<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Alex<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Not running a Shib IdP but still this is the list of SPs we had to specify SAML1.1 for on our PingFederate IdP<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="540" style="width:405.0pt;border-collapse:collapse">
<tbody>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><b><span style="color:black;mso-fareast-language:EN-GB">Connection Name<o:p></o:p></span></b></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><b><span style="color:black;mso-fareast-language:EN-GB">ConnectionID<o:p></o:p></span></b></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Brill Online<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border:solid windowtext 1.0pt;border-left:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://booksandjournals.brillonline.com/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Edinburgh University Press<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.euppublishing.com/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Ingenta Connect<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.ingentaconnect.com/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Karger SAML1.1<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.karger.com/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Lexis-Nexis<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://shib.lexisnexis.com<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Microbiology Research<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.microbiologyresearch.org/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> MIT Press Journals<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.mitpressjournals.org/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Safari UK DataService<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://safari.data-archive.ac.uk/shibboleth-sp<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> saml1.1 MedicinesComplete<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.medicinescomplete.com/mc/shibboleth<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:15.0pt">
<td width="189" nowrap="" valign="bottom" style="width:142.0pt;border:solid windowtext 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB"> Westlaw<o:p></o:p></span></p>
</td>
<td width="351" nowrap="" valign="bottom" style="width:263.0pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.0pt">
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-GB">https://www.westlaw.co.uk/metadata<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks<o:p></o:p></p>
<p class="MsoPlainText">James<o:p></o:p></p>
<p class="MsoPlainText">_____________________________________<o:p></o:p></p>
<p class="MsoPlainText">James Todd | Data Centre & Operations Analyst<o:p></o:p></p>
<p class="MsoPlainText">Edinburgh Napier University<o:p></o:p></p>
<p class="MsoPlainText">Craiglockhart Campus<o:p></o:p></p>
<p class="MsoPlainText">Edinburgh<o:p></o:p></p>
<p class="MsoPlainText">EH14 1DJ <o:p></o:p></p>
<p class="MsoPlainText">Tel: 0131 455 4313<o:p></o:p></p>
<p class="MsoPlainText">Email: j.todd@napier.ac.uk<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-US" style="mso-fareast-language:EN-GB">-----Original Message-----<br>
From: users [mailto:users-bounces@shibboleth.net] On Behalf Of Alex Stuart<br>
Sent: 16 February 2017 17:38<br>
To: Shib Users <users@shibboleth.net><br>
Subject: Please help reduce SAML 1 usage in the UK federation (was: SAML1.1 attribute release on Shib 3)</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hi Folks,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'd just like to outline what the UK federation been doing to deal with its chronic SAML 1 usage, and I have a request for assistance to Shibboleth IdP operators.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Some history: By the end of 2013, all entities registered in the UK federation had a directly embedded key, enabling IdPs to encrypt SAML 2 assertions to SPs, although we had approximately 250 registered IdPs and 100 SPs that did not
support SAML 2. Since then, we've been slowly chipping away at the SAML 1-only entities. In 2016, we made an effort to obtain SAML 2 metadata for all entities and we are now in the position that less than 2% of registered entities (22 SPs and 14 IdPs) do not
support SAML 2 in metadata.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Even so, we know that SAML 1 is still being used by SPs which appear to support SAML 2: because SPs use the WAYF protocol with our Central Discovery Service; from discussion here; and because we have many calls to the service desk about
SAML 1 Attribute Queries.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I've asked some IdP operators if they can provide anonymised data on SPs that are using SAML 1. I intend to collate the results, draw up a prioritised list, and work with the SP operators to reduce SAML 1 usage.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If you're running a Shibboleth IdP in the UK federation and wish to help us, please let me know directly or through the UK federation service desk (<a href="mailto:service@ukfederation.org.uk"><span style="color:windowtext;text-decoration:none">service@ukfederation.org.uk</span></a>)
which SPs are using SAML 1 with your IdP. Even better, by providing frequencies of SAML 1 and SAML 2 usage, we can determine whether there are conditions that trigger SAML 1 in a predominantly SAML 2-using SP. The output from a command like these would be
super (it should output the SP entityID, the profiles used, and the number of each):
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">cat idp-audit.log | cut -d\| -f4,5 | sort | uniq -c<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">cat idp-audit-2017-01*.log | cut -d\| -f4,5 | sort | uniq -c<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Any advice appreciated.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText">Alex<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> On 15 Feb 2017, at 16:57, Todd, James <<a href="mailto:J.Todd@napier.ac.uk"><span style="color:windowtext;text-decoration:none">J.Todd@napier.ac.uk</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> You'd be surprised, seems to be quite a few in the UK Federation that I've had to deal with in the last couple of months.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: users [<a href="mailto:users-bounces@shibboleth.net"><span style="color:windowtext;text-decoration:none">mailto:users-bounces@shibboleth.net</span></a>] On Behalf Of Cantor,
<o:p></o:p></p>
<p class="MsoPlainText">> Scott<o:p></o:p></p>
<p class="MsoPlainText">> Sent: 15 February 2017 16:41<o:p></o:p></p>
<p class="MsoPlainText">> To: Shib Users <<a href="mailto:users@shibboleth.net"><span style="color:windowtext;text-decoration:none">users@shibboleth.net</span></a>><o:p></o:p></p>
<p class="MsoPlainText">> Subject: Re: SAML1.1 attribute release on Shib 3<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> On 2/15/17, 11:34 AM, "users on behalf of Morris, Andi" <<a href="mailto:users-bounces@shibboleth.net%20on%20behalf%20of%20amorris@cardiffmet.ac.uk"><span style="color:windowtext;text-decoration:none">users-bounces@shibboleth.net on
behalf of amorris@cardiffmet.ac.uk</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">>> We configured the backchannel as per the Jetty config page on the
<o:p></o:p></p>
<p class="MsoPlainText">>> Shib wiki, so I would hope it is correct. I'll definitely look
<o:p></o:p></p>
<p class="MsoPlainText">>> further at that, as well as the metadata. We just used the default metadata created during the install (this is just a dev server).<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Is there really that much SAML 1 left you need to support? Your time may be better spent chasing down as many as you can and figuring out why they're using a 15 year old standard 12 years after it was replaced.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I have basically two left myself: National Institutes of Health and OhioLink. Low enough volume that I can simply push the attributes and move on.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -- Scott<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText">> To unsubscribe from this list send an email to <o:p></o:p></p>
<p class="MsoPlainText">> <a href="mailto:users-unsubscribe@shibboleth.net"><span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a> This message and its attachment(s) are intended for the addressee(s) only and should
not be read, copied, disclosed, forwarded or relied upon by any person other than the intended addressee(s) without the permission of the sender. If you are not the intended addressee you must not take any action based on this message and its attachment(s)
nor must you copy or show them to anyone. Please respond to the sender and ensure that this message and its attachment(s) are deleted.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> It is your responsibility to ensure that this message and its attachment(s) are scanned for viruses or other defects. Edinburgh Napier University does not accept liability for any loss or damage which may result from this message or
its attachment(s), or for errors or omissions arising after it was sent. Email is not a secure medium. Emails entering Edinburgh Napier University's system are subject to routine monitoring and filtering by Edinburgh Napier University.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Edinburgh Napier University is a registered Scottish charity.
<o:p></o:p></p>
<p class="MsoPlainText">> Registration number SC018373<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText">> To unsubscribe from this list send an email to <o:p></o:p></p>
<p class="MsoPlainText">> <a href="mailto:users-unsubscribe@shibboleth.net"><span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">—<o:p></o:p></p>
<p class="MsoPlainText">Alex Stuart<o:p></o:p></p>
<p class="MsoPlainText">UK federation support team<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:alex.stuart@jisc.ac.uk"><span style="color:windowtext;text-decoration:none">alex.stuart@jisc.ac.uk</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
<table width="100%" cellspacing="0" cellpadding="="0"" border="0" align="left" style="font-family: Arial, Helvetica, san-serif; font-size:10pt;">
<tbody>
<tr>
<td style="padding: 5px;">
<p>This message and its attachment(s) are intended for the addressee(s) only and should not be read, copied, disclosed, forwarded or relied upon by any person other than the intended addressee(s) without the permission of the sender. If you are not the intended
addressee you must not take any action based on this message and its attachment(s) nor must you copy or show them to anyone. Please respond to the sender and ensure that this message and its attachment(s) are deleted.</p>
<p>It is your responsibility to ensure that this message and its attachment(s) are scanned for viruses or other defects. Edinburgh Napier University does not accept liability for any loss or damage which may result from this message or its attachment(s), or
for errors or omissions arising after it was sent. Email is not a secure medium. Emails entering Edinburgh Napier University's system are subject to routine monitoring and filtering by Edinburgh Napier University.</p>
<p>Edinburgh Napier University is a registered Scottish charity. Registration number SC018373</p>
</td>
</tr>
</tbody>
</table>
</body>
</html>