InCommon Technical Discussions

[Nick Roy <>]

FYI

-------- Forwarded Message --------

Subject:	[InCommon NOTICE] InCommon eduGAIN import ruleset change RESCHEDULED to March 7
Date:	Mon, 26 Feb 2018 13:14:34 -0700
From:	Nick Roy
To:

Due to the impact of retiring the legacy metadata download endpoint,
which will affect sites on February 27, we are re-scheduling the change
of our eduGAIN import ruleset to the following week, Wednesday, March 7th.

Best regards,

Nick Roy
Director of Technology and Strategy, InCommon / Internet2 Trust and
Identity Services

On 2/22/18 1:20 PM, Nick Roy wrote:
> Hello,
>
> On February 28, InCommon will release version 8 of its eduGAIN import
> ruleset [1].
>
> This ruleset allows us to remove our ban on the importation of regular
> _expression_ scopes in metadata, but imposes some validity checks on
> scopes to try to limit security exposure from malformed, overly-broad or
> otherwise problematic scopes (regular _expression_ or otherwise). Within
> the next few days, we will publish our updated edugain import policy
> rules at [2]. I encourage you to take a look at those rules both now and
> after they are updated (you can add a 'watch' to the page to see when it
> changes) and let me know if you have any comments. That page also
> contains links to our daily metadata filtering reports, which you can
> also examine.
>
> The following is a summary of expected changes to imported metadata that
> will take place on February 28. We have also provided a detailed report
> (attached), which includes details of the issues affecting these
> filtered entity descriptors.
>
> Entity descriptors which will not be imported starting on February 28th:
>
> Issues with invalid, overly-broad or non-public-domain scopes:
> https://id-dev.unc.edu.ar/idp/shibboleth
> https://sso.saxion.nl/opensso
> http://sts.deltion.nl/adfs/services/trust
> http://sts.roc-nijmegen.nl/adfs/services/trust
> http://fed.rijnijssel.nl/adfs/services/trust
> https://cafe.ufba.br/idp/shibboleth
> https://birk.wayf.dk/birk.php/wayf.aau.dk
> https://idp.renata.edu.co/idp/shibboleth
> https://idp.trc.gov.om/idp/shibboleth
>
> Issues with ACS, SSO or SLO endpoints that do not use TLS:
> urn:mace:feide.no:services:no.inspera.assessment.dev
>
> RequstedAttribute lacks a NameFormat attribute:
> https://elixir.mf.uni-lj.si/sp/201506181025
> https://elixir.mf.uni-lj.si/sp/20150622
>
> [1] https://github.internet2.edu/InCommon/inc-meta/releases/tag/incommon-v8
> [2] https://spaces.internet2.edu/x/TgCNBQ
>
> Thank you and best regards,
>
> Nick Roy
> Director of Technology and Strategy, InCommon / Internet2 Trust and
> Identity Services

------------------------
InC-Ops-Notifications

This is a notification-only email list with an open subscription policy. This 
list has two types of subscribers:

1) All InCommon Site Administrators
2) Other subscribers

If you are a designated InCommon Site Administrator for your organization, 
you MUST remain on this email list. (You will not be able to unsubscribe.) 
The reason is that this list is the primary means of notifying you regarding 
timely information that could potentially affect the way your systems operate 
in a federated context.

Apart from Site Administrators, anyone else may subscribe to this list:

SUBSCRIBE: To subscribe to this email list:
Send email to 

 with the subject: sub inc-ops-notifications 
OR 
Visit: https://lists.incommon.org/sympa/subscribe/inc-ops-notifications

UNSUBSCRIBE: To unsubscribe from this email list:
Send email to 

 with the subject: unsub inc-ops-notifications
OR
Visit: https://lists.incommon.org/sympa/signoff/inc-ops-notifications

If you have any questions regarding InCommon Operations, please email 

 

To discuss an issue with the InCommon community related to federation, please 
post to