InCommon metadata support

[Scott Koranda <>]

This time including ...

> Hi Stijn,
> 
> I am forwarding your note to . They will be
> able to explain in detail why the metadata for your IdP has been
> excluded from the InCommon metadata feed that CILogon uses. They will
> also be able if necessary to consult with eduGAIN and the Belnet
> Federation operators.
> 
> Thanks,
> 
> Scott K for CILogon
> 
> > hi terry,
> > 
> > > [java] ERROR - Item 
> > > https://identity.ugent.be/simplesaml/saml2/idp/metadata.php (BE) was 
> > > marked with the following Error status messages
> > > [java] ERROR -     checkScopes/upperCase: scope 'UGent.be' includes 
> > > upper-case characters
> > oh boy...
> > 
> > > 
> > > 
> > > The rules for eduGAIN metadata import can be found at
> > > https://spaces.at.internet2.edu/display/InCFederation/Interfederation+Technical+Policy
> > the rules do not mention anything about not allowing uppercase letters
> > (not that we checked upfront years ago, but still).
> > 
> > > .
> > > 
> > > After you fix this issue in your local federation metadata, 
> > unfortunately, that will not happen that easily. we would need to change
> > our scope, and who knows what the fallout will be.
> > 
> > we would also need some very good argument why this is needed (aside
> > from the fatc that we need the CILogon service ;)
> > ideally there is some document stating that uppercase is not allowed;
> > but edugain doesn't seem to mind.
> > eg if
> > https://github.internet2.edu/InCommon/inc-meta/blob/master/mdx/incommon/edugain-policy.xml
> > is an actual edugain policy, we are clearly not compliant with edugain
> > (and that is (or might be) a valid reason to fix it, even with large
> > fallout)
> > 
> > however, if it is not, then we have a serious problem.
> > 
> > it is also annoying that even for regexps, uppercase is not allowed.
> > and to make it worse in our case, even with uppercase regex allowed, the
> > regex literal tail is a valid existing domainname;
> > on the other hand if the uppercase regex would constitute a valid
> > domain, then we should be able to use it as valid scope.
> > 
> > do you have any contact info for the people who are familiar with this
> > policy?
> > 
> > many thanks,
> > 
> > 
> > stijn