Pro-M - Oktatási Üzletág - Wiki - Szerkesztő közreműködései [hu]

MDX

2026-02-25T10:14:05Z

Cziernorbert(AT)niif.hu: tanusítvány módosítás

Az MDX, azaz MetaDataeXchange protokolt erőforrás optimalizálás céljából találták ki, hogy ne kelljen egyes IdP-knek és SP-knek indokolatlanul nagy XML fájlokat feldolgozniuk és tárolniuk, mikor a felhasználóiknak jó eséllyel a fájlokban tárolt entitások töredékére van csak szükségük. Ezért az egyes entitásokat be lehet úgy állítani, hogy csak akkor töltsék le az adott entitás metaadatát, mikor arra szükség van (az első letöltés után természetesen helyben tároldóik a metaadat a <code>cacheDuration</code>-ben megadott ideig). Az MDX kiszolgáló az alábbi szabvány szerint tudja visszaadni egy-egy entitás metaadatát: <code>https://mdx.eduid.hu/entities/{urlencoded}$entityID</code>, pl: <code>https://mdx.eduid.hu/entities/https%3A%2F%2Fdev.aai.niif.hu%2Fshibboleth</code>

== Dinamikus metadata kiszolgálás a HREF-ben ==
Az MDX kiszolgáló a '''https://mdx.eduid.hu''' alatt szolgáltat, és a ''href'' és az ''edugain'' metadata halmazokat tartalmazza.

Mindkét kiszolgáló ugyanazzal a kulccsal írja alá a lekért metaadat-állományt.
* A tanúsítvány letölthető innen: https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt
* SHA-1 lenyomata: <code>45:b2:33:96:7c:4f:7e:42:86:8d:cc:cf:cc:0e:3e:1c:2e:24:c2:de</code> .

=== Fontos tudnivaló Discovery Service használattal kapcsolatban ===
Lévén az MDX-et használó SP-knél nem áll rendelkezésre folyamatosan az összes potenciális IdP listája, így a beépített Discovery Service-ek nem működnek. Ha MDX-et használunk, akkor valamilyen külső Discvery Service-t kell használnunk. A HREF-ben a https://discovery.eduid.hu a központi Discovery Service.

Emellett maga az MDX kiszolgáló is biztosít Discovery Service felületet, ehhez akár Shibboleth SP-nél, akár simpleSAMLphp SP-nél a konfigurációban az alábbi URL-t kell megadni, mint Discovery Service: https://mdx.eduid.hu/role/idp.ds . Ez a Discovery Service tartalmazza a hazai eduID-ben, valamint az eduGAIN-ben levő összes IdP-t. (És, ellentétben a hagyományos https://discovery.eduid.hu/edugain szolgáltatással, ez tartlamazza a magyar VHO-t is VHO IdP néven.)

== MDX használata kliens oldalon ==
=== SimpleSAMLphp ===

Az 1.14-es kiadástól kezdve a SimpleSAMLphp tartalmazza az dinamikus metadata lekérdezés funkciót, amely mind IdP, mind SP szerepben egységes módon használható. A config/config.php állományban metadata.sources szekcióban kell elhelyezni az alábbi blokkot:

<source lang="php">
'metadata.sources' => array(
array('type' => 'flatfile'), // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
array(
'type' => 'mdx',
'server' => 'https://mdx.eduid.hu',
'cachedir' => '/var/simplesamlphp/mdx-cache', //opcionális, de ajánlott
'cachelength' => 86400, //opcionális,
'validateFingerprint' => '45:b2:33:96:7c:4f:7e:42:86:8d:cc:cf:cc:0e:3e:1c:2e:24:c2:de' //opcionális
),
),
</source>

A dinamikus és a statikus metadataforrások egyidejű használatára egy példa: [[SimpleSAMLMixedMetadata]]

=== Shibboleth SP ===

* Le kell tölteni a /etc/shibboleth alá az aláíró tanúsítványát innen: https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt
* Az alábbi blokkot be kell szúrni a <code>/etc/shibboleth/shibboleth2.xml</code> fájlba

<source lang="xml">
<MetadataProvider type="Dynamic" ignoreTransport="true">
<Subst>https://mdx.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</source>

=== Shibboleth IdPv3 ===

* Le kell tölteni a <code>${idp.home}/credentials/</code> alá az aláíró tanúsítványát innen: https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt
* A <code>conf/metadata-providers.xml</code> fájlt kell szerkeszteni az alábbi módon:
<source lang="xml">

<MetadataProvider
xmlns="urn:mace:shibboleth:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"
id="dynamicMDQ" xsi:type="DynamicHTTPMetadataProvider">


<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" />


<MetadataFilter xsi:type="SignatureValidation" requireSignedMetadata="true"
certificateFile="${idp.home}/credentials/href-metadata-signer-2025.crt" />


<MetadataQueryProtocol>https://mdx.eduid.hu/</MetadataQueryProtocol>
</MetadataProvider>

</source>

EntraID in eduID.hu

2026-02-16T08:34:01Z

Cziernorbert(AT)niif.hu:

== Overview ==

This document explains how to configure SimpleSAMLphp so that it uses Microsoft Entra ID as the authentication authority (Identity Provider) and then acts as a SAML Identity Provider (IdP) to external federated Service Providers (SPs). This pattern is commonly known as an '''authentication proxy''' or '''IdP proxy'''.

In plain terms:

* End users authenticate against '''Entra ID'''.
* SimpleSAMLphp receives this authentication and optionally enriches or transforms attributes.
* SimpleSAMLphp then issues SAML assertions to federation partners or internal applications.

The proxy setup looks like this:

<pre>
┌────────────────────────────────┐
│ SimpleSAMLphp Proxy │
│ ┌────────┐ ┌────────┐ │
│ │ SP │ <--> │ IDP │ │
│ └───┬────┘ └────┬───┘ │
└──────┼──────────────────┼──────┘
│ │
┌──────▼───────┐ ┌───────▼───────┐
│ Entra ID IdP │ │ Federation SP │
└──────────────┘ └───────────────┘
</pre>

== Configure a SimpleSAMLphp SAML 2.0 Service Provider ==

To configure SimpleSAMLphp as a SAML 2.0 Service Provider, a new authentication source must be defined in the file <code>config/authsources.php</code>. This authentication source represents SimpleSAMLphp in its SP role towards Entra ID and is used to publish SP metadata.

The following example shows a minimal configuration suitable for use with Microsoft Entra ID:

<syntaxhighlight lang="php" line>
$config = [
/* ... */
/* An authentication source that can authenticate against SAML 2.0 IdPs. */
'entraid-sp' => [
'saml:SP',
// The entity ID of this SP.
'entityID' => 'https://proxy.example.org/simplesaml',
// The entity ID of the IdP this SP should contact.
'idp' => 'https://sts.windows.net/<your-entra-tenant-id>/'
'name' => ['en' => 'Microsoft Entra ID'],
// certificates
'certificate' => 'server.crt',
'privatekey' => 'server.key',
'privatekey_pass' => 'YourPrivateKeyPassphrase', /* you encrypt your private key, right? */
'authproc' => [
/* authproc rules*/
],
// fine tuning the auth source for Entra ID
'sign.authnrequest' => true,
'sign.logout' => true,
'proxymode.passAuthnContextClassRef' => true,
'disable_scoping' => true,
'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
],
],
</syntaxhighlight>

== Configure SimpleSAMLphp SAML 2.0 Identity Provider ==

In order for SimpleSAMLphp to issue SAML assertions to downstream Service Providers, it must be configured as a SAML 2.0 Identity Provider. This configuration is defined in the file <code>metadata/saml20-idp-hosted.php</code>.

The IdP configuration references the previously defined authentication source, effectively chaining authentication to Entra ID.

<syntaxhighlight lang="php" line>
$metadata['http://proxy.example.org/idp'] = [
/*
* The hostname of the server (VHOST) that will use this SAML entity.
*
* Can be '__DEFAULT__', to use this entry by default.
*/
'host' => '__DEFAULT__',
// X.509 key and certificate. Relative to the cert directory.
'privatekey' => 'server.pem',
'privatekey_pass' => 'YourPrivateKeyPassphrase',
'certificate' => 'server.crt',
/*
* Authentication source to use. Must be one that is configured in
* 'config/authsources.php'.
*/
'auth' => 'entraid-sp', // proxy to Microsoft Entra ID
'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
'authproc' => [
],
];
</syntaxhighlight>

== Create a new Enterprise Application in Entra ID ==

=== 1. Create a new Enterprise Application ===

A new '''Enterprise Application''' must be created in the Entra ID portal to represent SimpleSAMLphp in its role as a SAML Service Provider. This can be done by navigating to the '''Enterprise applications''' section of the Entra ID portal and creating a new application. During creation, the option to create a custom application that is not found in the gallery should be selected. A descriptive name and also select ''Integrate any other application you don't find in the gallery''.

=== 2. Configure SAML-based Single Sign-On ===

After the application has been created, SAML-based single sign-on must be enabled. This is done by opening the application, navigating to the '''Single sign-on''' section, and selecting '''SAML''' as the sign-on method. The trust relationship between Entra ID and SimpleSAMLphp is established by uploading the SAML 2.0 SP metadata generated by SimpleSAMLphp. The metadata upload automatically populates the basic SAML configuration, including the entity ID and assertion consumer service URL.

=== 3. Download Entra ID Federation Metadata ===

To finalise the SimpleSAMLphp side of the bilateral trust relationship between your Entra ID tenant and SimpleSAMLphp, copy your Enterprise Application’s ''App Federation Metadata''. Using SimpleSAMLphp’s Metadata Converter (found on the ''Federation'' tab of SimpleSAMLphp’s admin portal), convert your App Federation Metadata to SimpleSAMLphp’s native PHP format. Once you have the converted metadata, paste it into the <code>metadata/saml20-idp-remote.php</code> file.

=== 4. Configure Attribute Claims Rules ===

Attribute and claim mappings can be adjusted in the Entra ID application to ensure that the required user attributes are released to SimpleSAMLphp. These attributes will later be available for transformation, filtering, or enrichment before being sent to downstream Service Providers.

== Attribute Mapping and Transformation ==

When authenticating against Microsoft Entra ID, user attributes are returned as SAML claims using Microsoft-specific or WS-Federation-style claim URIs. In most federation environments, these claims must be mapped to standard SAML or eduPerson attribute names before they are released to downstream Service Providers.

SimpleSAMLphp performs attribute mapping through authentication processing filters. Mapping rules are applied in the <code>authproc</code> section of the authentication source that represents Entra ID, ensuring that attributes are normalized as soon as they enter SimpleSAMLphp. These mappings can either reuse [https://github.com/simplesamlphp/simplesamlphp/blob/master/attributemap/entra2name.php built-in attribute maps provided] by SimpleSAMLphp or be defined explicitly using custom rules.

Here is an example of using <code>core:AttributeMap</code> processing filter:

<syntaxhighlight lang="php" line>
'authproc' => [
/* ... */
60 => [
'class' => 'core:AttributeMap',
/* there are several versions of the userprincipalname claim, you only need the one you use */
'http://schemas.xmlsoap.org/claims/UPN' => 'eduPersonPrincipalName',
'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn' => 'eduPersonPrincipalName',
'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => 'eduPersonPrincipalName',
/* other possible attributes */
'http://schemas.xmlsoap.org/claims/CommonName' => 'displayName',
'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'givenName',
'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'sn',
'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => 'mail',
'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' => 'memberOf',
],
/* ... */
],
</syntaxhighlight>

or
<syntaxhighlight lang="php" line>
'authproc' => [
60 => [
'class' => 'core:AttributeMap',
'attributemap' => 'entra2name',
],
],
</syntaxhighlight>

Once mapped, attributes can be further filtered, enriched, or selectively released by additional authentication processing filters before being issued by the proxy IdP.

== Configure SimpleSAMLphp to Use Entra ID as an Authentication Source ==

With the Enterprise Application configured, SimpleSAMLphp must be instructed to use Entra ID as its authentication source. This is done by setting the IdP entity ID in the entraid-sp authentication source to the Entra ID tenant identifier.

<syntaxhighlight lang="php" line>
'idp' => 'https://sts.windows.net/<your-entra-tenant-id>/',
</syntaxhighlight>

This configuration causes SimpleSAMLphp, acting as a Service Provider, to redirect authentication requests to Entra ID. After importing the Entra ID metadata, the corresponding entity ID should be visible under SAML 2.0 IdP metadata on the Federation tab of the SimpleSAMLphp admin interface.

== Testing ==

You should now be able to go to the '''Test''' tab in the admin portal, log in to your <code>entraid-sp</code> authentication source, and be redirected to your Entra ID application’s login page.
Once logged in, it is worth verifying that SimpleSAMLphp is correctly receiving the attributes from Entra ID.

== Sources ==

* https://nathansenblog.wordpress.com/2021/02/23/azure-ad-single-sign-on-with-simplesamlphp
* https://safire.ac.za/technical/resources/configuring-simplesamlphp-to-use-entra-id

HREF Key Rollover 2025

2025-05-30T12:40:35Z

Cziernorbert(AT)niif.hu:

== Bevezetés ==
A HREF új metaadat aláírókulcsra áll át a SAML 2.0 metaadataiban (HREF-2025). A HREF szövetségi tagoknak és partnernek az új aláírókulcshoz tartozó konfigurációkat 2025. juniús 14.-ig frissíteniük kell az összes eduID.hu-t támogató rendszerükben. Ezt követően a régi - több, mint 4 éves aláírókulcs (HREF-2020) - leállításra kerül, és az utolsó aláírástól számított 10. napon a régi metaadat érvénytelen lesz.

Az alábbi táblázatok az átálláshoz szükséges összes adatot tartalmazzák. A konfigurációs példák, olyan megoldásokat kínálnak (ahol ez lehetséges), amelyekkel egyszerre lehet használni a régi és az új metaadatot.

== Key Rollover ==

=== Elnevezések ===

{| class="wikitable"
! Elnevezés || Metaadat aláíró tanúsítvány || Kivezetés tervezett időpontja
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2025 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}

=== SHA1 fingerprints ===

{| class="wikitable"
! Elnevezés || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE</code>
|}

=== Domain név változások ===

{| class="wikitable"
|-
! Domain || Technikai domain || Kulcs || Állapot
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}

=== Discovery Service változások ===

{| class="wikitable"
! URL
|-
| https://mdx-2020.eduid.hu/role/idp.ds
|-
| https://mdx-2025.eduid.hu/discovery/ds
|}

== Shibboleth Service Provider beállítások ==

https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider

=== XML ===

https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 2.X ====

<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>

== Shibboleth Identity Provider beállítások ==

=== XML ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

== SimpleSAMLphp ==

=== MDX ===

<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE'
],
],
</syntaxhighlight>

=== metarefresh ===

https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3

https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md

<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>

<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>

== FAQ /GYIK ==

Bővítés alatt!

* Miért cserél KIFÜ kulcsot?
* IdP-t érinti?
* Mi a helyzet az eduGAIN-t használó IdP-kkel?
* Mi a helyzet az eduGAIN-t használó SP-kkel?
* Hogyan tudom ellenőrízni, hogy jó kulcsot használok?

HREF Key Rollover 2025 English

2025-05-21T13:03:44Z

Cziernorbert(AT)niif.hu: Új oldal, tartalma: „== Introduction == The Hungarian Research and Educational Federation is migrating to a new metadata signing certificate (HREF-2025). All HREF members and partners mus…”

== Introduction ==

The Hungarian Research and Educational Federation is migrating to a new metadata signing certificate (HREF-2025).

All HREF members and partners must update their IdP and SP configurations with the new signing certificate by June 14, 2025, in order to ensure uninterrupted access to federated services supporting eduID.hu. After this date, the old signing certificate (HREF-2020), which has been in use for more than 4 years, will be decommissioned, and 10 days after its last use, the old metadata will become invalid.

The tables below contain all necessary data for the transition. Where possible, configuration examples offer solutions that allow simultaneous use of both the old and new metadata.

== Key Rollover ==

=== Code names ===

{| class="wikitable"
! Code name || Metadata signing certificate || Date of expiration
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2025 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}

=== SHA1 fingerprints ===

{| class="wikitable"
! Code name || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE</code>
|}

=== Domain names ===

{| class="wikitable"
|-
! Domain || URL || Key || Status
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}

== Shibboleth Service Provider beállítások ==

https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider

=== XML ===

https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 2.X ====

<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>

== Shibboleth Identity Provider beállítások ==

=== XML ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

== SimpleSAMLphp ==

=== MDX ===

<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE'
],
],
</syntaxhighlight>

=== metarefresh ===

https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3

https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md

<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>

<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>

HREF Key Rollover 2025

2025-05-15T07:37:49Z

Cziernorbert(AT)niif.hu:

== Bevezetés ==
A HREF új metaadat aláírókulcsra áll át a SAML 2.0 metaadataiban (HREF-2025). A HREF szövetségi tagoknak és partnernek az új aláírókulcshoz tartozó konfigurációkat 2025. juniús 14.-ig frissíteniük kell az összes eduID.hu-t támogató rendszerükben. Ezt követően a régi - több, mint 4 éves aláírókulcs (HREF-2020) - leállításra kerül, és az utolsó aláírástól számított 10. napon a régi metaadat érvénytelen lesz.

Az alábbi táblázatok az átálláshoz szükséges összes adatot tartalmazzák. A konfigurációs példák, olyan megoldásokat kínálnak (ahol ez lehetséges), amelyekkel egyszerre lehet használni a régi és az új metaadatot.

== Key Rollover ==

=== Elnevezések ===

{| class="wikitable"
! Elnevezés || Metaadat aláíró tanúsítvány || Kivezetés tervezett időpontja
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2025 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}

=== SHA1 fingerprints ===

{| class="wikitable"
! Elnevezés || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE</code>
|}

=== Domain név változások ===

{| class="wikitable"
|-
! Domain || Technikai domain || Kulcs || Állapot
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}

== Shibboleth Service Provider beállítások ==

https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider

=== XML ===

https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 2.X ====

<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>

== Shibboleth Identity Provider beállítások ==

=== XML ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

== SimpleSAMLphp ==

=== MDX ===

<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE'
],
],
</syntaxhighlight>

=== metarefresh ===

https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3

https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md

<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>

<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>

== FAQ /GYIK ==

Bővítés alatt!

* Miért cserél KIFÜ kulcsot?
* IdP-t érinti?
* Mi a helyzet az eduGAIN-t használó IdP-kkel?
* Mi a helyzet az eduGAIN-t használó SP-kkel?
* Hogyan tudom ellenőrízni, hogy jó kulcsot használok?

HREF Key Rollover 2025

2025-01-23T08:43:12Z

Cziernorbert(AT)niif.hu: Új oldal, tartalma: „== Bevezetés == A HREF új metaadat aláírókulcsra áll át a SAML 2.0 metaadataiban (HREF-2025). A HREF szövetségi tagoknak és partnernek az új aláírókulcsho…”

== Bevezetés ==
A HREF új metaadat aláírókulcsra áll át a SAML 2.0 metaadataiban (HREF-2025). A HREF szövetségi tagoknak és partnernek az új aláírókulcshoz tartozó konfigurációkat 2025. juniús 14.-ig frissíteniük kell az összes eduID.hu-t támogató rendszerükben. Ezt követően a régi - több, mint 4 éves aláírókulcs (HREF-2020) - leállításra kerül, és az utolsó aláírástól számított 10. napon a régi metaadat érvénytelen lesz.

Az alábbi táblázatok az átálláshoz szükséges összes adatot tartalmazzák. A konfigurációs példák, olyan megoldásokat kínálnak (ahol ez lehetséges), amelyekkel egyszerre lehet használni a régi és az új metaadatot.

== Key Rollover ==

=== Elnevezések ===

{| class="wikitable"
! Elnevezés || Metaadat aláíró tanúsítvány || Kivezetés tervezett időpontja
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}

=== SHA1 fingerprints ===

{| class="wikitable"
! Elnevezés || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>F3:53:3E:1E:FF:A3:65:69:C4:5E:CB:17:55:89:51:1D:76:9F:91:A9</code>
|}

=== Domain név változások ===

{| class="wikitable"
|-
! Domain || Technikai domain || Kulcs || Állapot
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}

== Shibboleth Service Provider beállítások ==

https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider

=== XML ===

https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 2.X ====

<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>

== Shibboleth Identity Provider beállítások ==

=== XML ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

</MetadataProvider>
</syntaxhighlight>

=== MDX ===

==== Shibboleth 4.X ====

https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

==== Shibboleth 3.X ====

https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider

<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">

<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>

<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>

<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>

</MetadataProvider>
</syntaxhighlight>

== SimpleSAMLphp ==

=== MDX ===

<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => 'F3:53:3E:1E:FF:A3:65:69:C4:5E:CB:17:55:89:51:1D:76:9F:91:A9'
],
],
</syntaxhighlight>

=== metarefresh ===

https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3

https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md

<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => 'F3:53:3E:1E:FF:A3:65:69:C4:5E:CB:17:55:89:51:1D:76:9F:91:A9',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>

<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>

== FAQ /GYIK ==

Bővítés alatt!

* Miért cserél KIFÜ kulcsot?
* IdP-t érinti?
* Mi a helyzet az eduGAIN-t használó IdP-kkel?
* Mi a helyzet az eduGAIN-t használó SP-kkel?
* Hogyan tudom ellenőrízni, hogy jó kulcsot használok?