Shibboleth

Shibboleth is open-source identity-management software for organisations, campuses and federations that need standards-based authentication across many services. It suits teams prepared to run self-hosted infrastructure and manage identity policy themselves. Its broad protocol and federation tooling are compelling, but the absence of lifecycle provisioning makes it a poor fit when automated account joiner-mover-leaver workflows are essential.

Overview

Founded in 2000, Shibboleth serves individual organisations and multi-site federations, including academic institutions and commercial organisations. The software is free to download and use, and its Identity Provider is designed for demanding environments, handling millions of authentication requests per day. That scale makes it appropriate for national or institutional identity infrastructure rather than a lightweight sign-in widget.

Shibboleth is self-hosted, so the organisation owns deployment and operational responsibility. General users rely on Wiki documentation, community forums and mailing lists. Consortium membership adds developer question-and-answer access and members-only Slack support, which matters when a federation needs a more direct escalation path.

Key features

Federated sign-on and protocols

The Identity Provider offers flexible single sign-on for complex identity requirements and supports SAML 1.1, SAML 2.0, OpenID Connect and CAS. LDAP and Kerberos integrations let it work with established directories. Built-in MFA and adaptive access strengthen authentication choices, while customizable authentication and data-manipulation features allow specialist policies. This breadth benefits institutions connecting varied legacy and modern services, though it demands administrators who can design and maintain those policies.

Service-provider controls

The Service Provider integrates with a wide range of web applications and popular web servers. Its policy-oriented authorization features let organisations express access rules beyond simple login, making it useful where application permissions follow institutional or federation policy.

Discovery and metadata

The Embedded Discovery Service presents users with a smaller Identity Provider list and supports screen readers, helping large federations reduce selection friction without abandoning accessibility. The Metadata Aggregator verifies digitally signed metadata, filters selected elements and exposes a web service for querying processed metadata. Those controls are valuable for federations that must govern trust data at scale.

There is no lifecycle provisioning. Shibboleth authenticates and authorizes identities but does not provide an end-to-end automated process for creating, changing and removing accounts.

Pricing

The Shibboleth software plan costs free and is free to download and use. It is the natural choice for organisations able to operate the stack and obtain support through community channels.

Paid annual plans are structured around organisation type and scale:

• Academic/Non-Profit Small: $3,354 a year, up to 10,000 users.
• Academic/Non-Profit Medium: $6,707 a year, 10,000–50,000 users.
• Academic/Non-Profit Large: $10,061 a year, 50,000+ users.
• Commercial Small: $6,707 a year, revenue up to €10m.
• Commercial Medium: $13,415 a year, revenue €10m–€100m.
• Commercial Large: $26,829 a year, revenue €100m+.
• NREN/Federation Small: $15,244 a year, up to 250 IdPs and SPs.
• NREN/Federation Medium: $30,488 a year, 251–750 IdPs and SPs.
• NREN/Federation Large: $60,976 a year, 750+ IdPs and SPs.

Every paid tier is billed annually. The thresholds make budgeting predictable for universities, companies and federation operators, while the jump from free software to paid membership is mainly a support and consortium commitment rather than a feature-gated hosted edition. There is no free trial because the core software is already free.

Platforms

Shibboleth supports Linux, macOS, Windows and self-hosted deployments. That range accommodates mixed administration environments, but all platforms still require the organisation to run and secure its own identity services.

Who it's for

Choose Shibboleth for universities, research networks, identity federations and enterprises that need SAML-heavy interoperability, signed metadata controls and policy-driven authorization at substantial scale. It is also a strong choice when open-source licensing and self-hosting are strategic requirements. Look elsewhere if you need turnkey cloud administration, automated lifecycle provisioning or a simpler implementation for a small application estate.

Pros and cons

• Pros: free open-source software; support for SAML, OpenID Connect and CAS; LDAP and Kerberos integration; built-in MFA and adaptive access; service-provider integration with popular web servers; signed-metadata verification and filtering; accessible discovery service; proven capacity for millions of daily authentication requests.
• Cons: no lifecycle provisioning; self-hosting puts deployment and maintenance on your organisation; community support is the baseline unless you join the Consortium; paid annual tiers become substantial for larger commercial and federation deployments.

Alternatives

For a broader comparison, see Single Sign-On Software.

• miniOrange Identity and Access Management is a freemium, multi-platform option with a free Customer IAM tier and a free trial.
• FusionAuth offers a free self-hosted Community plan with unlimited use and core authentication features.
• Zoho Directory provides a free tier for 10 users, three third-party cloud apps and two directory stores, plus a free trial.
• Ory suits teams considering a freemium model with a developer tier and a paid production environment.
• authentik is an open-source alternative supporting OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy use.
• Google Cloud Identity is a managed alternative with automated provisioning in its 6.00 USD-per-user-per-month annual plan.
• AWS IAM Access Analyzer is a free AWS service focused on IAM policy validation and generation.
• Descope offers open-source SDKs and a free tier capped at 7,500 monthly active users, 10 monthly active tenants and three SSO connections.

Verdict

Shibboleth is a strong recommendation for technically capable institutions and federations that need open, standards-based identity infrastructure with serious metadata and authorization controls. Choose it for scale, protocol coverage and self-hosting freedom; choose another product when automated provisioning, managed operations or simpler support is more important than federation depth.