InCommon Operations Notifications

[Thomas Scavo <>]

You are receiving this message because you are an InCommon Site Administrator 
(or are otherwise subscribed to this mailing list). This message is FYI only.

Beginning on Monday, April 10, the InCommon Registration Authority (RA) will 
no longer validate the domains in the endpoint locations in registered 
metadata. The RA will continue to validate the domain in the entityID in both 
SP and IdP metadata, as well as the Scope in IdP metadata, but the domains in 
the endpoint locations will no longer be checked by the RA. This includes the 
domains in the endpoint locations in both SP and IdP metadata.

This new policy will have the greatest effect on the owners of SP metadata. 
Until now, the use of “foreign domains” in SP endpoint locations required a 
difficult and sometimes lengthy validation process. After consultation with 
both the Ops Advisory Group and the Technical Advisory Committee, it was 
determined that the existing process provides no security benefit to InCommon 
participants and therefore the process can be safely eliminated.

If you have concerns or questions about this new policy, please contact us at 


Tom Scavo
For the InCommon RA