Community Review in progress!
This document contains DRAFT material intended for discussion and comment by the InCommon participant community. Comments and questions should be sent to the InCommon participants mailing list (participants@incommon.org).
A Checklist for New IdPs
Basic considerations for New IdPs:
- Identify at least two Site Administrators to administer IdP metadata
- Refresh and verify metadata at least daily (every hour if possible)
- Choose your entityID carefully
- a simple, generic name is best
- example: https://sso.example.edu/idp
- hostname must be rooted in your primary domain (e.g., example.edu)
- hostname need not match endpoint locations
- a simple, generic name is best
- Choose your Scope carefully
- usually equal to your primary domain
- used to construct eduPersonPrincipalName
- avoid multiple Scopes in metadata
Is your IdP secure and trustworthy?
- Create and handle your private key safely and securely!
- Do not share your signing key with other SAML entities
- Sign assertions using:
- a strong 2048-bit key
- the SHA-256 digest algorithm (which may not be supported by your software)
- Protect all SAML IdP endpoints with TLS
- Protect the Logo URL with TLS
Protect your private key!
Safeguarding the IdP’s private signing key protects all Federation participants from the disastrous consequences of a key compromise.
Is your IdP interoperable?
- Support SAML2 Web Browser SSO
- Publish a SAML2
SingleSignOnService
endpoint that supports the HTTP-Redirect binding - Publish long-lived, self-signed certificates in metadata
- Publish technical and administrative contacts in metadata
- Stabilize the following permanent metadata elements:
- entityID
- Scope
- endpoint locations
- certificates
- Support at least the following user attributes:
- eduPersonPrincipalName (non-reassigned)
- eduPersonTargetedID (optional)
- mail (== ePPN)
- displayName
- givenName
- sn (surName)
- Stabilize the values of persistent identifiers (ePPN and ePTID)
- Test and monitor all SAML endpoints 24x7
Is your IdP discoverable?
- Publish the following [user interface elements] in metadata:
- DisplayName
- Information URL (optional)
- Logo URL
- Adopt a measured attribute release process
- release a SAML2 NameID (Transient or Persistent) to all SPs
- release a [minimal subset of the R&S attribute bundle] to R&S SPs
- release public directory information to all SPs
- Publish an appropriate error handling URL in metadata
Support R&S
Support the Research & Scholarship Category of services now!
Recommended protocol support for new IdPs:
- Support SAML2 only (do not support SAML1)
- Remove the SAML2 AttributeService endpoint
- Remove the SAML2 ArtifactResolutionService endpoint