InCommon Operations Notifications

[Nick Roy <>]

Due to the impact of retiring the legacy metadata download endpoint,
which will affect sites on February 27, we are re-scheduling the change
of our eduGAIN import ruleset to the following week, Wednesday, March 7th.

Best regards,

Nick Roy
Director of Technology and Strategy, InCommon / Internet2 Trust and
Identity Services

On 2/22/18 1:20 PM, Nick Roy wrote:
> Hello,
>
> On February 28, InCommon will release version 8 of its eduGAIN import
> ruleset [1].
>
> This ruleset allows us to remove our ban on the importation of regular
> expression scopes in metadata, but imposes some validity checks on
> scopes to try to limit security exposure from malformed, overly-broad or
> otherwise problematic scopes (regular expression or otherwise). Within
> the next few days, we will publish our updated edugain import policy
> rules at [2]. I encourage you to take a look at those rules both now and
> after they are updated (you can add a 'watch' to the page to see when it
> changes) and let me know if you have any comments. That page also
> contains links to our daily metadata filtering reports, which you can
> also examine.
>
> The following is a summary of expected changes to imported metadata that
> will take place on February 28. We have also provided a detailed report
> (attached), which includes details of the issues affecting these
> filtered entity descriptors.
>
> Entity descriptors which will not be imported starting on February 28th:
>
> Issues with invalid, overly-broad or non-public-domain scopes:
> https://id-dev.unc.edu.ar/idp/shibboleth
> https://sso.saxion.nl/opensso
> http://sts.deltion.nl/adfs/services/trust
> http://sts.roc-nijmegen.nl/adfs/services/trust
> http://fed.rijnijssel.nl/adfs/services/trust
> https://cafe.ufba.br/idp/shibboleth
> https://birk.wayf.dk/birk.php/wayf.aau.dk
> https://idp.renata.edu.co/idp/shibboleth
> https://idp.trc.gov.om/idp/shibboleth
>
> Issues with ACS, SSO or SLO endpoints that do not use TLS:
> urn:mace:feide.no:services:no.inspera.assessment.dev
>
> RequstedAttribute lacks a NameFormat attribute:
> https://elixir.mf.uni-lj.si/sp/201506181025
> https://elixir.mf.uni-lj.si/sp/20150622
>
> [1] https://github.internet2.edu/InCommon/inc-meta/releases/tag/incommon-v8
> [2] https://spaces.internet2.edu/x/TgCNBQ
>
> Thank you and best regards,
>
> Nick Roy
> Director of Technology and Strategy, InCommon / Internet2 Trust and
> Identity Services