Technical requirements

Set up a SAML 2.0 identity provider

The organisation must have its own authentication infrastructure. On top of it, an identity provider supporting SAML 2.0 is set up with Shibboleth or SimpleSAMLphp. The setup has four parts:

User authentication

Authenticating the user against the organisation's authentication infrastructure.

Attribute resolution

Collecting attributes about the authenticated subject. This sometimes happens during authentication, sometimes after it. Data can come from the authentication infrastructure or from other systems such as SQL databases or web services, and can be combined, transformed or set to fixed values. Some of the collected attributes are later sent to the service provider.

Attribute release

Deciding which of the person's attributes are released to which service, by defining the necessary rules.

Regular metadata refresh

Periodically fetching current metadata for the services in YETKİM and eduGAIN.

Release the core attributes

The identity provider must be able to release the core attributes defined for YETKİM, correctly and consistently.

Complete organisation, service and contact details in your metadata

Organisation

Organisation name, web page and similar details.

Contacts

At least a technical and a support contact. Contacts should be groups, not individuals, and e-mail addresses should be aliases or lists. Example: Identity Support, kimlik-destek@universite.edu.tr

MDUI

Metadata Extensions for Login and Discovery User Interface: service name, description, logo, information page, privacy page and hints for discovery services.

Check your metadata with the eduGAIN validator

Validate your metadata at technical.edugain.org/validator2.

• Tick Metadata URL contains only one entity in the form.
• Select both Turkish (tr) and English (en) as languages.
• Errors about mdrpi:RegistrationInfo can be ignored at this stage.

Send your metadata to YETKİM

Send your metadata to yetkim@ulakbim.gov.tr. It is checked and, if no problems are found, added to the YETKİM test infrastructure. Default entityID and metadata locations:

Your metadata URL is also your identity provider's entityID. Your metadata is retrieved through it, and service providers authorise your users based on it.

Domain name. The entityID depends on your domain. If the domain changes, access to services in YETKİM may break.

Test, then request to join

Once in the test infrastructure, check the YETKİM test services at test.yetkim.org.tr. If everything works, your organisation's YETKİM contact sends the request to join the production federation to yetkim@ulakbim.gov.tr.

Registration information is addedDone by YETKİM

Your metadata gets a final check and registration information (mdrpi:RegistrationInfo) is added to it.

Metadata is published in YETKİM and eduGAINDone by YETKİM

Your identity provider's metadata is included in YETKİM and at the same time sent to the eduGAIN metadata pool. Within a few hours, at most one day, it reaches every service in eduGAIN.

Listed as a participantDone by YETKİM

When these steps are complete your organisation is added to the YETKİM participants list.

Test attribute release in eduGAIN

Run the necessary checks with the eduGAIN attribute release test services at release-check.edugain.org.

Configure F-Ticks

Configure F-Ticks for service usage statistics. By default F-Ticks data goes to both YETKİM and eduGAIN. You may choose to send it to YETKİM only.

For Shibboleth and SimpleSAMLphp settings see f-ticks.edugain.org/techidp.html.

Entity categories (optional)

Identity providers that want to be part of specific entity categories contact YETKİM. Depending on the review, the relevant entity categories are added to their metadata.