Tsinghua University Identity Provider — SAML 2.0 Federation Metadata

Tsinghua operates its own Shibboleth Identity Provider and publishes machine-readable SAML 2.0 metadata about it at a public, unauthenticated URL on its own domain. The document declares entityID https://idp.tsinghua.edu.cn/idp/shibboleth, a Shibboleth shibmd:Scope of tsinghua.edu.cn, an IDPSSODescriptor advertising SAML 2.0, SAML 1.1 and urn:mace:shibboleth:1.0, four SingleSignOnService and four SingleLogoutService bindings, two ArtifactResolutionService endpoints and an AttributeAuthorityDescriptor with SOAP attribute query on port 8443. This is the surface class a university operates by definition, and it is the one where Tsinghua is stronger than several of its better-ranked peers in this cohort: every SSO and SLO location resolves to a Tsinghua host, so the institution runs the SAML service itself rather than fronting it with OpenAthens or a federation operator. The corresponding human-facing login estate (id.tsinghua.edu.cn, with an OAuth-shaped /thu-oauth/callback) publishes no client registration, scope list or discovery document, so the federation metadata is the only part of the identity estate an outside party can read. Gaps recorded honestly: the metadata carries no validUntil, no cacheDuration and no XML signature, so relying parties have no published refresh interval and no tamper check.