Dynamic Analysis of IdP Endpoints

Dynamic Analysis of IdP Endpoints in Metadata

InCommon Operations periodically probes browser-facing endpoints in IdP metadata for liveness. The goal of this probing operation is to alert site administrators about possible deployment issues involving InCommon IdPs.

There are service providers in the Federation that offer a comprehensive list of IdPs on their discovery interface. If your IdP has issues, your users may hit a dead end when they choose your IdP on a discovery interface. This results in a poor user experience and reflects badly on the Federation. Consequently, if you, as an IdP operator, are unable to fix or repair your IdP in short order, it is strongly RECOMMENDED that you self-assert the Hide From Discovery Category until the issues can be resolved. Once you insert the hide-from-discovery entity attribute (via the Federation Manager), your IdP will be removed from the list below.

The following tables list the codes used to classify IdPs and endpoints:

An endpoint probe results in a curl exit code. A zero exit code indicates success while a nonzero exit code indicates failure. See the curl man page for a brief description of possible exit codes.

An endpoint probe that produces both curl exit code 0 and HTTP response code 200 is considered a successful probe. All unsuccessful probes are listed in the following table (which was produced on May 20, 2016):