InCommon Operations Notifications

[Nick Roy <>]

Dear InCommon participants,

As InCommon prepares to release our production per-entity metadata service in June, we need to retire the legacy MDQ beta service. This service (mdq-beta.incommon.org) will be retired tomorrow, Wednesday, May 1, 2019. At that point, all clients using this service will fail to download metadata from the service. This will cause those clients to not be able to use federated authentication, unless a change to their configuration is made. Before that time, all clients currently using the service should do one of two things:

1) Transition to the new MDQ Technology Preview, a pre-production MDQ service (just like mdq-beta.incommon.org, but built with different technology, the same technology we will use for production). More information on that option is available at: https://spaces.at.internet2.edu/x/2wR0C
2) Switch back to using the existing metadata aggregates. The main and idp-only aggregate will continue to be supported in the new production MDQ service, after it goes live in June. Information on the aggregates is available at: https://spaces.at.internet2.edu/x/JwQjAQ

It is important to note that the metadata signing key used by the old mdq-beta and the new MDQ Technology Preview are different. Clients changing from mdq-beta to the MDQ Technology Preview must reconfigure their software to use the new metadata signing public key for verification of metadata integrity. This is detailed in the MDQ Technology Preview documentation.

Site administrators should share this message with any Service Provider administrators or delegated administrators they may have encouraged to use the mdq-beta service.

Please send a request to if you have any questions or concerns about this change.

Thank you,
Nick Roy
Director of Technology and Strategy
InCommon/Internet2 Trust and Identity Services

Attachment: signature.asc
Description: OpenPGP digital signature