eduGAIN · DFN-AAI
University SSO.
Your login. Our system.
QUESTIONSTAR is a Service Provider in eduGAIN and DFN-AAI. Students, faculty, staff and administration sign in with their university account — no second account, no separate password.
Service Provider in both federations
What this means for your university
Everyone with a university account — students, faculty, staff, administration — uses their familiar login. Sign-in takes about two clicks, no additional QUESTIONSTAR passwords floating around in your IT.
Roles like survey author, respondent or admin map to the attributes your IdP already releases. No separate user directory, no duplicates — your identity management stays in one place.
The sign-in flow
Standard Shibboleth SAML 2.0 flow. Your IdP verifies the credentials, releases the attributes you configured, we map roles and access. QUESTIONSTAR never sees passwords — they stay only with your IdP.
What your IdP should release
Standard Shibboleth attributes that your IdP typically already releases:
| Attribute | Purpose |
|---|---|
eduPersonPrincipalName | Unique user identifier |
mail | Contact address |
displayName (or givenName + sn) | Display name in the QUESTIONSTAR interface |
schacHomeOrganization | Home institution mapping |
eduPersonAffiliation or eduPersonScopedAffiliation | For role mapping (student, faculty, staff → QUESTIONSTAR roles) |
eduPersonEntitlement (optional) | For granular access control, if needed |
If your university uses different attributes or a different mapping logic, we adjust our attribute mapping accordingly. That's part of the setup conversation.
From request to live
Four steps, transparent and without marketing fog:
- 1
You order a license.
See Academic pricing. Pricing scales with your institution's size and intended use cases.
- 2
You send us your IdP metadata and role requirements.
IdP metadata XML from your Shibboleth configuration, plus a brief description of which attribute values should map to which QUESTIONSTAR role.
- 3
We configure your tenant.
Attribute mapping, roles, access to your surveys and results. Test login typically ready within 1-2 business days.
- 4
Test login, then go live.
You verify with a few test accounts that sign-in, roles and access are correct. Then production.
What can take longer?
The timeline above applies to test login. A full rollout can take longer if you:
- want to set up a custom domain for branding or respondent trust,
- prefer to host on your own infrastructure instead of our servers,
- need to run specific GDPR or DPA clauses through internal review before approval.
All three points we discuss up front to keep the schedule realistic.
Reach 70+ national federations worldwide
Through eduGAIN we automatically reach more than 70 national federations worldwide — InCommon (US), UKfed (UK), SWITCH-AAI (CH), SURFconext (NL), HAKA (FI), CAF (Canada), Tuakiri (New Zealand), and many others.
QUESTIONSTAR is registered as a Service Provider in the eduGAIN Interfederation Service. The Shibboleth infrastructure stands on our end already — for connection to a specific national federation we coordinate with their SP registrar. No new infrastructure setup, no extra effort from your university.
Practical cases
- Erasmus programs or exchange students who should participate in surveys during their stay
- Cross-institutional research collaborations with international author participation
- Multi-partner grants where research assistants from different institutions need shared access
- Sabbatical or visiting scholar programs with temporary access
How your home federation fits
Your university is likely already a member of your national federation (InCommon, UKfed, SWITCH-AAI, etc.). If your federation is part of eduGAIN — which most major national academic federations are — your IdP can reach us through the interfederation trust fabric, with no new federation memberships on your side. We switch SSO on for your institution once it’s licensed.
Frequently asked questions
Does our university need its own servers to use QUESTIONSTAR?
No. QUESTIONSTAR runs on our servers in the EU (Frankfurt am Main, Germany — IONOS data centers, ISO 27001 certified) by default. If your compliance policy requires self-hosting, on-premise deployment is available — we discuss that up front.
How long does the connection take?
Test login: 1-2 business days after license order and IdP metadata handover. Full deploy can take longer — depending on whether you set up a custom domain for branding, host on your own infrastructure, or need to run specific internal approval processes. We discuss the details in the setup conversation.
Can we map roles (author, respondent, admin) to specific attributes?
Yes. Standard mapping is based on eduPersonAffiliation — for example, faculty and staff receive author rights, student receives respondent rights. If your university uses a different role model (e.g. via eduPersonEntitlement or custom attributes), we adjust the mapping accordingly. That’s part of the setup conversation.
What about data protection and data processing agreements?
Standard GDPR compliance with a data processing agreement included — no extra effort for SSO connection. Details at Security and the data processing agreement.
Is the connection included in the academic license or is there an extra fee?
Included. The technical setup is part of our academic licensing. See Academic pricing for the full terms.
Not from a university context?
For business use we offer Single Sign-On via any standard OAuth 2.0 / OpenID Connect identity provider:
- Microsoft Entra ID (formerly Azure AD)
- Microsoft 365
- Google Workspace
- Okta
- Auth0
- Your own OIDC-compliant IdP stack
The setup process is analogous to university SSO: order a license, hand over IdP metadata and role requirements, we configure, you test, then go live.
Request business SSO setupReady to connect?
Tell us briefly which university you represent, which use case you have in mind (course evaluation, research survey, administrative feedback, ...), and whether you have specific hosting or branding requirements. We respond within one business day.