Both sides previous revision Previous revision Next revision | Previous revisionLast revisionBoth sides next revision |
en:production [2022/05/02 14:04] – Wolfgang Pempe | en:production [2023/01/09 14:22] – tags Silke Meyer |
---|
===== 1. Metadata Administration Tool ===== | ===== 1. Metadata Administration Tool ===== |
| |
Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set that is considered to fit best the needs for productive operations (cf. [[en:degrees_of_reliance|Degrees of Reliance]]). The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the entity will be unlocked. | Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set that is considered to fit best the needs for productive operations (cf. [[en:degrees_of_reliance|Degrees of Reliance]]). The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the button will be unlocked. The metadata entry in question is then reviewed by the DFN-AAI team. |
| |
| {{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600|}} |
===== 2. Configuration Changes ===== | ===== 2. Configuration Changes ===== |
| |
| |
==== SP Example ==== | ==== SP Example ==== |
| |
| <callout type="danger" title="Important note: Make sure that redirectLimit is set to the value 'host' or 'exact'!"> |
| Please make sure that in **''shibboleth2.xml''** in all **''<Sessions>''** elements the XML attribute **''redirectLimit''** |
| - is set and |
| - has the value **''host''** or **''exact''**! (if necessary in combination with ''allow'') |
| This measure prevents the possible open redirect misuse of the SP e.g. in the context of a phishing attack, cf. https://shibboleth.atlassian.net/browse/SSPCPP-714. |
| For more information on the configuration parameters of the ''<Sessions>'' element see the [[https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions|Shibboleth Wiki]]. |
| </callout> |
| |
**For metadata URLs and the certificate for signature validation please refer to [[en:metadata|the Metadata documentation]].** | **For metadata URLs and the certificate for signature validation please refer to [[en:metadata|the Metadata documentation]].** |
| |
</file> | </file> |
| |
{{tag>idp4 tutorial discovery produktivbetrieb metadata}} | {{tag>idp4 tutorial discovery production metadata wayf}} |