InCommon Operations Notifications

[Thomas Scavo <>]

Earlier today, InCommon Ops upgraded our metadata aggregator (MDA) tooling in 
production. Our tooling is based on Shibboleth MDA V0.9.1, which introduced a 
new CRDetectionStage that filters literal CR characters from imported 
metadata. (Recall that, on March 22, we inadvertently imported and published 
IdP metadata that contained literal CR characters, which caused some SPs to 
experience a brief outage.)

The tooling implements four new import filters, documented on the 
Interfederation Technical Policy wiki page. [1] If you compare last week’s 
import filter log to today’s log [2] you will notice the following 
differences:

* One SP entity with an entityID prefix not on the whitelist is filtered: 
urn:urkund:shibboleth:sp

* Two IdP entities with one or more regexs in a scope are filtered.

* A total of 15 non-HTTPS logo elements are filtered, from 11 different 
entities.

If you have questions, please contact us at 


Tom Scavo
For InCommon Ops

[1] https://spaces.internet2.edu/x/TgCNBQ
[2] 
https://wayf.incommonfederation.org/metadata-diff/md_filter_reports/?C=M;O=D

On Tue, Jun 7, 2016 at 10:17 AM, Thomas Scavo 
<>
 wrote:
>
> Imported metadata is filtered as outlined on the Interfederation Technical 
> Policy wiki page: https://spaces.internet2.edu/x/TgCNBQ
>
> A copy of the import filter log is routinely published on the web server: 
> https://wayf.incommonfederation.org/metadata-diff/md_filter_reports/?C=M;O=D
>
> On Monday, June 13, 2016, InCommon Ops will deploy four (4) additional 
> filter stages in production. See the Interfederation Technical Policy wiki 
> page (linked above) for details. Watch the published import filter log 
> (linked above) for changes.