Identity providers
Identity providers configure OIDC/SSO authentication for an institute. Students and staff authenticate through these providers.
Creating an identity provider
- Go to Administration → Organisation → Identity providers → Add
Basic settings
- Institute: the institute this provider belongs to
- Name: display name (e.g. "SURFconext", "Microsoft Entra ID")
- Provider type: OIDC
- Active: enable this provider
OIDC endpoints
- Authorization / Token / Userinfo / JWKS / End Session / Issuer
Client credentials
- Client ID, Client secret (encrypted at rest)
Claim mapping
| Field | Default | Purpose |
|---|---|---|
| Username claim | sub | Used as the student number |
| Role claim | roles | Contains role information |
| Teacher role value | ses-teacher | Grants teacher access |
| Admin role value | ses-admin | Grants admin/staff access |
| Faculty claim | (blank) | Faculty of the teacher |
Access control claim
Access to an institute is enforced through the OIDC institutes claim. If
a user's claim does not include the institute, the login is refused — for
every tenant.
Role enforcement
| OIDC role | is_superuser | is_staff | Groups |
|---|---|---|---|
ses-superuser | Yes | Yes | ses-superuser, ses-admin, ses-teacher |
ses-admin | No | Yes | ses-admin, ses-teacher |
ses-teacher | No | Yes | ses-teacher |
ses-student | No | No | — |
SSO sessions
Single sign-on sessions are tracked with the user, identity provider, student number, role, an encrypted refresh token and an expiration time.