Error with SPs registered with InCommon

[Michael Grady]

This really is InCommon Participants stuff, but you want to see the mail thread on this list that started yesterday. Bottom line, for an unknown reason InCommon changed the validUntil date to 3 weeks out instead of the always 2 weeks out (for years), and your IdP or SP is rejecting the InCommon metadata. You need to change the validUntil period to 21 days for now. 

And if you are still using the old aggregate endpoint, that stops working -- and that has been announced multiple times -- on Feb. 25.

You should switch to MDQ. But note the aggregate is not (yet) going away. Only the original location for it is going away. The following URL will continue to deliver an aggregate, but with the MDQ signing cert used, not the original one for the original aggregate location.

   https://mdq.incommon.org/entities

As documented here:

   https://spaces.at.internet2.edu/display/MDQ/how-to-locate-metadata-with-mdq

> On Feb 18, 2025, at 10:07 AM, Rodriguez, Eric via users <users at shibboleth.net> wrote:
> 
> IDP version is 4.3.1
> We’re experiencing the same thing at Longwood University, but somewhat different. Our metadata has not automatically updated since 12:16PM yesterday, and it expired after 8PM last night.
>  
> Also, it seems that http://shibboleth.net/ns/profiles/saml2/sso/browser is unavailable for RP configurations. May be unrelated to the InCommon issue.
>  
> Eric Rodriguez
> Senior Computer Systems Engineer
> Longwood University
>  
> From: users <users-bounces at shibboleth.net <mailto:users-bounces at shibboleth.net>> On Behalf Of Ramaiah, Vanna G. via users
> Sent: Tuesday, February 18, 2025 11:01 AM
> To: users at shibboleth.net <mailto:users at shibboleth.net>
> Cc: Ramaiah, Vanna G. <ramaiah at musc.edu <mailto:ramaiah at musc.edu>>
> Subject: Error with SPs registered with InCommon
>  
> CAUTION: This is an EXTERNAL email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
> 
> IDP version is 4.3.3.
> Any service provider registered with incommon is unable to login.We are getting this error in the logs.
>  
> InCommon: Metadata backing store contained an EntityDescriptor with the ID:https://federation.nih.gov/FederationGateway,  but it was no longer valid
>  
>  
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/f3ddf8d4/attachment.htm>