Keeping Your Federation in Shape Discussion with InCommon Technical Advisory Committee Members Jim Basney Scott Cantor Tom Barton

TAC’s Role Facilitate campus tech implementations –Metadata management –InCommon metadata schema extensions –Specifications, guidance & notifications –Supportive services Advise & recommend to Steering Committee on tech matters –SSL & end-user certs –eduRoam? Community engagement –Working groups –IAM Online (with EDUCAUSE & MACE/Internet2) –Gather feedback & requirements

Topics for Today Gotcha’s to watch out for Federated Security Incident Response Upgrading to shib 2.X uApprove Balancing metadata for InCommon, ASPs, other external federations, internal webSSO Campus openID needs What aren’t we doing that we should?

Watch out for these SOAP endpoint issues New InC signing cert Good entityId practice: use URLs –But watch out for older SPs that assume URN form Keep your metadata up to date! –Publishing schedule Keys – yes. PKI – no! Expiring certs

How to upgrade to shib 2.X (or maybe how not to) Show of hands: –Running 2.X IdP –Running 1.X IdP –# months until upgrade Stories from the room InC’s support for test IdP’s SAML/shib 2 metadata –SOAP endpoint issues

FEDERATED SECURITY INCIDENT MANAGEMENT

uApprove Who is doing it? How’s it going? Who plans to? What’s needed on campus in addition to uApprove itself? Requirements for metadata extensions?

Comodo User Certs Who wants them? –Sooner, later For what? –Authentication? –Signing? –Encryption? Key escrow? For which campus groups? Comodo-campus interface needs –How many points of contact? –What capabilities?

Balancing campus metadata management Campus stories in managing –InC metadata –Other external federation’s metadata –ASP metadata –Metadata for shib-based campus SSOWA* *SSO with Attributes

More discussion, time permitting Shib, InC, and campus openID needs What do you wish InC would do but doesn’t? –Should we stop or change something we’re doing? Silver  this afternoon at 2:30