New IdP Checklist

A Checklist for New IdPs

Basic considerations for New IdPs:

1. Identify at least two Site Administrators to administer IdP metadata
2. Refresh and verify metadata at least daily (every hour if possible)
3. Choose your entityID carefully
   1. a simple, generic name is best
      1. example: https://sso.example.edu/idp
   2. hostname must be rooted in your primary domain (e.g., example.edu)
   3. hostname need not match endpoint locations
4. Choose your Scope carefully
   1. usually equal to your primary domain
   2. used to construct eduPersonPrincipalName
   3. avoid multiple Scopes in metadata

Is your IdP secure and trustworthy?

A trustworthy IdP is the basic building block of an identity federation.

1. Create and handle your private key safely and securely!
2. Do not share your signing key with other SAML entities
3. Sign assertions using:
   1. a strong 2048-bit key
   2. the SHA-256 digest algorithm (which may not be supported by your software)
4. Protect all SAML IdP endpoints with TLS
5. Protect the Logo URL with TLS

Is your IdP interoperable?

By definition, an interoperable IdP strives to provide an overall positive federated user experience.

1. Support SAML2 Web Browser SSO
2. Publish a SAML2 SingleSignOnService endpoint that supports the HTTP-Redirect binding
3. Publish long-lived, self-signed certificates in metadata
4. Publish technical and administrative contacts in metadata
5. Stabilize the following metadata elements:
   1. entityID
   2. Scope
   3. endpoint locations
   4. certificates
6. Support at least the following user attributes:
   1. eduPersonPrincipalName (non-reassigned)
   2. eduPersonTargetedID (optional)
   3. mail (== ePPN)
   4. displayName
   5. givenName
   6. sn (surName)
7. Stabilize the values of persistent identifiers (ePPN and ePTID)
8. Test and monitor all SAML endpoints 24x7

Is your IdP discoverable?

A discoverable IdP in an interoperable IdP with the following additional properties:

1. Publish the following [user interface elements] in metadata:
   1. DisplayName
   2. Information URL (optional)
   3. Logo URL
2. Adopt a measured attribute release process
   1. release a SAML2 NameID (Transient or Persistent) to all SPs
   2. release a [minimal subset of the R&S attribute bundle] to R&S SPs
   3. release public directory information to all SPs
3. Publish an appropriate error handling URL in metadata

Recommended protocol support for new IdPs:

1. Support SAML2 only (do not support SAML1)
2. Remove the SAML2 AttributeService endpoint
3. Remove the SAML2 ArtifactResolutionService endpoint