Dokumentation DFN-AAI, DFN-PKI und eduroam - en

certificates

Anonymous (anonymous@undisclosed.example.com) — 2024-08-27T06:23:54+00:00

2024/06/20 10:36		aktuell
Zeile 15:		Zeile 15:

	=== DFN-PKI Certificates ===		=== DFN-PKI Certificates ===
-	For SAML-based communication, 3-year valid certificates from the [[https://www.pki.dfn.de/dfn-verein-community-pki\|DFN-Verein Community PKI]] are recommended. If you are entitled to request certificates issued by DFN-PKI, please select the "Shibboleth IdP SP" profile when submitting your CSR. Upload the server certificate in the metadata administration tool.	+	For SAML-based communication, 3-year valid certificates from the [[de:dfnpki:dfnvereincommunitypki\|DFN-Verein Community PKI]] are recommended. If you are entitled to request certificates issued by DFN-PKI, please select the "Shibboleth IdP SP" profile when submitting your CSR. Upload the server certificate in the metadata administration tool.

	\\		\\

checklist

Anonymous (anonymous@undisclosed.example.com) — 2023-03-21T12:07:59+00:00

2022/11/17 11:48		aktuell
Zeile 171:		Zeile 171:
	{{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600\|}}		{{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600\|}}

		+	{{tag>needs-update}}

configuration

Anonymous (anonymous@undisclosed.example.com) — 2021-10-20T10:19:50+00:00

2017/06/15 13:53		aktuell
Zeile 1:		Zeile 1:
	====== Configuration ======		====== Configuration ======
	For installation and configuration of IdP and SP software please refer to		For installation and configuration of IdP and SP software please refer to
-	* [[de:shibidp3\|Shibboleth IdP]]	+	* [[de:shibidp:uebersicht\|Shibboleth IdP]] (de)
-	* [[de:shibsp\|Shibboleth SP]]	+	* [[de:shibsp\|Shibboleth SP]] (de)
-	* [[de:nonshib\|Other IdP/SP Software]]	+	* [[de:nonshib\|Other IdP/SP Software]] (de)
	Next step: [[en:certificates\|Certificates]]		Next step: [[en:certificates\|Certificates]]

contact

Anonymous (anonymous@undisclosed.example.com) — 2024-01-26T16:04:42+00:00

2022/06/23 17:04		aktuell
Zeile 2:		Zeile 2:
	* DFN: https://dfn.de/geschaeftsstelle/kontakt-und-anreise/ (German only)		* DFN: https://dfn.de/geschaeftsstelle/kontakt-und-anreise/ (German only)
	* [[en:aai:contact\|DFN-AAI]]		* [[en:aai:contact\|DFN-AAI]]
-	* [[https://www.pki.dfn.de/pkikontakt\|DFN-PKI]] (German only)	+	* [[de:dfnpki:contact\|DFN-PKI]] (German only)
	* [[de:eduroam:contact\|eduroam]] (German only)		* [[de:eduroam:contact\|eduroam]] (German only)

controlpage

Anonymous (anonymous@undisclosed.example.com) — 2025-11-21T07:54:01+00:00

2023/06/12 09:17		aktuell
Zeile 17:		Zeile 17:
	* [[en:aai:contact\|Contact]]		* [[en:aai:contact\|Contact]]
	* [[en:aai:assurance\|Identity Assurance (en)]]		* [[en:aai:assurance\|Identity Assurance (en)]]
-	* [[de:shibidp:uebersicht\|Tutorial Shibboleth IdP 4.x (de)]]
-	* [[de:shibidp:start\| Start des Tutorials]]
-	* [[de:shibidp:prepare\|Vorarbeiten]]
-	* [[de:shibidp:install\|Installation IdP 4.x]]
-	* [[de:shibidp:config\| Start Konfiguration]]
-	* [[de:shibidp:config-metadata\|Föderationsmetadaten]]
-	* [[de:shibidp:config-log\|Logging]]
-	* [[de:shibidp:config-mdv\|Eintrag in Metadatenverwaltung]]
-	* [[de:shibidp:config-idm\|Anbindung IdM]]
-	* [[de:shibidp:config-attributes-minimal\|Minimalkonfiguration von Attributen]]
-	* [[de:shibidp:config-zertifikate\|Zertifikate für SAML]]
-	* [[de:shibidp:config-i18n\|Internationalisierung]]
-	* [[de:shibidp:config-logos\|Logo und Favicon]]
-	* [[de:shibidp:config-tou\|Nutzungsbedinungen und User Consent]]
-	* [[de:shibidp:config-storage\|Server-Side Storage und persistentId]]
-	* [[de:shibidp:config-slo\|Single Logout]]
-	* [[de:shibidp:config-sealer\|Secret Key Management]]
-	* [[de:shibidp:config-encryption\|Verschlüsselungsalgorithmus]]
-	* [[de:production\|Produktivbetrieb]]
-	* [[de:shibidp:config-attributes\|Anpassung der Attributkonfiguration]]
-	* [[de:attributes-nutshell\|Attributes in a Nutshell]]
-	* [[:de:shibidp:troubleshooting\|Troubleshooting]]
-	* [[de:shibidp:config-ecp\|Enhanced Client or Proxy (ECP)]]
-	* [[de:shibidp:fail2ban\|Brute Force-Abwehr]]
	* [[de:shibidp:config-advanced\|Advanced IdP Configuration (de)]]		* [[de:shibidp:config-advanced\|Advanced IdP Configuration (de)]]
	* [[de:shibidp:statusurl\|IdP Status-URL]]		* [[de:shibidp:statusurl\|IdP Status-URL]]
Zeile 48:		Zeile 24:
	* [[de:shibidp:config-testzugang\|Testzugang für externe Admins]]		* [[de:shibidp:config-testzugang\|Testzugang für externe Admins]]
	* [[de:shibidp:config-cluster\|Hochverfügbarkeit]]		* [[de:shibidp:config-cluster\|Hochverfügbarkeit]]
-	* [[de:shibidp:config-x509\|X509-Authentifizierung]]
	* [[de:shibidp:mfa\|Mehr-Faktor-Authentifizierung]]		* [[de:shibidp:mfa\|Mehr-Faktor-Authentifizierung]]
	* [[de:shibidp:migration\|IdP-Migration]]		* [[de:shibidp:migration\|IdP-Migration]]
Zeile 58:		Zeile 33:
	* [[de:shibidp:change-entityid\|Änderung der EntityID]]		* [[de:shibidp:change-entityid\|Änderung der EntityID]]
	* [[de:shibidp:archiv\|Archivierte Artikel]]		* [[de:shibidp:archiv\|Archivierte Artikel]]
-	* [[de:shibidp:upgrade\|Shibboleth IdP 4.x Upgrade (de)]]
	* [[de:shibidp:upgrade5\|Shibboleth IdP 5.x Upgrade (de)]]		* [[de:shibidp:upgrade5\|Shibboleth IdP 5.x Upgrade (de)]]
	* [[de:aai:dataprotection\|Data Protection (de)]]		* [[de:aai:dataprotection\|Data Protection (de)]]

discovery

Anonymous (anonymous@undisclosed.example.com) — 2024-02-13T08:23:53+00:00

2024/02/13 09:21		aktuell
Zeile 39:		Zeile 39:

	Some SP operators have documented the generation of WAYFless URLs for their platform:		Some SP operators have documented the generation of WAYFless URLs for their platform:
-	* [[https://www.conf.dfn.de/beschreibung-des-dienstes/aai-freischaltung/\|DFNconf and DFN-Webconf]] (in German)	+	* [[https://www.conf.dfn.de/anleitungen-und-dokumentation/dfnconf-portal/aai-freischaltung\|DFNconf and DFN-Webconf]] (in German)
	* [[https://service.elsevier.com/app/answers/detail/a_id/28537/supporthub/elsevieraccess/\|Elsevier]]		* [[https://service.elsevier.com/app/answers/detail/a_id/28537/supporthub/elsevieraccess/\|Elsevier]]
	* [[https://idp.nature.com/help/sso#wayfless\|Springer Nature]]		* [[https://idp.nature.com/help/sso#wayfless\|Springer Nature]]

entity_attributes

Anonymous (anonymous@undisclosed.example.com) — 2023-01-12T18:29:27+00:00

2022/05/02 14:15		aktuell
Zeile 4:		Zeile 4:
	</callout>		</callout>

-	===== Degrees of Reliance of IdPs =====
-
-	This Entity Attribute announces the [[en:degrees_of_reliance\|Degree of Reliance]] of an Identity Provider.
-
-	<file xml dfn-aai-idp-metadata.xml>
-	<md:EntityDescriptor entityID="https://idp.scc.kit.edu/idp/shibboleth">
-	<md:Extensions>
-	<mdrpi:RegistrationInfo registrationAuthority="https://www.aai.dfn.de" registrationInstant="2010-03-15T10:30:11Z">
-	<mdrpi:RegistrationPolicy xml:lang="en">https://www.aai.dfn.de/en/join/</mdrpi:RegistrationPolicy>
-	<mdrpi:RegistrationPolicy xml:lang="de">https://www.aai.dfn.de/teilnahme/</mdrpi:RegistrationPolicy>
-	</mdrpi:RegistrationInfo>
-	<mdattr:EntityAttributes>
-	<!-- ... -->
-	<saml:Attribute Name="http://aai.dfn.de/loa/degree-of-reliance" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
-	<saml:AttributeValue>advanced</saml:AttributeValue>
-	</saml:Attribute>
-	</mdattr:EntityAttributes>
-	</md:Extensions>
-
-	</file>
-
-	For an example on how to restrict an SP's metadata import to IdPs that conform to the requirements of the Degree of Reliance 'Advanced' please refer to [[en:production#sp_example\|Production Environment]].
-	===== SP: Required Degree of Reliance =====
-	This entity attribute is used to signal the [[en:degrees_of_reliance\|Degree of Reliance]] required by the respective service provider.
-
-	<file xml dfn-aai-sp-metadata.xml>
-	<EntityDescriptor entityID="https://bw-support.scc.kit.edu/secure">
-	<Extensions>
-	<mdrpi:RegistrationInfo registrationAuthority="https://www.aai.dfn.de" registrationInstant="2013-05-29T12:16:37Z">
-	<mdrpi:RegistrationPolicy xml:lang="en">https://www.aai.dfn.de/en/join/</mdrpi:RegistrationPolicy>
-	<mdrpi:RegistrationPolicy xml:lang="de">https://www.aai.dfn.de/teilnahme/</mdrpi:RegistrationPolicy>
-	</mdrpi:RegistrationInfo>
-	<mdattr:EntityAttributes>
-	<!-- ... -->
-	<saml:Attribute Name="http://aai.dfn.de/require-loa/degree-of-reliance" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
-	<saml:AttributeValue>advanced</saml:AttributeValue>
-	</saml:Attribute>
-	</mdattr:EntityAttributes>
-	</Extensions>
-	</file>

	===== Sirtfi =====		===== Sirtfi =====
Zeile 120:		Zeile 80:
	</file>		</file>

-	The next example shows IdP metadata: The IdP releases attributes to CoCo compliant SPs, and it commits to the degree of reliance "Advanced".	+	The next example shows IdP metadata: The IdP releases attributes to CoCo compliant SPs.

	<file xml dfn-aai-metadata.xml>		<file xml dfn-aai-metadata.xml>
Zeile 132:		Zeile 92:
	<saml:Attribute Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">		<saml:Attribute Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	<saml:AttributeValue>http://www.geant.net/uri/dataprotection-code-of-conduct/v1</saml:AttributeValue>		<saml:AttributeValue>http://www.geant.net/uri/dataprotection-code-of-conduct/v1</saml:AttributeValue>
-	</saml:Attribute>
-	<saml:Attribute Name="http://aai.dfn.de/loa/degree-of-reliance" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
-	<saml:AttributeValue>advanced</saml:AttributeValue>
	</saml:Attribute>		</saml:Attribute>
	</mdattr:EntityAttributes>		</mdattr:EntityAttributes>
Zeile 180:		Zeile 137:
	</file>		</file>

-	The metadata of an IdP taking part in bwIdM and committing to the Degree of Reliance "Advanced" look like this:	+	The metadata of an IdP taking part in bwIdM:

	<file xml dfn-aai-metadata.xml>		<file xml dfn-aai-metadata.xml>
Zeile 192:		Zeile 149:
	<saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">		<saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	<saml:AttributeValue>http://aai.dfn.de/category/bwidm-member</saml:AttributeValue>		<saml:AttributeValue>http://aai.dfn.de/category/bwidm-member</saml:AttributeValue>
-	</saml:Attribute>
-	<saml:Attribute Name="http://aai.dfn.de/loa/degree-of-reliance" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
-	<saml:AttributeValue>advanced</saml:AttributeValue>
	</saml:Attribute>		</saml:Attribute>
	</mdattr:EntityAttributes>		</mdattr:EntityAttributes>
Zeile 225:		Zeile 179:
	<file xml shibboleth2.xml>		<file xml shibboleth2.xml>
	<MetadataProvider type="XML"		<MetadataProvider type="XML"
-	uri="http://www.aai.dfn.de/metadata/dfn-aai-metadata.xml"	+	uri="http://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml"
	backingFilePath="dfn-aai-metadata.xml" reloadInterval="3600">		backingFilePath="dfn-aai-metadata.xml" reloadInterval="3600">
	<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />		<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />
-	<MetadataFilter type="Whitelist" matcher="EntityAttributes">	+	<MetadataFilter type="Include" matcher="EntityAttributes">
	<saml:Attribute Name="http://macedir.org/entity-category"		<saml:Attribute Name="http://macedir.org/entity-category"
	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">		NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	<saml:AttributeValue>http://aai.dfn.de/category/bwidm-member</saml:AttributeValue>		<saml:AttributeValue>http://aai.dfn.de/category/bwidm-member</saml:AttributeValue>
	</saml:Attribute>		</saml:Attribute>
-	</MetadataFilter>
-	<MetadataFilter type="EntityRoleWhiteList">
-	<RetainedRole>md:IDPSSODescriptor</RetainedRole>
	</MetadataFilter>		</MetadataFilter>
	</MetadataProvider>		</MetadataProvider>
Zeile 248:		Zeile 199:
	backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600">		backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600">
	<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />		<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />
-	<MetadataFilter type="Blacklist" matcher="EntityAttributes">	+	<MetadataFilter type="Exclude" matcher="EntityAttributes">
	<saml:Attribute Name="http://macedir.org/entity-category"		<saml:Attribute Name="http://macedir.org/entity-category"
	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">		NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	<saml:AttributeValue>http://aai.dfn.de/category/public-idp</saml:AttributeValue>		<saml:AttributeValue>http://aai.dfn.de/category/public-idp</saml:AttributeValue>
	</saml:Attribute>		</saml:Attribute>
-	</MetadataFilter>
-	<MetadataFilter type="EntityRoleWhiteList">
-	<RetainedRole>md:IDPSSODescriptor</RetainedRole>
	</MetadataFilter>		</MetadataFilter>
	</MetadataProvider>		</MetadataProvider>
Zeile 261:		Zeile 209:
	</file>		</file>

-	This Shibboleth SP filters metadata to only work with IdPs committing to the Degree of Reliance "Advanced":
-
-	<file xml shibboleth2.xml>
-	<MetadataProvider type="XML"
-	uri="http://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml"
-	backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600">
-	<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />
-	<MetadataFilter type="Whitelist" matcher="EntityAttributes">
-	<saml:Attribute Name="http://aai.dfn.de/loa/degree-of-reliance"
-	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
-	<saml:AttributeValue>advanced</saml:AttributeValue>
-	</saml:Attribute>
-	</MetadataFilter>
-	</MetadataProvider>
-
-	</file>

	This IdP filter policy releases a list of attributes to bwIDM Service Providers:		This IdP filter policy releases a list of attributes to bwIDM Service Providers:

functionaltest

Anonymous (anonymous@undisclosed.example.com) — 2017-06-15T13:45:11+00:00

2017/06/15 13:59		aktuell
Zeile 3:		Zeile 3:
	* [[en:functionaltest_sp\|Service Provider]]		* [[en:functionaltest_sp\|Service Provider]]

-	Next step: [[en:production\|Productive Operation]]	+	Next step: [[en:production\|Production Environment]]

functionaltest_oidc_op

Anonymous (anonymous@undisclosed.example.com) — 2023-11-13T12:23:29+00:00

2023/11/12 15:04		aktuell
Zeile 1:		Zeile 1:
	====== Functional Test OpenID Connect OP ======		====== Functional Test OpenID Connect OP ======
-
-	<callout type="danger" title="Test RPs not available">
-	Due to a technical fault, the RP instances listed below are not available until further notice.
-	</callout>

	We offer three Relying Parties (that is: Service Providers supporting OIDC) for test pruposes.		We offer three Relying Parties (that is: Service Providers supporting OIDC) for test pruposes.

functionaltest_sp

Anonymous (anonymous@undisclosed.example.com) — 2022-06-16T13:46:37+00:00

2022/05/17 12:33		aktuell
Zeile 14:		Zeile 14:
	\| test-ma \| test \| urn:mace:dir:common-lib-terms \| member@... ; staff@... \| member with multiple affiliations \|		\| test-ma \| test \| urn:mace:dir:common-lib-terms \| member@... ; staff@... \| member with multiple affiliations \|
	\|test-all \|test \|only if required in SP metadata\|only if required in SP metadata\|all attributes that the SP requires in its metadata\|		\|test-all \|test \|only if required in SP metadata\|only if required in SP metadata\|all attributes that the SP requires in its metadata\|
-	\|test-special-charactrers1, test-special-charactrers2, test-special-charactrers3 \|test \|only if required in SP metadata\|only if required in SP metadata\|givenName and sn contain special characters, all attributes that the SP requires in its metadata\|	+	\|test-special-characters1, test-special-characters2, test-special-characters3 \|test \|only if required in SP metadata\|only if required in SP metadata\|givenName and sn contain special characters, all attributes that the SP requires in its metadata\|
	\|test-multi-mail \|test \|only if required in SP metadata\|only if required in SP metadata\|multiple values in e-mail attribute (do not use ''mail'' as an identifier, see [[en:aai:attributes_best_practice\|Best Practice]]), all attributes that the SP requires in its metadata\|		\|test-multi-mail \|test \|only if required in SP metadata\|only if required in SP metadata\|multiple values in e-mail attribute (do not use ''mail'' as an identifier, see [[en:aai:attributes_best_practice\|Best Practice]]), all attributes that the SP requires in its metadata\|

imprint

Anonymous (anonymous@undisclosed.example.com) — 2024-07-08T08:08:17+00:00

2022/05/02 15:23		aktuell
Zeile 1:		Zeile 1:
	====== Imprint ======		====== Imprint ======
-	[[https://www2.dfn.de/en/imprint/\|Imprint]] \| [[de:dse\|Privacy Policy (in German)]]	+	[[https://www.dfn.de/en/imprint/\|Imprint]] \| [[de:dse\|Privacy Policy (in German)]]

join

Anonymous (anonymous@undisclosed.example.com) — 2021-07-20T09:59:03+00:00

2020/04/03 17:41		aktuell
Zeile 3:		Zeile 3:
	* [[en:requirements\|Requirements and Best Practices]]		* [[en:requirements\|Requirements and Best Practices]]
	* [[en:registration\|Registration]]		* [[en:registration\|Registration]]
-	* [[en:metadata_admin_tool\|Metadata Administration]], [[en:metadata_admin_tool:checklist\|Check List for Publishing Metadata]]	+	* [[en:metadata_admin_tool\|Metadata Administration]], [[en:checklist\|Check List for Publishing Metadata]]
	* [[en:configuration\|Configuration]], [[en:certificates\|Certificates]], [[en:metadata\|Federation Metadata]]		* [[en:configuration\|Configuration]], [[en:certificates\|Certificates]], [[en:metadata\|Federation Metadata]]
	* [[en:functionaltest\|Functional Tests]]		* [[en:functionaltest\|Functional Tests]]

metadata

Anonymous (anonymous@undisclosed.example.com) — 2026-03-12T09:46:58+00:00

2026/02/18 15:50		aktuell
Zeile 24:		Zeile 24:

	Certificate for validating the signature(s) of DFN-AAI metadata (PEM format) \\		Certificate for validating the signature(s) of DFN-AAI metadata (PEM format) \\
-	SHA256 Fingerprint: 4D:DA:3F:88:EF:E9:E1:AA:E6:E3:EE:3C:B0:63:8A:ED:51:3C:A8:9A:03:AD:94:96:A2:2E:B5:F1:75:FB:21:48 \\	+	SHA256 Fingerprint: 6E:FE:08:72:C3:C2:49:77:AF:67:31:F3:AC:30:F7:17:17:03:EF:FA:BB:6C:88:14:97:B3:E1:A5:DD:A5:3A:A1 \\
	https://www.aai.dfn.de/metadata/dfn-aai.pem		https://www.aai.dfn.de/metadata/dfn-aai.pem
-
-	<callout type="primary" title="New Certificate for signature validation as of March, 12th, 2026, ca. 11:00 a.m. CET">
-	SHA256 Fingerprint: 6E:FE:08:72:C3:C2:49:77:AF:67:31:F3:AC:30:F7:17:17:03:EF:FA:BB:6C:88:14:97:B3:E1:A5:DD:A5:3A:A1 \\
-	https://download.aai.dfn.de/tmp/dfn-aai.pem (temporary location)
-	</callout>

	==== Additional Information ====		==== Additional Information ====

metadata_admin_tool

Anonymous (anonymous@undisclosed.example.com) — 2024-02-21T10:32:33+00:00

2023/10/05 14:20		aktuell
Zeile 22:		Zeile 22:
	Please note that we added a new role called "subadmin" (as of 11/9/2022). Metadata admins can invite subadmins independently and delegate the administration of metadata of individual IdPs/SPs to them. (See below for details.)		Please note that we added a new role called "subadmin" (as of 11/9/2022). Metadata admins can invite subadmins independently and delegate the administration of metadata of individual IdPs/SPs to them. (See below for details.)

-	==== How to get your initial credentials for the new tool ====	+	==== How to get your initial credentials for the MD Admin Tool ====
-	Your old credentials will not work in the new metadata admin tool (released Nov. 9th). You will receive an invitation link to the e-mail address you registered with. Follow the link in the e-mail. It only works once, though. If you followed the link earlier but did not set a password, please use the password reset link.	+	You will receive an invitation link to the e-mail address you registered with. Follow the link in the e-mail. It only works once, though. If you followed the link earlier but did not set a password, please use the password reset link.

	==== Two factor authentication ====		==== Two factor authentication ====
Zeile 47:		Zeile 47:


-	==== New role: Subadmin ====	+	==== Further role: Subadmin ====
	In the new metadata administration tool the role of subadmins is a new feature. It enables regular metadata admins to delegate the administration of metadata of individual IdPs/SPs to third parties. They do not have to involve DFN-AAI hotline into account creation for subadmins. (Regular metadata admins with full access still have to be registered via the hotline though.)		In the new metadata administration tool the role of subadmins is a new feature. It enables regular metadata admins to delegate the administration of metadata of individual IdPs/SPs to third parties. They do not have to involve DFN-AAI hotline into account creation for subadmins. (Regular metadata admins with full access still have to be registered via the hotline though.)

Zeile 127:		Zeile 127:
	* Select a file from your local computer and choose a meaningful name for the list.		* Select a file from your local computer and choose a meaningful name for the list.
	* If your file does not comply with the image size that can be displayed in the common UI interfaces, you can let our server scale it for you by ticking "Autoscale". The metadata administration tool does not accept any logos or favicons that are too big or too small. Thus, if you do not enable autoscaling you have to make sure the images have the correct size.{{:en:metadata_admin_tool:logos-en.png?600 \|}}		* If your file does not comply with the image size that can be displayed in the common UI interfaces, you can let our server scale it for you by ticking "Autoscale". The metadata administration tool does not accept any logos or favicons that are too big or too small. Thus, if you do not enable autoscaling you have to make sure the images have the correct size.{{:en:metadata_admin_tool:logos-en.png?600 \|}}
-
-	===== Main differences between old and new MD admin tool =====
-	^ old ^ new ^
-	\| password login only \| 2FA is mandatory \|
-	\| self-signed certificate had to be verified by the hotline \| Self-signed certificates can be used without hotline interaction \|
-	\| All metadata admins had write access to everything in the organization's account. \| Metadata admins can add subadmins and delegate certain metadata entries to them. \|
-	\| Logos/Favicons were published in the metadata as external URLs. It was possible to link to images with unsuitable sizes. \| (New) Logos/Favicons are uploaded to the tool and delivered by it. Files are scaled to the right size during the upload. \|
-	\| New entities could be added by fetching xml metadata from a remote URL. \| Existing xml metadata files can be uploaded. \|
-	\| Scopes were entered in the IdP metadata form. \| Scopes are regarded as meta information that is maintained on the level of the organization. They can then be assigned to individual IdPs. \|
-

metadata_local

Anonymous (anonymous@undisclosed.example.com) — 2023-03-02T11:41:02+00:00

2023/03/02 12:29		aktuell
Zeile 22:		Zeile 22:
	You can optionally limit access to the download URL to certain IP address ranges.		You can optionally limit access to the download URL to certain IP address ranges.

-	{{:en:metadata_admin_tool:local-metadata_htaccess.png?400\|}}	+	{{ :en:metadata_admin_tool:download-url1-en.png?800 \|}}
		+	{{ :en:metadata_admin_tool:local-metadata_htaccess.png?800 \|}}

	====== Configuration ======		====== Configuration ======

normative_documents

Anonymous (anonymous@undisclosed.example.com) — 2023-01-12T18:33:03+00:00

2020/03/24 15:07		aktuell
Zeile 1:		Zeile 1:
	====== Policy Documents ======		====== Policy Documents ======
	Guidelines, profiles and other normative documents		Guidelines, profiles and other normative documents
-
-	===== Levels of Assurance / Degrees of Reliance =====
-	* Please refer to [[en:degrees_of_reliance\|Degrees of Reliance]]

	===== Metadata Registration Practice Statement =====		===== Metadata Registration Practice Statement =====
	* [[https://www.aai.dfn.de/fileadmin/documents/mrps_dfn-aai_1.0.pdf\|Version 1.0, 2019-03-31 ]]		* [[https://www.aai.dfn.de/fileadmin/documents/mrps_dfn-aai_1.0.pdf\|Version 1.0, 2019-03-31 ]]

production

Anonymous (anonymous@undisclosed.example.com) — 2023-01-12T18:38:31+00:00

2023/01/09 14:22		aktuell
Zeile 7:		Zeile 7:
	===== 1. Metadata Administration Tool =====		===== 1. Metadata Administration Tool =====

-	Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set that is considered to fit best the needs for productive operations (cf. [[en:degrees_of_reliance\|Degrees of Reliance]]). The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the button will be unlocked. The metadata entry in question is then reviewed by the DFN-AAI team.	+	Using the Metadata Admin Tool (entity edit view, section "Federations"), the respective entity has to be added to the federation / metadata set(s) that is considered to fit best the needs for productive operations, i.e. at least DFN-AAI and - if applicable - eduGAIN. The system will check whether the metadata of this entity meet all requirements of the production environment (especially the registered certificate[s]) - and whether the account is linked with a contract. If the checks are positive, the button will be unlocked. The metadata entry in question is then reviewed by the DFN-AAI team.

	{{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600\|}}		{{:en:metadata_admin_tool:mdv-produktiv-pending-neuemdv-en.png?600\|}}
Zeile 85:		Zeile 85:
	For metadata URLs and the certificate for signature validation please refer to [[en:metadata\|the Metadata documentation]].		For metadata URLs and the certificate for signature validation please refer to [[en:metadata\|the Metadata documentation]].

-	Communication with all productive IdPs in DFN-AAI (Degree of Reliance "Adavanced" and "Basic") as well as all IdPs from eduGAIN - except "Self-Signup" IdPs (cf. also [[de:entity_attributes\|Entity Attributes]]):	+	Communication with all productive IdPs in DFN-AAI as well as all IdPs from eduGAIN - except "Self-Signup" IdPs (cf. also [[de:entity_attributes\|Entity Attributes]]):

	<file xml /etc/shibboleth/shibboleth2.xml>		<file xml /etc/shibboleth/shibboleth2.xml>
Zeile 98:		Zeile 98:
	backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600">		backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600">
	<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />		<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />
-	<MetadataFilter type="Blacklist" matcher="EntityAttributes">	+	<MetadataFilter type="Exclude" matcher="EntityAttributes">
	<saml:Attribute Name="http://macedir.org/entity-category"		<saml:Attribute Name="http://macedir.org/entity-category"
	NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">		NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
Zeile 107:		Zeile 107:
	</file>		</file>

-	The following example shows how to restrict the metadata import to IdPs that conform to the requirements of the Degree of Reliance 'Advanced':	+	\\
-		+
-	<file xml /etc/shibboleth/shibboleth2.xml>	+
-	<MetadataProvider type="XML" validate="true"	+
-	url="http://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml"	+
-	backingFilePath="dfn-aai-idp-metadata.xml" reloadInterval="3600">	+
-	<MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" />	+
-	<MetadataFilter type="Include" matcher="EntityAttributes">	+
-	<saml:Attribute Name="http://aai.dfn.de/loa/degree-of-reliance" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">	+
-	<saml:AttributeValue>advanced</saml:AttributeValue>	+
-	</saml:Attribute>	+
-	</MetadataFilter>	+
-	</MetadataProvider>	+
-		+
-	</file>	+

	===== Discovery Service =====		===== Discovery Service =====
Zeile 145:		Zeile 130:
	</file>		</file>

-	All productive IdPs in DFN-AAI (Degrees of Reliance "Advanced" + "Basic")	+	All productive IdPs in DFN-AAI
-	<file xml /etc/shibboleth/shibboleth2.xml>	+
-	<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.aai.dfn.de/DFN-AAI-Basic/wayf">	+
-	SAML2	+
-	</SSO>	+
-	</file>	+
-		+
-	All IdPs in DFN-AAI with Degree of Reliance "Advanced"	+
	<file xml /etc/shibboleth/shibboleth2.xml>		<file xml /etc/shibboleth/shibboleth2.xml>
	<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.aai.dfn.de/DFN-AAI/wayf">		<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.aai.dfn.de/DFN-AAI/wayf">
Zeile 159:		Zeile 137:
	</file>		</file>

-	All productive IdPs in DFN-AAI (Degree of Reliance "Advanced" + "Basic") and eduGAIN	+	All productive IdPs in DFN-AAI and in eduGAIN
	<file xml /etc/shibboleth/shibboleth2.xml>		<file xml /etc/shibboleth/shibboleth2.xml>
	<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.aai.dfn.de/DFN-AAI-eduGAIN/wayf">		<SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.aai.dfn.de/DFN-AAI-eduGAIN/wayf">

registration

Anonymous (anonymous@undisclosed.example.com) — 2025-02-24T15:32:54+00:00

2025/02/24 16:32		aktuell
Zeile 17:		Zeile 17:
	Phone: +49-30-884299-9124 \\		Phone: +49-30-884299-9124 \\
	Fax: +49-30-884299-370		Fax: +49-30-884299-370
-
-	<del>In exceptional duly justified cases, a temporary test account can be created before the contract is signed. Please contact the DFN-AAI helpdesk.</del>

	New entities (Identity Provider, Service Provider, Attribute Authorities) first have to join the DFN-AAI Test Federation before they are entitled to register with the production federation.		New entities (Identity Provider, Service Provider, Attribute Authorities) first have to join the DFN-AAI Test Federation before they are entitled to register with the production federation.

requirements

Anonymous (anonymous@undisclosed.example.com) — 2023-01-12T18:41:03+00:00

2022/09/26 11:21		aktuell
Zeile 29:		Zeile 29:

	==== Identity Provider ====		==== Identity Provider ====
-	* The participant must have an operational Identity Management system (IdM) that at least meets the requirements of [[en:degrees_of_reliance\|the Degree of Reliance]] 'Basic'. User and groups for which these requirements are not met must be excluded from using the DFN-AAI.	+	* The participant must have an operational Identity Management system (IdM) and Identity Provider (IdP) that at least meet [[de:aai:assurance_idp#erste_schritte_und_voraussetzungen\|Conformance Criteria of the REFEDS Assurance Framework]]. User and groups for which these requirements are not met must be excluded from using the DFN-AAI.
	* An Identity Provider should be able to produce the [[de:common_attributes\|most important attributes]]. These attributes must be encoded in [[https://wiki.shibboleth.net/confluence/display/CONCEPT/SAMLAttributeNaming\|standard-compliant encoding]] (urn:oid) when transmitted to Service Providers (if required for the provision of the respective service and permissible under data protection law)		* An Identity Provider should be able to produce the [[de:common_attributes\|most important attributes]]. These attributes must be encoded in [[https://wiki.shibboleth.net/confluence/display/CONCEPT/SAMLAttributeNaming\|standard-compliant encoding]] (urn:oid) when transmitted to Service Providers (if required for the provision of the respective service and permissible under data protection law)
	* The signature of an Authentication Request sent by an SP must be validated against the corresponding certificate, which has been stored for this SP in the federation metadata		* The signature of an Authentication Request sent by an SP must be validated against the corresponding certificate, which has been stored for this SP in the federation metadata

shibspmigration

Anonymous (anonymous@undisclosed.example.com) — 2019-09-12T08:28:39+00:00

2019/09/12 10:27		aktuell
Zeile 2:		Zeile 2:

	Ideally the metadata of a Service Provider do not change during migration. We recommend to		Ideally the metadata of a Service Provider do not change during migration. We recommend to
-	* preserve the SP's FQDN (and thus the old binding URLS). Change the name server entry instead, or move the IP address to the new server. If you cannot preserve the host name, go to the [[https://www.aai.dfn.de/verwaltung/\|metadata administration tool]] and add the new binding URLs - additionally to the old ones. During migration the old and the new binding URLs are published in parallel.	+	* preserve the SP's FQDN (and thus the old binding URLS). Change the name server entry instead, or move the IP address to the new server. If you cannot preserve the host name, go to the [[https://www.aai.dfn.de/en/administration/\|metadata administration tool]] and add the new binding URLs - additionally to the old ones. During migration the old and the new binding URLs are published in parallel.
	* preserve the certificate and private key. If you have to use a new key (and a new certifcate) for SAML-based communication please follow the step by step guide for [[https://doku.tid.dfn.de/en:certificates#certificate_key_rollover_sp\|certificate rollover]].		* preserve the certificate and private key. If you have to use a new key (and a new certifcate) for SAML-based communication please follow the step by step guide for [[https://doku.tid.dfn.de/en:certificates#certificate_key_rollover_sp\|certificate rollover]].
	* make sure the SP's EntityID stays the same. On the Identity Providers' side attribute release is tied to the EntityIDs of Service Providers. To modify it would mean that all IdPs you are working with would have to be reconfigured.		* make sure the SP's EntityID stays the same. On the Identity Providers' side attribute release is tied to the EntityIDs of Service Providers. To modify it would mean that all IdPs you are working with would have to be reconfigured.

sidebar

Anonymous (anonymous@undisclosed.example.com) — 2018-03-05T15:15:33+00:00

2018/03/05 16:15		aktuell
Zeile 1:		Zeile 1:
	~~NOCACHE~~		~~NOCACHE~~
-	<nav type="pills" stacked="true">
	{{navi>en:controlpage?ns}}		{{navi>en:controlpage?ns}}
-	</nav>	+

start

Anonymous (anonymous@undisclosed.example.com) — 2026-01-18T17:06:48+00:00

2024/07/08 10:06		aktuell
Zeile 3:		Zeile 3:
	The English version of this knowledge base is still in development. If you have any questions, please don't hesitate to [[en:contact\|contact us]].		The English version of this knowledge base is still in development. If you have any questions, please don't hesitate to [[en:contact\|contact us]].

-	Here you'll find information on [[en:dfnaai:start\|DFN-AAI]], the [[de:dfnpki:tcsfaq\|TCS Service of the DFN-PKI]] (German) and [[de:eduroam:start\|eduroam]] (German).	+	Here you'll find information on [[en:dfnaai:start\|DFN-AAI]], the [[de:dfnpki:start\|DFN-PKI]] (German) and [[de:eduroam:start\|eduroam]] (German).

-	For general information on DFN-PKI, please refer to https://www.pki.dfn.de.

ueberblick

Anonymous (anonymous@undisclosed.example.com) — 2015-06-06T14:21:17+00:00

2026/04/28 20:22	aktuell
Zeile 1:	Zeile 1:
	+	====== Overview ======
	+	content missing...

2023/06/12 09:17		aktuell
Zeile 17:		Zeile 17:
	* [[en:aai:contact\|Contact]]		* [[en:aai:contact\|Contact]]
	* [[en:aai:assurance\|Identity Assurance (en)]]		* [[en:aai:assurance\|Identity Assurance (en)]]
-	* [[de:shibidp:uebersicht\|Tutorial Shibboleth IdP 4.x (de)]]
-	* [[de:shibidp:start\| Start des Tutorials]]
-	* [[de:shibidp:prepare\|Vorarbeiten]]
-	* [[de:shibidp:install\|Installation IdP 4.x]]
-	* [[de:shibidp:config\| Start Konfiguration]]
-	* [[de:shibidp:config-metadata\|Föderationsmetadaten]]
-	* [[de:shibidp:config-log\|Logging]]
-	* [[de:shibidp:config-mdv\|Eintrag in Metadatenverwaltung]]
-	* [[de:shibidp:config-idm\|Anbindung IdM]]
-	* [[de:shibidp:config-attributes-minimal\|Minimalkonfiguration von Attributen]]
-	* [[de:shibidp:config-zertifikate\|Zertifikate für SAML]]
-	* [[de:shibidp:config-i18n\|Internationalisierung]]
-	* [[de:shibidp:config-logos\|Logo und Favicon]]
-	* [[de:shibidp:config-tou\|Nutzungsbedinungen und User Consent]]
-	* [[de:shibidp:config-storage\|Server-Side Storage und persistentId]]
-	* [[de:shibidp:config-slo\|Single Logout]]
-	* [[de:shibidp:config-sealer\|Secret Key Management]]
-	* [[de:shibidp:config-encryption\|Verschlüsselungsalgorithmus]]
-	* [[de:production\|Produktivbetrieb]]
-	* [[de:shibidp:config-attributes\|Anpassung der Attributkonfiguration]]
-	* [[de:attributes-nutshell\|Attributes in a Nutshell]]
-	* [[:de:shibidp:troubleshooting\|Troubleshooting]]
-	* [[de:shibidp:config-ecp\|Enhanced Client or Proxy (ECP)]]
-	* [[de:shibidp:fail2ban\|Brute Force-Abwehr]]
	* [[de:shibidp:config-advanced\|Advanced IdP Configuration (de)]]		* [[de:shibidp:config-advanced\|Advanced IdP Configuration (de)]]
	* [[de:shibidp:statusurl\|IdP Status-URL]]		* [[de:shibidp:statusurl\|IdP Status-URL]]
Zeile 48:		Zeile 24:
	* [[de:shibidp:config-testzugang\|Testzugang für externe Admins]]		* [[de:shibidp:config-testzugang\|Testzugang für externe Admins]]
	* [[de:shibidp:config-cluster\|Hochverfügbarkeit]]		* [[de:shibidp:config-cluster\|Hochverfügbarkeit]]
-	* [[de:shibidp:config-x509\|X509-Authentifizierung]]
	* [[de:shibidp:mfa\|Mehr-Faktor-Authentifizierung]]		* [[de:shibidp:mfa\|Mehr-Faktor-Authentifizierung]]
	* [[de:shibidp:migration\|IdP-Migration]]		* [[de:shibidp:migration\|IdP-Migration]]
Zeile 58:		Zeile 33:
	* [[de:shibidp:change-entityid\|Änderung der EntityID]]		* [[de:shibidp:change-entityid\|Änderung der EntityID]]
	* [[de:shibidp:archiv\|Archivierte Artikel]]		* [[de:shibidp:archiv\|Archivierte Artikel]]
-	* [[de:shibidp:upgrade\|Shibboleth IdP 4.x Upgrade (de)]]
	* [[de:shibidp:upgrade5\|Shibboleth IdP 5.x Upgrade (de)]]		* [[de:shibidp:upgrade5\|Shibboleth IdP 5.x Upgrade (de)]]
	* [[de:aai:dataprotection\|Data Protection (de)]]		* [[de:aai:dataprotection\|Data Protection (de)]]

2022/05/17 12:33		aktuell
Zeile 14:		Zeile 14:
	\| test-ma \| test \| urn:mace:dir:common-lib-terms \| member@... ; staff@... \| member with multiple affiliations \|		\| test-ma \| test \| urn:mace:dir:common-lib-terms \| member@... ; staff@... \| member with multiple affiliations \|
	\|test-all \|test \|only if required in SP metadata\|only if required in SP metadata\|all attributes that the SP requires in its metadata\|		\|test-all \|test \|only if required in SP metadata\|only if required in SP metadata\|all attributes that the SP requires in its metadata\|
-	\|test-special-charactrers1, test-special-charactrers2, test-special-charactrers3 \|test \|only if required in SP metadata\|only if required in SP metadata\|givenName and sn contain special characters, all attributes that the SP requires in its metadata\|	+	\|test-special-characters1, test-special-characters2, test-special-characters3 \|test \|only if required in SP metadata\|only if required in SP metadata\|givenName and sn contain special characters, all attributes that the SP requires in its metadata\|
	\|test-multi-mail \|test \|only if required in SP metadata\|only if required in SP metadata\|multiple values in e-mail attribute (do not use ''mail'' as an identifier, see [[en:aai:attributes_best_practice\|Best Practice]]), all attributes that the SP requires in its metadata\|		\|test-multi-mail \|test \|only if required in SP metadata\|only if required in SP metadata\|multiple values in e-mail attribute (do not use ''mail'' as an identifier, see [[en:aai:attributes_best_practice\|Best Practice]]), all attributes that the SP requires in its metadata\|

2020/04/03 17:41		aktuell
Zeile 3:		Zeile 3:
	* [[en:requirements\|Requirements and Best Practices]]		* [[en:requirements\|Requirements and Best Practices]]
	* [[en:registration\|Registration]]		* [[en:registration\|Registration]]
-	* [[en:metadata_admin_tool\|Metadata Administration]], [[en:metadata_admin_tool:checklist\|Check List for Publishing Metadata]]	+	* [[en:metadata_admin_tool\|Metadata Administration]], [[en:checklist\|Check List for Publishing Metadata]]
	* [[en:configuration\|Configuration]], [[en:certificates\|Certificates]], [[en:metadata\|Federation Metadata]]		* [[en:configuration\|Configuration]], [[en:certificates\|Certificates]], [[en:metadata\|Federation Metadata]]
	* [[en:functionaltest\|Functional Tests]]		* [[en:functionaltest\|Functional Tests]]