<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">></span><span style="font-size:11.0pt"> With that being said, this is something that logging identified as soon as it changed and should have been caught and dealt with when it first occurred and not after
backup metadata expired.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">What I mean here is that while InCommon did something different than their prace statement indicated, federation participants could have caught it by better log monitoring instead of having things simply break.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Mizushima, Marcus via users<br>
<b>Sent:</b> Tuesday, February 18, 2025 10:05 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Mizushima, Marcus <mmizushima@calstate.edu><br>
<b>Subject:</b> RE: Error with SPs registered with InCommon<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">It is a bit more than just “long-recommended and widely deployed.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">”
The 14 day period is in the InCommon Metadata Registration Practice Statement (https:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">//incommon.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">org/federation/mrps/):
“The Federation Operator adds an expiration date to the<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">It is a bit more than just “long-recommended and widely deployed.” The 14 day period is in the InCommon Metadata Registration Practice Statement (<a href="https://urldefense.com/v3/__https:/incommon.org/federation/mrps/__;!!MWueTNF2!X8DkjEopzuxGdU5fNaLMew4QLLeQGweJphH7HPxqT53oDOyTvO-EybAWs-G2px34ppul9GS0o88HlcS6OPRoiQI$">https://incommon.org/federation/mrps/</a>):</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">“The Federation Operator adds an expiration date to the metadata aggregate. The value of the validUntil XML attribute on the top-level <md:EntitiesDescriptor> element is a date two (2) weeks into the future.”</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">With that being said, this is something that logging identified as soon as it changed and should have been caught and dealt with when it first occurred and not after backup metadata expired.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Peter Schober via users<br>
<b>Sent:</b> Tuesday, February 18, 2025 9:20 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Cc:</b> Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>><br>
<b>Subject:</b> Re: Error with SPs registered with InCommon</span><o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">Thanks, Scott and Michael, for correcting me. The newly published metadata violated the long-recommended and widely deployed configuration setting. Funny, so it
was "giving bit more leeway" that broke the federation. -peter -- For Consortium</span><o:p></o:p></p>
</div>
<pre style="white-space:pre-wrap"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Thanks, Scott and Michael, for correcting me. The newly published</span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">metadata violated the long-recommended and widely deployed</span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">configuration setting.</span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Funny, so it was "giving bit more leeway" that broke the federation.</span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">-peter</span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">-- </span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MWueTNF2!XPXZGtkYr12S9xMNTEK4sbvI9R1nZVUsetkq7OR9r8rysXSxAcQx7vL5iUt24w5G91CTetCmZ2h5zhEfbAbDSFg$">https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MWueTNF2!XPXZGtkYr12S9xMNTEK4sbvI9R1nZVUsetkq7OR9r8rysXSxAcQx7vL5iUt24w5G91CTetCmZ2h5zhEfbAbDSFg$</a></span><o:p></o:p></pre>
<pre><span style="font-size:12.0pt;font-family:"Arial",sans-serif">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></span><o:p></o:p></pre>
</div>
</body>
</html>