<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We looked at 45 days of login logs to get a list of entity ids and then ran a script to generate a spreadsheet with entity id and contact information extracted from the repositories. Then we manually searched for contacts for the remaining applications. There
are over 240 active applications. ArcGIS looks only at the second cert and was the only one to break that we know of when we added the second cert. There's an InCommon document that mentions that EZProxy only looks at the first cert but I manually configure
that one. I have only a handful of SPs to configure. We're making the change on a weekend but there's one SP (that we know of) whose SAML is maintained by the vendor and they don't work on weekends which is why I added support for a second cert - which won't
expire until later in the week.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As for SHA1 vs SHA256 I was thinking in line of a very old application that doesn't know how to deal with a SHA256 signing certificate.</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Wessel, Keith <kwessel@illinois.edu><br>
<b>Sent:</b> Wednesday, June 30, 2021 2:01 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: Question about relying-party-system.xml</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">We'll name ours, too: Ezri, maker of ArcGIS. I was impressed that they could consume a federation's metadata and use IdP discovery, and even validate the signature on the federation's aggregate. But when they got IdP metadata with multiple
encryption certs, they didn't' try each cert to decrypt. To their credit, we reported the issue, and they have a developer actively working to fix it. Now if we could just convince some of these vendors that there are better options than creating your own
SAML implementation...<br>
<br>
Keith<br>
<br>
<br>
-----Original Message-----<br>
From: users <users-bounces@shibboleth.net> On Behalf Of Cantor, Scott<br>
Sent: Wednesday, June 30, 2021 1:57 PM<br>
To: Shib Users <users@shibboleth.net><br>
Subject: Re: Question about relying-party-system.xml<br>
<br>
On 6/30/21, 2:48 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces@shibboleth.net on behalf of rullfig@uic.edu> wrote:<br>
<br>
> Yes, understand all that. Service owners have long been notified - <br>
> some applications have been tested with the new certificate, etc. <br>
> We've even encountered an SP that broke when we added the second certificate to federated metadata.<br>
<br>
I have also. I'll name them: Cornerstone. <br>
<br>
> I think we've prepared as much as we could. Major applications should <br>
> be fine - there might be a few that break though.<br>
<br>
I have over 200 systems that are essentially either manually dealt with by me or manually by the vendor, so there's really no amount of preparing that would have done any good, I had to limit the change to the rest and deal with the others one by one over 9
months of time.<br>
<br>
The only difference if I hadn't been changing the actual key is that if I had chosen to pull the plug all at once, there's a chance some number of the 200 would have worked, but I wouldn't even hazard a guess as to how many. I doubt it would have been more
than half at best.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg__%3B!!DZ3fjg!oViL6zBPYKbkS01a1ePMOSO1aoubv9j_X8Beg5Lbk26-_n2TKRuViWRh1M8NLQBYiA%24&data=04%7C01%7Crullfig%40uic.edu%7C9516525820fd4ee1f4c208d93bf9738c%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637606764842461060%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lXDX0%2BUlcbPQH%2Bb1%2FqTSrdCXBLbky1jnd2cuLwm25Pw%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg__%3B!!DZ3fjg!oViL6zBPYKbkS01a1ePMOSO1aoubv9j_X8Beg5Lbk26-_n2TKRuViWRh1M8NLQBYiA%24&data=04%7C01%7Crullfig%40uic.edu%7C9516525820fd4ee1f4c208d93bf9738c%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637606764842461060%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lXDX0%2BUlcbPQH%2Bb1%2FqTSrdCXBLbky1jnd2cuLwm25Pw%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C9516525820fd4ee1f4c208d93bf9738c%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637606764842461060%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=it7tdJTGS%2F72HCtlGoUhZaPGZds%2BMRKfK%2B3wt7uoVJ0%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C9516525820fd4ee1f4c208d93bf9738c%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637606764842461060%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=it7tdJTGS%2F72HCtlGoUhZaPGZds%2BMRKfK%2B3wt7uoVJ0%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>