Delegated Administration

Delegated Administration of Metadata

The term delegated administration refers to the ability of a site administrator to delegate responsibility for administering SP metadata to another administrator called a delegated administrator. The rationale for delegated administration was discussed in a [blog post] published early in 2012. The primary motivation for adding this feature to the [InCCollaborate:Federation Manager] is to simplify metadata management for those sites with large numbers of entities in metadata.

Facts About Delegated Administration

• A site administrator delegates the ability to administer metadata to a delegated administrator by providing the eduPersonPrincipalName and e-mail address of a prospective delegated administrator.
• A site administrator constrains the privileges of each delegated administrator, that is, the site administrator assigns delegated administrators to manage particular SPs.
• A delegated administrator is able to administer SP metadata only.
• A delegated administrator may create/modify/delete SP entity descriptors.
• A metadata update request submitted by a delegated administrator must be approved by a site administrator.
• The delegated administrative login interface accepts federated credentials only (i.e., InCommon Operations does not issue passwords to delegated administrators).
• The delegated administrative login interface supports SAML V2.0 only (i.e., the delegated administrator’s IdP must support SAML V2.0 Web Browser SSO).

Limitations

• A delegated administrator for one organization may not function as a delegated administrator for another organization.
• A site administrator for an organization may not function as a delegated administrator for the same organization.
• Assigning two delegated administrators to the same entity descriptor can have undesirable side effects since the editing of entity descriptors is not constrained by the software in any way.

For the Site Administrator

To use this new feature, a site administrator logs into the Federation Manager as usual and clicks the menu item "Delegated Administrators" along the left hand side of the page. After provisioning a new delegated administrator, the system sends an email invitation to the newly provisioned delegated administrator (copying all the site administrators as well). The delegated administrator clicks the link in the email to continue with the onboarding process.

Preparing Your IdP

Since the delegated administrative login interface accepts federated credentials only, a site administrator must configure the IdP to release the following attributes to the Federation Manager (https://fm.incommon.org/sp):

• eduPersonPrincipalName
• mail
• displayName OR (givenName AND sn)

For the Delegated Administrator

Security Considerations

For delegated administrators, the Federation Manager recognizes federated credentials only (no local credentials are issued to delegated admins). Currently there are no explicit assurance requirements associated with the federated credentials of delegated administrators. Since a trusted site administrator must approve any metadata update request submitted by a delegated administrator, the approval process mitigates any weakness in the delegated administrator's login credentials.