Please help reduce SAML 1 usage in the UK federation (was: SAML1.1 attribute release on Shib 3)

Mon Feb 20 07:48:52 EST 2017

Apologies Alex,
I'll also resend my results without the SAML1 grep filter.

Cheers,
Andi

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Alex Stuart
Sent: 20 February 2017 10:53
To: Shib Users <users at shibboleth.net>
Subject: Re: Please help reduce SAML 1 usage in the UK federation (was: SAML1.1 attribute release on Shib 3)

Yup, I didn't include the "grep saml1" deliberately. SAML 1 logging data tells us whether an SP is using SAML 1 with the IdP, which is great. However, an SP can use SAML 1 through different mechanisms. For example:

- the SP is configured to use SAML 1 preferentially over SAML 2 even if it has SAML 2 endpoints registered (maybe it has a local discovery page that wasn't updated when the SAML 2 endpoints were registered)

- the SP uses a Central Discovery Service with the WAYF protocol, which just supports SAML 1

- the Home Organization's library may have a portal page that contains a IdP-first, SAML 1 link to the SP

These mechanisms can co-exist with SAML 2 mechanisms. So if your logs show that a particular SP is using both SAML 1 and SAML 2, it may suggest that the SP is using SAML 2 from its own login page and something else provokes SAML 1. That might be a link on a library portal page which has the SAML 1 form, or it could be in someone's bookmarks, or in some course notes...

While the entities that participate in the UK federation continue to be SAML 1-capable, and we still have SAML 1 metadata registered, there will always be these residual mechanisms that can provoke SAML 1. I'm slowly coming to realise that SAML 1 is a chronic condition: once you've had it in your federation, you'll always have it, and the best that can be done is to manage it.

That's why I was asking for extracts of all entries from the logs. It'll give an indication whether an SP is always using SAML 1 (in which case I can prioritise contacting the SP operators) or if the SP uses a mix of protocols (in which case the course of action isn't clear-cut and more data required).

Alex

> On 20 Feb 2017, at 10:08, Dave Perry <Dave.Perry at hull-college.ac.uk> wrote:
>
> Thanks Andi, there was no | grep saml1 in Alex's original post first command so re-ran that.
>
> Dave
>
> _________________________________________________
> Dave Perry
> eLearning Technologist, Hull College Group (Monday - Thursday)
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG Extension 2230 /
> Direct Dial 01482 381930
>
> * Need a fast reply? Try elearning at hull-college.ac.uk *
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Morris,
> Andi
> Sent: 20 February 2017 10:05
> To: Shib Users
> Subject: RE: Please help reduce SAML 1 usage in the UK federation
> (was: SAML1.1 attribute release on Shib 3)
>
> Hi Dave,
> Zcat will search through the compressed logs, presuming they're in gzip format:
>
> zcat idp-audit-2017*  | cut -d\| -f4,5 | sort | uniq -c | grep saml1
>
> Cheers,
> Andi
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Dave
> Perry
> Sent: 20 February 2017 09:41
> To: Shib Users <users at shibboleth.net>
> Subject: RE: Please help reduce SAML 1 usage in the UK federation
> (was: SAML1.1 attribute release on Shib 3)
>
> I have tried running this, but in our v3 IdP (installed from clean) the logs are compressed daily so you have to extract them all (to run your second command).
> I'll email you off list when I've done this.
>
> Dave
>
> _________________________________________________
> Dave Perry
> eLearning Technologist, Hull College Group (Monday - Thursday)
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG Extension 2230 /
> Direct Dial 01482 381930
>
> * Need a fast reply? Try elearning at hull-college.ac.uk *
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Alex
> Stuart
> Sent: 16 February 2017 17:38
> To: Shib Users
> Subject: Please help reduce SAML 1 usage in the UK federation (was:
> SAML1.1 attribute release on Shib 3)
>
> Hi Folks,
>
> I'd just like to outline what the UK federation been doing to deal with its chronic SAML 1 usage, and I have a request for assistance to Shibboleth IdP operators.
>
> Some history: By the end of 2013, all entities registered in the UK federation had a directly embedded key, enabling IdPs to encrypt SAML 2 assertions to SPs, although we had approximately 250 registered IdPs and 100 SPs that did not support SAML 2. Since then, we've been slowly chipping away at the SAML 1-only entities. In 2016, we made an effort to obtain SAML 2 metadata for all entities and we are now in the position that less than 2% of registered entities (22 SPs and 14 IdPs) do not support SAML 2 in metadata.
>
> Even so, we know that SAML 1 is still being used by SPs which appear to support SAML 2: because SPs use the WAYF protocol with our Central Discovery Service; from discussion here; and because we have many calls to the service desk about SAML 1 Attribute Queries.
>
> I've asked some IdP operators if they can provide anonymised data on SPs that are using SAML 1. I intend to collate the results, draw up a prioritised list, and work with the SP operators to reduce SAML 1 usage.
>
> If you're running a Shibboleth IdP in the UK federation and wish to help us, please let me know directly or through the UK federation service desk (service at ukfederation.org.uk) which SPs are using SAML 1 with your IdP. Even better, by providing frequencies of SAML 1 and SAML 2 usage, we can determine whether there are conditions that trigger SAML 1 in a predominantly SAML 2-using SP. The output from a command like these would be super (it should output the SP entityID, the profiles used, and the number of each):
>
> cat idp-audit.log | cut -d\| -f4,5 | sort | uniq -c
>
> cat idp-audit-2017-01*.log | cut -d\| -f4,5 | sort | uniq -c
>
> Any advice appreciated.
>
> Thanks,
> Alex
>
>
>> On 15 Feb 2017, at 16:57, Todd, James <J.Todd at napier.ac.uk> wrote:
>>
>> You'd be surprised, seems to be quite a few in the UK Federation that I've had to deal with in the last couple of months.
>>
>>
>> -----Original Message-----
>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
>> Cantor, Scott
>> Sent: 15 February 2017 16:41
>> To: Shib Users <users at shibboleth.net>
>> Subject: Re: SAML1.1 attribute release on Shib 3
>>
>> On 2/15/17, 11:34 AM, "users on behalf of Morris, Andi" <users-bounces at shibboleth.net on behalf of amorris at cardiffmet.ac.uk> wrote:
>>
>>> We configured the backchannel as per the Jetty config page on the
>>> Shib wiki, so I would hope it is correct. I'll definitely look
>>> further at that, as well as the metadata. We just used the default metadata created during the install (this is just a dev server).
>>
>> Is there really that much SAML 1 left you need to support? Your time may be better spent chasing down as many as you can and figuring out why they're using a 15 year old standard 12 years after it was replaced.
>>
>> I have basically two left myself: National Institutes of Health and OhioLink. Low enough volume that I can simply push the attributes and move on.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net This message and its attachment(s) are intended for the addressee(s) only and should not be read, copied, disclosed, forwarded or relied upon by any person other than the intended addressee(s) without the permission of the sender. If you are not the intended addressee you must not take any action based on this message and its attachment(s) nor must you copy or show them to anyone. Please respond to the sender and ensure that this message and its attachment(s) are deleted.
>>
>> It is your responsibility to ensure that this message and its attachment(s) are scanned for viruses or other defects. Edinburgh Napier University does not accept liability for any loss or damage which may result from this message or its attachment(s), or for errors or omissions arising after it was sent. Email is not a secure medium. Emails entering Edinburgh Napier University's system are subject to routine monitoring and filtering by Edinburgh Napier University.
>>
>> Edinburgh Napier University is a registered Scottish charity.
>> Registration number SC018373
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
> -
> Alex Stuart
> UK federation support team
> alex.stuart at jisc.ac.uk
>
>
>
>
> **********************************************************************
> This message is sent in confidence for the addressee only. It may  contain confidential or sensitive information.  The contents are not to be disclosed to anyone other than the addressee.  Unauthorised recipients are requested to preserve this confidentiality and to advise us of any errors in transmission.  Any views expressed in this message are solely the views of the individual and do not represent the views of the College.  Nothing in this message should be construed as creating a contract.
>
> Hull College Group owns the email infrastructure, including the contents.
>
> Hull College Group is committed to sustainability, please reflect before printing this email.
> **********************************************************************
>
> TEXT
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net ________________________________
>
> [Cardiff Metropolitan University - Queens Anniversary Prizes
> 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-reco
> gnised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-Education.a
> spx>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-
Alex Stuart
UK federation support team
alex.stuart at jisc.ac.uk

________________________________

[Cardiff Metropolitan University - Queens Anniversary Prizes 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-recognised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-Education.aspx>