InCommon Operations Notifications

[Nick Roy <>]

Hello,

On Wednesday, August 2, a delegated SP metadata administrator in the
InCommon Federation Manager reported the ability to access their
delegated SP metadata without supplying a password, and bypassing
federated authentication.  This would potentially allow an attacker who
knew the federated user ID of a delegated administrator to try to modify
SP metadata to which that delegated administrator had been granted
access by their InCommon Site Administrator.  Actual modification of
such metadata would have to be approved by both the Site Administrator
and InCommon staff, so there are two checks in place to prevent this
unauthorized tampering.

InCommon operations staff immediately patched the Federation Manager
database to prevent further such action, and the InCommon Federation
Manager development team has built a permanent fix and regression tests
in the application.  This permanent fix was immediately deployed to
production.  We will be writing up a full incident report on the issue
in the coming weeks, and sharing that with InCommon participants.

In the meantime, please address any questions you may have to me, at
.

Thank you,

Nick Roy
Director of Technology and Strategy, InCommon