InCommon Technical Discussions

[Nick Roy <>]

They do care - and they were also affected by an ePTID/SAML persistent
nameID-related issue that also involved deployers not getting an upgrade
right.  Interestingly, neither case involved IdPv3.  One was an IBM
product, the other was SimpleSAMLphp.  More info can be found in the
incident report linked off our security incident handling wiki:

https://spaces.internet2.edu/display/InCFederation/Security+Incident+Handling

Nick

On 6/7/17 7:43 PM, Wessel, Keith wrote:
> If memory serves, ORCID also cares. They weren't federated back in 2015 
> when I did my IdP upgrade to V3.
>
> Keith
>
>
> -----Original Message-----
> From: 
> 
>  
> [mailto:]
>  On Behalf Of Basney, Jim
> Sent: Wednesday, June 07, 2017 7:55 PM
> To: 
> 
> Subject: Re: [InC-Technical] ePTID changes caused by Shibboleth IdPv3 
> upgrade
>
> On 6/7/17, 4:52 PM, Wessel, Keith wrote:
>> why are the EPTID values changing?
> I don't know. If someone from InCommon wants to follow-up with the IdP 
> operators to find out, I'd be happy to provide details off-list. It'd be 
> even better if the IdP operators in question want to reply on the list.
>
>> You were actualy the one who reported the error to me.
> Yes, exactly my point. No SPs other than CILogon seem to care about ePTID, 
> so why should the IdP operators bother to get it right? Things are working 
> for the SPs that matter to them. CILogon is an outlier.
>
> Are there any other SP operators on the list who are detecting these ePTID 
> changes?
>
> -Jim
>