Error with SPs registered with InCommon

[Mizushima, Marcus]

> With that being said, this is something that logging identified as soon as it changed and should have been caught and dealt with when it first occurred and not after backup metadata expired.

What I mean here is that while InCommon did something different than their prace statement indicated, federation participants could have caught it by better log monitoring instead of having things simply break.

From: users <users-bounces at shibboleth.net> On Behalf Of Mizushima, Marcus via users
Sent: Tuesday, February 18, 2025 10:05 AM
To: Shib Users <users at shibboleth.net>
Cc: Mizushima, Marcus <mmizushima at calstate.edu>
Subject: RE: Error with SPs registered with InCommon

It is a bit more than just “long-recommended and widely deployed. ” The 14 day period is in the InCommon Metadata Registration Practice Statement (https: //incommon. org/federation/mrps/): “The Federation Operator adds an expiration date to the

It is a bit more than just “long-recommended and widely deployed.” The 14 day period is in the InCommon Metadata Registration Practice Statement (https://incommon.org/federation/mrps/<https://urldefense.com/v3/__https:/incommon.org/federation/mrps/__;!!MWueTNF2!X8DkjEopzuxGdU5fNaLMew4QLLeQGweJphH7HPxqT53oDOyTvO-EybAWs-G2px34ppul9GS0o88HlcS6OPRoiQI$>):

“The Federation Operator adds an expiration date to the metadata aggregate. The value of the validUntil XML attribute on the top-level <md:EntitiesDescriptor> element is a date two (2) weeks into the future.”

With that being said, this is something that logging identified as soon as it changed and should have been caught and dealt with when it first occurred and not after backup metadata expired.

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Peter Schober via users
Sent: Tuesday, February 18, 2025 9:20 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Cc: Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>>
Subject: Re: Error with SPs registered with InCommon

Thanks, Scott and Michael, for correcting me. The newly published metadata violated the long-recommended and widely deployed configuration setting. Funny, so it was "giving bit more leeway" that broke the federation. -peter -- For Consortium

Thanks, Scott and Michael, for correcting me. The newly published

metadata violated the long-recommended and widely deployed

configuration setting.



Funny, so it was "giving bit more leeway" that broke the federation.

-peter

--

For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MWueTNF2!XPXZGtkYr12S9xMNTEK4sbvI9R1nZVUsetkq7OR9r8rysXSxAcQx7vL5iUt24w5G91CTetCmZ2h5zhEfbAbDSFg$<https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MWueTNF2!XPXZGtkYr12S9xMNTEK4sbvI9R1nZVUsetkq7OR9r8rysXSxAcQx7vL5iUt24w5G91CTetCmZ2h5zhEfbAbDSFg$>

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/691c0bfd/attachment.htm>