A denial-of-service attack paralyzed a single sign-on service used by universities just as students return to campus.