InCommon Operations Notifications

[Nick Roy <>]

Hello,

For many years, InCommon has supported a redirect from a very old metadata download location:

http://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml

And

https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml

To the current production (“main”) aggregate location:

http://md.incommon.org/InCommon/InCommon-metadata.xml

We have not supported TLS for metadata downloads for a number of reasons, mainly because we felt it would cause a false sense of security for deployments that do not correctly verify the XML digital signature on the metadata document itself (see documentation at: https://spaces.internet2.edu/display/InCFederation/Metadata+Consumption)

On January 31, 2018, InCommon Operations will:

1. Remove the redirect noted above

2. Introduce TLS support for metadata downloads on md.incommon.org

Before January 31, 2018, it is critical that all metadata clients be configured to fetch metadata from http://md.incommon.org/InCommon/InCommon-metadata.xml. If you currently fetch metadata from one of the old (wayf.incommonfederation.org) locations noted above, you need to reconfigure your deployment. Failure to do so will mean your IdP and/or SPs will break.

Please pass along this information to anyone in your organization who is responsible for running an IdP or SP in InCommon, especially those such as delegated administrators or other systems administrators who may not be subscribed to this mailing list.

Thank you,

Nick Roy

Director of Technology and Strategy, InCommon / Internet2 Trust and Identity Services