Phase 1 Implementation Plan

This document is a plan to implement the Phase 1 Recommendations of the Metadata Distribution WG. For more detailed information, see the Phase 1 Implementation Plan FAQ.

Executive Summary

A timeline for the Phase 1 Implementation Plan is given below:

  1. On December 18, 2013, InCommon Operations will deploy three new metadata aggregates at the following permanent HTTP locations:
  2. All new metadata aggregates will be signed using a new self-signed signing certificate set to expire on December 18, 2037.
  3. All new metadata aggregates will be signed with the same key but the fallback metadata aggregate will use a different digest algorithm.
  4. All deployments shall migrate to one of the new metadata aggregates ASAP but no later than March 29, 2014.
  5. All deployments shall be able to verify an XML signature that uses a SHA-256 digest algorithm by June 30, 2014.

See the Actions section below for the current state of the Phase 1 Implementation Plan.

Policy

It is strongly recommended that InCommon SPs and IdPs refresh and verify metadata at least daily. The security implications of metadata refresh are discussed on the Metadata Consumption wiki page:

Regular metadata refresh protects users against spoofing and phishing, and is a necessary precaution in the event of key compromise. Failure to refresh metadata exposes you, your users, and other Federation participants to unnecessary risk.

If you verify the digital signature on InCommon metadata (as recommended), the following implementation plan may affect your metadata refresh process. Even if you don't verify the signature (which is not recommended), note that the HTTP location of InCommon metadata is changing.

Drivers

  1. The InCommon metadata signing certificate expires on May 2, 2014.
  2. The InCommon metadata signing certificate is signed by a legacy CA whose certificate expires on March 29, 2014.
  3. The XML signature on InCommon metadata uses the deprecated (and soon-to-be disallowed) SHA-1 digest algorithm.
  4. Multiple, heterogeneous services currently run on vhost wayf.incommonfederation.org, namely, Metadata Services and the Discovery Service. To provide better quality of service, these services need to be segregated onto their own vhosts (md.incommon.org and ds.incommon.org, resp.). This will allow us to fine-tune each service according to its requirements.
  5. Multiple metadata aggregates will allow us to deploy changes to InCommon metadata more quickly and safely. Metadata consumers will have options depending on the requirements of their deployment.

Actions

InCommon Operations will take the following actions:

  1. Create a new self-signed signing certificate set to expire on December 18, 2037: [DONE]
  2. On December 18, 2013, deploy three new metadata aggregates: [DONE]
    1. A new production metadata aggregate that uses the new self-signed certificate and a SHA-2 digest algorithm (specifically, SHA-256):
    2. A new fallback metadata aggregate that uses the new self-signed certificate and the SHA-1 digest algorithm (like we do now):
    3. A new preview metadata aggregate that is aliased to the production metadata aggregate:
  3. Advise all deployments to migrate to one of the new metadata aggregates ASAP but no later than March 29, 2014. [DONE]
  4. Create discussion list help@incommon.org. [DONE]
  5. Replace the current metadata aggregate with a redirect to the fallback metadata aggregate on March 29, 2014. [DONE]
  6. Retire the following resources on March 29, 2014:
  7. Sync the fallback metadata aggregate with the production metadata aggregate on June 30, 2014. [DONE]
  8. Remove the redirect to the fallback metadata aggregate on [date TBD].

If you have questions or problems regarding this transition, please post them to help@incommon.org.