SAML 2.0

[!WARNING] Planned — not yet available. SAML 2.0 is not implemented yet. Campus One currently issues identity exclusively over OpenID Connect; the SAML endpoints, metadata URL, and certificate described below do not exist today. This page documents the intended SAML integration so you can plan ahead — use OIDC for any integration you need to ship now.

SAML 2.0 is planned for enterprise and legacy systems that cannot use OIDC. Campus One will act as the Identity Provider (IdP); your app is the Service Provider (SP).

Credentials

After connecting your app in the developer dashboard, find these values in the Sign-in tab:

Configure your SP using the IdP Metadata URL — most SAML libraries can auto-import from it.

SP configuration you must provide

In the app drawer → Sign-in tab, enter:

Sign-in flow

Student clicks "Sign in with Campus One"
  → Your SP generates a SAML AuthnRequest
  → Student's browser is redirected (POST or Redirect binding) to Campus One SSO URL
  → Campus One authenticates the student
  → Campus One POST-binds a signed SAMLResponse to your ACS URL
  → Your SP validates the signature and extracts the assertion
  → Student is signed in

SAMLResponse attributes

Campus One includes user attributes in the assertion. Attribute names follow the URN convention:

Which attributes are present depends on the permissions granted for your app.

Signature verification

All assertions are signed with Campus One's X.509 certificate. Always verify:

1. The Issuer matches https://auth.campusone.com.ng/saml
2. The signature is valid against the downloaded certificate
3. NotBefore and NotOnOrAfter conditions are respected
4. The Audience restriction matches your SP Entity ID

Never process an unsigned or unverified assertion.

Example: Node.js with samlify

import * as samlify from "samlify";
import * as validator from "@authenio/samlify-node-xmllint";

samlify.setSchemaValidator(validator);

const idp = samlify.IdentityProvider({
  metadata: "https://auth.campusone.com.ng/saml/metadata",
});

const sp = samlify.ServiceProvider({
  entityID: "urn:nile:campusone:yourapp",
  assertionConsumerService: [
    {
      Binding: samlify.Constants.namespace.post,
      Location: "https://yourapp.nile.edu/saml/acs",
    },
  ],
});

// Generate login URL
const { context } = sp.createLoginRequest(idp, "redirect");
res.redirect(context);

// Handle ACS POST
app.post("/saml/acs", async (req, res) => {
  const { extract } = await sp.parseLoginResponse(idp, "post", req);
  const email = extract.attributes["urn:oid:1.2.840.113549.1.9.1"];
  // sign in the user...
});

Key rotation

Campus One rotates its signing certificate annually. Watch for the CampusOne-Certificate-Expiry header in SAML responses — it contains the days until the next rotation. Download the new certificate from the IdP metadata URL before the old one expires.