InCommon Operations Notifications

[Johnny Lasker <>]

Some InCommon organizations are reporting issues with their SSO. This is likely related to consumption of the legacy metadata aggregate which expired on March 31, 2025. This instance expired as part of our retirement of the legacy metadata aggregate and push to have all organizations use the MDQ service. 

 

The affected metadata URLs include:

• InCommon Legacy SAML Metadata Aggregate (http://md.incommon.org/InCommon/InCommon-metadata.xml)
• InCommon Legacy SAML IdP-Only Metadata Aggregate (http://md.incommon.org/InCommon/InCommon-metadata-idp-only.xml)

 

We understand that any outage is serious and we are working to publish one more valid instance of the legacy metadata aggregate which should resolve your current issues. This instance will be valid for two weeks, which means organizations will still need to move to the MDQ service before this instance expires to avoid another interruption.

 

If your organization operates SAML Identity Provider or Service Provider systems which are federated with InCommon for single sign-on (SSO), AND the systems rely on one of the InCommon legacy SAML metadata aggregates above, then those systems will need to be updated at your earliest convenience, to resolve future service interruptions.

 

Action Required

If possible, configure your SAML providers to support dynamic, per-entity metadata using the MDQ protocol. If you continue to require a metadata aggregate, configure your SAML provider(s) with the new All Entities or IdP only aggregate instead of the legacy aggregates. In either case, you will need to configure your providers to use InCommon's new signing key to verify the metadata signatures.

 

For more on the MDQ service, visit: https://spaces.at.internet2.edu/display/MDQ

 

Please let us know if you require further assistance.

 

Johnny Lasker

Principal Service Integration Engineer

Internet2 Trust & Identity