This is an old revision of the document!


Check List for Publishing Metadata

(Metadata Registration Practice Statement)

Please take the following hints into account before submitting your new IdP or SP to DFN-AAI:

  • If reading your new system's metadata fails with the error unable to open file your web server does not respond with the full certificate chain. Please check your configuration first (find help here).
  • If possible, please fill in all fields. Correct your data when you see red warning messages.
  • Display Name: the name of your organization, institution or company
  • Description: a short description, e.g. “Identity Provider of the University of XYZ”
  • Information URL: the website of your organization, institution or company
  • Privacy Statement URL: Please provide the link to your data privacy statement. This field is mandatory for Service Providers. If your data privacy statement is only available either in English or in German, you can leave the other field empty.
  • The logos are displayed in the discovery service (favicons of IdPs) resp. on IdPs' login screens. That is why they have clearly defined maximum sizes. Please scale your logos to make them fit. The small logo is supposed to be a favicon of 16 by 16 pixels. (SPs do not need to submit a favicon URL.) The big logo has to have a width of 64 to 240 pixels and a maximum height of 180 pixels.
  • Please submit at least four contacts per system: An administrative contact, a technical one, a support contact and a security contact. We recommend to use non-personalized email addresses, especially for the security contact which could be your Computer Emergency Response Team. If you do not have anything like that, put in the contact that responds in case of security incidents. Please make sure to keep those email addresses up to date!
  • Have your X.509 certificate for SAML-based communication ready. We have an information page about certificates. The most important items are:
    • IdPs use DFN-PKI certificates. As of July 2019, only the second generation of DFN-PKI certificates will be valid.
    • SPs can use DFN-PKI certificates (if entitled), certificates issued by established commercial CAs, or self-signed certificates.
    • SSL certificates must not exceed a validity of 39 months.
    • For security reasons, we do no longer accept certificates that were created with a sha1 signature algorithm. Here is how you can check this, e.g. with openssl:
openssl x509 -in example.org.crt.pem -noout -text | grep "Signature Algorithm" | uniq
  • For Service Providers: If you need your SP to execute Attribute Queries or Artifact Queries, your SP certificate should have the client attribute set. If you request your certificate from DFN-PKI, please use the template called “Shibboleth IdP/-SP”. If you do not use DFN-PKI certificates, have a look at our Swiss colleagues' documentation. If you do not need any Attribute/Artifact Queries, please deactivate the feature in your SP. With a Shibboleth SP you'd have to remove the element <AttributeResolver type=“Query”> and to restart shibd. Moreover, you should remove the Binding URL for Artifact Resolution Services and all SOAP Bindings (Logout). Here is how you check if your certificate has the client attribute set with openssl:
openssl x509 -in example.org.crt.pem -noout -text | grep -A 1 "X509v3 Extended Key Usage"
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
  • Put your new system into our test federation DFN-AAI-Test. Use our public test systems to check if the transfer of attributes works correctly.

  • If it does, submit a request to join DFN-AAI.

  • Last modified: 5 years ago