Shibboleth

Shibboleth is open-source identity software for organisations that need federated authentication across many services and sites. It suits universities, identity federations and commercial teams able to run their own infrastructure. Its standards breadth and federation controls are strong reasons to choose it, while the lack of lifecycle provisioning is a serious constraint for automated workforce administration.

Overview

Founded in 2000, Shibboleth serves individual organisations and multi-site federations, including academic institutions and commercial organisations worldwide. Its Identity Provider is built for substantial demand, handling millions of authentication requests per day. That capacity makes it a credible foundation for institutional or national identity services rather than a small, hosted sign-in add-on.

Deployment is self-hosted on Linux, macOS or Windows, leaving your team responsible for installation, policy and operations. The software is free to download and use. General support comes through Wiki documentation, community forums and mailing lists; Consortium members also receive developer Q&A and members-only Slack support, useful when a federation needs a more direct escalation route.

Key features

Federated sign-on and directories

The Identity Provider supplies flexible single sign-on for complex identity environments and supports SAML 1.1, SAML 2.0, OpenID Connect and CAS. LDAP and Kerberos integrations help it fit established directories, while built-in multi-factor authentication and adaptive access add stronger controls without requiring a separate identity layer. Authentication and data manipulation can be customised, so experienced teams can match local policy instead of accepting a fixed workflow.

Service-provider integration

The Service Provider works with a broad range of web applications and popular web servers. Its policy-oriented authorization features let administrators express access rules beyond simply accepting a successful login. This is particularly valuable where one identity service must protect many independently managed applications.

Discovery and metadata

The Embedded Discovery Service narrows a large federation to a smaller identity-provider list and supports screen readers, improving selection for users in complex federated environments. The Metadata Aggregator verifies digitally signed metadata, filters chosen elements and exposes a web service for querying processed results. Together, these tools reduce the administrative burden of maintaining federation relationships, but they still require teams capable of governing metadata and trust.

Provisioning gap and security maintenance

There is no lifecycle provisioning. Shibboleth can authenticate and authorize users, but it will not supply automated joiner, mover and leaver account workflows; organisations needing that automation should plan another system. The project publishes security advisories and recommends updating the Identity Provider to version 5.2.2 or later for the May 2026 XML parsing vulnerability. Self-hosting therefore includes an ongoing patch-management obligation.

Pricing

The Shibboleth software plan costs nothing and is free to download and use. There is no free trial because the software itself is free. Separate annual plans price organisational or federation membership and scale by users, revenue or connected identity and service providers:

All paid figures are billed annually. Smaller academic or commercial organisations pay less but receive correspondingly lower user or revenue thresholds; federation pricing is tied to the number of IdPs and SPs. Choose the free software when you only need the platform, and budget membership pricing when the associated organisational support and participation fit your operation.

Platforms

Shibboleth runs on Linux, macOS and Windows and is self-hosted. It is suited to teams that can manage servers, upgrades, certificates, metadata and availability themselves, rather than buyers seeking a fully managed cloud service.

Who it's for

Universities, research communities, identity federations and large commercial organisations are the natural audience. It is especially appropriate when SAML federation, directory integration, fine-grained authorization and high authentication volume matter more than turnkey administration. Smaller teams, or organisations that require automated account provisioning as a core function, should look elsewhere or pair it with another provisioning system.

Pros and cons

• Pros: Supports SAML 1.1, SAML 2.0, OpenID Connect and CAS, covering diverse federation requirements.
• Pros: Handles millions of authentication requests per day, giving large institutions headroom.
• Pros: Metadata signing checks, filtering and query services strengthen federation governance.
• Pros: Built-in MFA, adaptive access, LDAP and Kerberos integration support mature security environments.
• Cons: No lifecycle provisioning, so account creation and removal remain a separate responsibility.
• Cons: Self-hosting and security patching demand skilled operational staff.

Alternatives

For a broad directory of options, see Single Sign-On Software.

• FusionAuth is a freemium alternative with a free, unlimited self-hosted Community plan for core authentication.
• miniOrange Identity and Access Management suits teams wanting freemium customer or employee identity options plus a free trial.
• Zoho Directory is a freemium, cross-platform choice with a 10-user free tier and a seven-day reporting window.
• authentik is worth considering for open-source self-hosting with OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy support.
• Google Cloud Identity fits organisations preferring a managed service; its Premium annual plan is $6 a month.
• Ory offers freemium developer and production tiers for teams building identity services around APIs and self-hosting.
• Auth0 Guardian is a focused freemium option for mobile MFA scenarios.
• AWS IAM Access Analyzer is a free AWS service for validating IAM policies and generating policy guidance, not a full federation platform.

Verdict

Choose Shibboleth when your organisation needs open-source, self-hosted federation with extensive protocol, directory, metadata and authorization control at institutional scale. Its free software and high-volume Identity Provider are compelling for capable universities and federations. Look elsewhere when automated lifecycle provisioning or managed operations is a primary requirement.