InCommon Technical Discussions

[Nick Roy <>]

FYI

-------- Forwarded Message --------

Subject:	[InCommon NOTICE] Re: InCommon eduGAIN import ruleset change RESCHEDULED to March 7
Date:	Wed, 7 Mar 2018 10:32:27 -0700
From:	Nick Roy
To:

This change is now in place. Please let me know if you have any issues
consuming the updated metadata. If you follow the daily diffs, you will
see a large change today due to a refactoring of namespaces in the
metadata. This resulted in an approximately 1MB reduction in size of the
main aggregate.

As a reminder, the Interfederation Technical Policy, which describes the
rules we use for the import of eduGAIN metadata into InCommon, is kept
up-to-date at: https://spaces.internet2.edu/x/TgCNBQ. You will also find
a link to the daily import logs on that page, which will tell you what
entities were filtered on import, by what rules.

Best regards,

Nick Roy
Director of Technology and Strategy, InCommon / Internet2 Trust and
Identity Services

On 2/26/18 1:13 PM, Nick Roy wrote:
> Due to the impact of retiring the legacy metadata download endpoint,
> which will affect sites on February 27, we are re-scheduling the change
> of our eduGAIN import ruleset to the following week, Wednesday, March 7th.
>
> Best regards,
>
> Nick Roy
> Director of Technology and Strategy, InCommon / Internet2 Trust and
> Identity Services
>
> On 2/22/18 1:20 PM, Nick Roy wrote:
>> Hello,
>>
>> On February 28, InCommon will release version 8 of its eduGAIN import
>> ruleset [1].
>>
>> This ruleset allows us to remove our ban on the importation of regular
>> _expression_ scopes in metadata, but imposes some validity checks on
>> scopes to try to limit security exposure from malformed, overly-broad or
>> otherwise problematic scopes (regular _expression_ or otherwise). Within
>> the next few days, we will publish our updated edugain import policy
>> rules at [2]. I encourage you to take a look at those rules both now and
>> after they are updated (you can add a 'watch' to the page to see when it
>> changes) and let me know if you have any comments. That page also
>> contains links to our daily metadata filtering reports, which you can
>> also examine.
>>
>> The following is a summary of expected changes to imported metadata that
>> will take place on February 28. We have also provided a detailed report
>> (attached), which includes details of the issues affecting these
>> filtered entity descriptors.
>>
>> Entity descriptors which will not be imported starting on February 28th:
>>
>> Issues with invalid, overly-broad or non-public-domain scopes:
>> https://id-dev.unc.edu.ar/idp/shibboleth
>> https://sso.saxion.nl/opensso
>> http://sts.deltion.nl/adfs/services/trust
>> http://sts.roc-nijmegen.nl/adfs/services/trust
>> http://fed.rijnijssel.nl/adfs/services/trust
>> https://cafe.ufba.br/idp/shibboleth
>> https://birk.wayf.dk/birk.php/wayf.aau.dk
>> https://idp.renata.edu.co/idp/shibboleth
>> https://idp.trc.gov.om/idp/shibboleth
>>
>> Issues with ACS, SSO or SLO endpoints that do not use TLS:
>> urn:mace:feide.no:services:no.inspera.assessment.dev
>>
>> RequstedAttribute lacks a NameFormat attribute:
>> https://elixir.mf.uni-lj.si/sp/201506181025
>> https://elixir.mf.uni-lj.si/sp/20150622
>>
>> [1] https://github.internet2.edu/InCommon/inc-meta/releases/tag/incommon-v8
>> [2] https://spaces.internet2.edu/x/TgCNBQ
>>
>> Thank you and best regards,
>>
>> Nick Roy
>> Director of Technology and Strategy, InCommon / Internet2 Trust and
>> Identity Services
>