity ID, SSO endpoint URL, signing certificate) into JoinNow, and configure the attribute release policy to release uid, mail, eduPersonAffiliation, eduPersonPrincipalName, and ou to JoinNow SP.

 

In JoinNow, incoming SAML assertion attributes are mapped to identity fields in certificate templates and enrollment policy conditions, restricting issuance to specific users. JoinNow uses SP-initiated SSO: users visit the enrollment portal, JoinNow sends a SAML AuthnRequest to Shibboleth, and Shibboleth returns the assertion after authentication. IdP-initiated flows are not used for enrollment. JoinNow inherits Shibboleth IdP authentication requirements, including MFA via Duo, TOTP, or Shibboleth MFA plugins, eliminating the need for additional MFA configuration.

Automated Eduroam Onboarding

Deliver a seamless, self-service enrollment experience where students and faculty use their existing Shibboleth credentials to receive secure, phishing-resistant certificates for campus-wide Wi-Fi. When a user visits the JoinNow enrollment portal, they authenticate through their institution's Shibboleth SSO flow. JoinNow receives the SAML assertion, encodes the user's identity attributes, including eduPersonPrincipalName, into a certificate, and installs it on the device automatically. Cloud RADIUS is configured as the institution's home RADIUS server in the eduroam hierarchy, so the issued certificate works for campus Wi-Fi and at any eduroam-participating partner institution worldwide. No IT helpdesk involvement required. No shared passwords. No manual device configuration. Students and faculty connect securely from the moment enrollment completes.

Frequently Asked Questions

Shibboleth Integration — Common Questions

Does SecureW2 require changes to the existing Shibboleth IdP configuration?

Yes, but the changes are limited. The Shibboleth IdP administrator needs to register JoinNow as a SAML SP in the IdP metadata configuration and configure an attribute release policy to send the required user attributes uid, mail, eduPersonAffiliation, eduPersonPrincipalName, ou to JoinNow during enrollment. No changes to Shibboleth authentication mechanisms are required.
 

What SAML attributes does JoinNow require from Shibboleth?

At minimum, JoinNow needs a unique user identifier (uid or eduPersonPrincipalName) and an email address (mail) to issue a certificate. For role-based VLAN segmentation, eduPersonAffiliation and ou are recommended. Custom institution-defined attributes can be mapped to JoinNow certificate fields if your policies require them.
 

Does the user authenticate through Shibboleth on every Wi-Fi connection?

No. Shibboleth authentication happens once during self-service enrollment. JoinNow uses the SAML assertion to verify identity and issue a certificate. After enrollment, the device authenticates using EAP-TLS with that certificate. No SSO interaction is required at network authentication time. The certificate carries the user's identity so Cloud RADIUS can enforce access policy without contacting the IdP on every connection.
 

What happens to a student's certificate when they graduate?

When the student's account is deprovisioned in the Shibboleth-backed LDAP directory, JoinNow CloudConnector can detect the change and automatically revoke the certificate. Cloud RADIUS will reject the certificate at the next authentication attempt. Administrators can also revoke certificates manually through the JoinNow admin console if immediate revocation is needed before the next scheduled LDAP sync.

Is eduroam supported with JoinNow-issued certificates?

Yes. JoinNow Cloud RADIUS supports the eduroam RADIUS federation. Certificates issued with the user's eduPersonPrincipalName in the SAN are recognized by eduroam-participating institutions. Institutions configure JoinNow as their home RADIUS server in the eduroam hierarchy. Users can authenticate at partner institutions without any changes to their device.

Does SecureW2 operate the CA, or does the institution run its own PKI?

SecureW2 operates the CA as a managed cloud service. Institutions do not need to deploy or manage on-premises PKI infrastructure, CRL distribution points, or OCSP responders. SecureW2 handles issuance, renewal, and revocation. For institutions that require an institutional CA, SecureW2 can issue certificates under a customer-provided intermediate CA.
 

Can JoinNow issue certificates to BYOD devices, or only institution-managed devices?

Both. BYOD devices are the primary use case for JoinNow enrollment via Shibboleth SSO. The user visits the enrollment portal on their personal device, authenticates through Shibboleth, and JoinNow installs the certificate and network profile automatically. For institution-managed devices, SecureW2 also supports MDM-based auto-enrollment through Jamf, Intune, and Google Workspace alongside the Shibboleth SAML flow.

What if a user loses their device or a certificate is compromised?

Certificates can be revoked immediately through the JoinNow admin console. Revocation takes effect at the next EAP-TLS authentication attempt Cloud RADIUS checks OCSP or CRL status on every connection. Users can re-enroll a replacement device through the self-service portal after an administrator clears the revoked enrollment record.

Is multi-factor authentication supported during enrollment?

Yes. JoinNow defers all authentication to Shibboleth during the enrollment SAML flow. If the institution's Shibboleth configuration requires MFA via Duo, TOTP, or a Shibboleth MFA plugin users will complete the second factor as part of the SSO login before JoinNow issues the certificate. No additional MFA configuration is required in JoinNow.
 

What platforms does JoinNow support for self-service enrollment?

JoinNow MultiOS supports Windows, macOS, iOS, iPadOS, Android, and ChromeOS. On Windows, JoinNow uses WMI and the native 802.1X configuration APIs. On macOS and iOS, JoinNow delivers a signed configuration profile (.mobileconfig). On Android, JoinNow uses the Android KeyStore and Wi-Fi configuration APIs. Certificates are installed in the device's system certificate store, not user-accessible storage.

Ready to Activate Shibboleth Integration with SecureW2?

Connect with our integration specialists to implement this solution in your environment and transform your security posture.

Schedule a demoContact Sales