Roadmap for Operationalizing eduGAIN

This is a roadmap for operationalizing eduGAIN participation in the InCommon Federation.

Contents:

Milestones

Phase 0 [DONE]

• Introduce the <mdrpi:RegistrationInfo> element into production metadata
• Introduce the registered-by-incommon entity attribute into production metadata
• Introduce the <mdrpi:PublicationInfo> element into production metadata
  • Align with the <mdrpi:PublicationInfo> element in the export aggregate

Phase 1 [in production by November 20, 2015]

Perform the following operations:

1. Deploy a user interface for IdPs in the Federation Manager
   1. Give Site Administrators the ability to self-assert membership in the Hide From Discovery Category
2. Deploy initial user interfaces for IdPs and SPs in the Federation Manager
   1. Give Site Administrators the ability to opt out of default export of IdP metadata
   2. Give Site Administrators the ability to explicitly opt into the export of SP metadata

Phase 2 [in production on January 11, 2016]

Perform the following operation:

1. Import global metadata into the preview aggregate
   1. Advise deployers to point their pre-production systems at the preview aggregate

Phase 3 [in production on February 11, 2016]

Perform the following operations in order:

1. Deploy final user interfaces for IdPs and SPs in the Federation Manager
   
   1. Continue to give Site Administrators the ability to opt out of default export of IdP metadata
   2. Continue to give Site Administrators the ability to explicitly opt into the export of SP metadata
2. Import global metadata into the main production aggregate
   1. Sync the main production aggregate with the preview aggregate
   2. Maintain the fallback aggregate for a minimum of one month
      
3. Export InCommon metadata to eduGAIN
   
   1. Export all IdP metadata by default, except those IdPs that have explicitly opted out
   2. Export SP metadata on demand, for those SPs that have explicitly opted in

The following groups of entities require special handling:

1. Thirteen (13) InCommon SPs currently being exported to eduGAIN
2. InCommon SPs registered in multiple federations
3. InCommon SPs that already consume global IdP metadata
4. InCommon IdPs that already consume global SP metadata

Policy Rules

Import Rules (in order)

1. Filter all imported entities with XML attribute mdrpi:RegistrationInfo[@registrationAuthority='https://incommon.org']
   1. Entities so marked must come from primary sources only.
2. Filter all entity attributes not on the Entity Attribute Whitelist (see subsection below)
3. Filter all imported entities with weak keys
   1. The use of weak keys in metadata has security and privacy implications.
   2. There are no weak keys in InCommon metadata and so we'd like to keep it that way.
4. Filter all imported IdP entities that do not have a SAML2 SingleSignOnService endpoint that supports the HTTP-Redirect binding. [to be discussed]
   1. In effect, all imported IdPs must support SAML2.
   2. This rule has no effect until Phase 2.
5. Filter all imported entities that have the same entityID as an existing entity in the InCommon aggregate.
   1. This happens because some SPs choose to join multiple federations.
   2. Dozens of global SPs are filtered by this rule.

A number of additional rules are applied to ensure metadata correctness. Some minor but common errors are corrected. Entities failing checks such as XML schema validity are removed.

Entity Attribute Whitelist

1. (name, value) = (http://macedir.org/entity-category, http://refeds.org/category/research-and-scholarship)
2. (name, value) = (http://macedir.org/entity-category-support, http://refeds.org/category/research-and-scholarship)
3. (name, value) = (http://macedir.org/entity-category, http://refeds.org/category/hide-from-discovery)

Export Rules

1. Filter all exported entities not having XML attribute mdrpi:RegistrationInfo[@registrationAuthority='https://incommon.org']
   1. Only entities registered by InCommon will be exported.
2. Filter the legacy incommon.org R&S entity attribute value from SP metadata
   1. This tag remains in SP metadata for backwards compatibility only. We hope to completely remove this tag from SP metadata in the future.
   2. This tag has nothing to do with R&S interoperability outside the InCommon Federation.
3. Filter all exported IdP entities that do not have a SAML2 SingleSignOnService endpoint that supports the HTTP-Redirect binding. [to be discussed]
   
   1. In effect, all exported IdPs must support SAML2.
      

Metadata Export Options

SP Metadata Export Options

The following user interface will be deployed at Phase 1:

The checkbox in the above interface is not checked by default.

At Phase 2, InCommon Operations will begin importing IdP metadata from eduGAIN. At that time, we will replace the initial user interface for SPs with the following simplified user interface:

The default value of the latter checkbox depends on the state of the former checkbox.

IdP Metadata Export Options

The following user interface will be deployed at Phase 1:

The second radio button in the above interface is checked by default.

At Phase 2, InCommon Operations will begin importing SP metadata from eduGAIN. At that time, we will replace the initial user interface for IdPs with the following updated user interface:

The default value of the latter set of radio buttons depends on the state of the former set of radio buttons.

At Phase 3, InCommon Operations will begin exporting IdP metadata to eduGAIN by default. At that time, we will replace the previous user interface for IdPs with the following simplified user interface:

The default value of the checkbox depends on the state of the former set of radio buttons.