AboutEduID.hu - Laptörténet

Sitya(AT)niif.hu, 2013. május 2., 09:11-n

2013-05-02T09:11:40Z

Bajnokk(AT)niif.hu: /* Production federation */ more pretty links

2012-10-26T14:06:40Z

‎Production federation: more pretty links

Bajnokk(AT)niif.hu: /* How to join */

2012-10-26T14:05:16Z

‎How to join

Bajnokk(AT)niif.hu: + ''How to join'' stub

2012-10-26T13:26:11Z

+ ''How to join'' stub

Bajnokk(AT)niif.hu: /* Legal */ alter link to reference to the production service agreement

2012-09-06T14:19:15Z

‎Legal: alter link to reference to the production service agreement

Bajnokk(AT)niif.hu: /* Legal */ Add link to contract

2012-04-03T11:55:48Z

‎Legal: Add link to contract

Bajnokk(AT)niif.hu: /* Service levels of Federation Operator Services */ SLA is not necessary here

2012-04-03T11:38:18Z

‎Service levels of Federation Operator Services: SLA is not necessary here

Bajnokk(AT)niif.hu: /* Metadata */ moving metadata specification to a separate document

2012-03-30T15:25:19Z

‎Metadata: moving metadata specification to a separate document

Bajnokk(AT)niif.hu: metadata sign interval correction, otherwise mostly language polishing

2012-03-30T12:51:25Z

metadata sign interval correction, otherwise mostly language polishing

Bajnokk(AT)niif.hu: /* Federation Operator services */

2012-03-28T17:54:44Z

‎Federation Operator services

← Régebbi változat		A lap 2013. május 2., 09:11-kori változata
121. sor:		121. sor:

	You do not need to re-register your entity to proceed to the production federation. If we have all the necessary information, the starting of the joining process is at your discretion.		You do not need to re-register your entity to proceed to the production federation. If we have all the necessary information, the starting of the joining process is at your discretion.
		+	[[Kategória: AAI]][[Kategória: eduid]][[Kategória: english]]

@@ 105. sor: / 105. sor: @@
 * Helpdesk URL (optional)
-This information should be sent to the Federation Operator (see [[#Contacts]]) in email. Two copies of the signed Service Agreement (available at [http://eduid.hu/documents]) should be sent by traditional post, one copy will be returned after counter-signing.
+This information should be sent to the Federation Operator (see [[#Contacts|above]]) in email. Two copies of the signed Service Agreement (available at http://eduid.hu/documents) should be sent by traditional post, one copy will be returned after counter-signing.
 After the application has been reviewed by the Federation Operator, it is forwarded to the Members' Board. It usually takes 3-5 working days for the Board to accept the application, after which the entity metadata is be added to the production federation metadata.

← Régebbi változat		A lap 2012. október 26., 14:05-kori változata
93. sor:		93. sor:

	== How to join ==		== How to join ==
		+	=== Production federation ===
		+	In order to join the production federation as a Partner, you need to send the following information:
		+	* SP metadata URL (HTTPS preferred)
		+	* Name of the SP
		+	* Brief description of the service
		+	* Service URL
		+	* Privacy policy URL
		+	* Administrative and technical contact names and mail addresses (non-personal preferred)
		+	* Required and optional attributes
		+	* Logo URL (optional)
		+	* Helpdesk URL (optional)
		+
		+	This information should be sent to the Federation Operator (see [[#Contacts]]) in email. Two copies of the signed Service Agreement (available at [http://eduid.hu/documents]) should be sent by traditional post, one copy will be returned after counter-signing.
		+
		+	After the application has been reviewed by the Federation Operator, it is forwarded to the Members' Board. It usually takes 3-5 working days for the Board to accept the application, after which the entity metadata is be added to the production federation metadata.
		+
		+	=== Testing metadata ===
		+	It is recommended that a new SP should be registered to the testing federation at first, which is much easier and a fully online process.
		+
		+	The following information is necessary to enter into the testing metadata:
		+	* SP metadata URL (HTTPS preferred)
		+	* Name of the SP
		+	* Administrative and technical contact names and mail addresses (non-personal preferred)
		+	* Required and optional attributes
		+
		+	You can ask for test accounts in our Virtual Home Organization. During testing, you might want to use the production federation metadata, because the VHO is present in both metadata files.
		+
		+	You do not need to re-register your entity to proceed to the production federation. If we have all the necessary information, the starting of the joining process is at your discretion.

@@ 3. sor: / 3. sor: @@
 == About the federation ==
-Hungarian Research and Educational Federation (HREF) is a SAML2-based Identity Federation of Hungarian higher education and research institutions, public collections and other content providers. For the end-users, the federation aims to be transparent, therefore the login procedure is communicated as '''''eduID login'''''.
+Hungarian Research and Educational Federation ('''HREF''') is a SAML2-based Identity Federation of Hungarian higher education and research institutions, public collections and other content providers. For the end-users, the federation aims to be transparent, therefore the login procedure is communicated as '''''eduID login'''''.
 === Contacts ===
 The Federation is operated by [http://www.niif.hu NIIF Institute] as a Federation Operator. Questions, concerns or any kind of requests about the Federation should be directed to any of the following addresses:
@@ 91. sor: / 91. sor: @@
 === Metadata ===
 [[HREFMetadataSpecEN | Metadata Specification]] is maintained in a separate document.

@@ 60. sor: / 60. sor: @@
 The Federation itself is not a legal entity, Members and Partners establish a legal connection to the Federation Operator. Any legal claims between Members and/or Partners shall be directed to the organisation operating the Identity Provider or the Service Provider.
-The Service Agreement between the Federation Operator and Partner is available '''[[:File:Href-contract-partner.doc|here]]'''.
+The Service Agreement between the Federation Operator and Partner is available '''[http://www.eduid.hu/wp-content/uploads/2012/08/href-contract-partner.doc here]'''.
 == Technical information ==

← Régebbi változat		A lap 2012. április 3., 11:38-kori változata
89. sor:		89. sor:
	=== Metadata ===		=== Metadata ===
	[[HREFMetadataSpecEN \| Metadata Specification]] is maintained in a separate document.		[[HREFMetadataSpecEN \| Metadata Specification]] is maintained in a separate document.
−
−	~~== Service levels of Federation Operator Services ==~~
−	~~=== Metadata distribution ===~~
−	Metadata is considered to be ''available'', if the federation metadata file is available and can be validated by using the signing certificate of the Federation Operator. Metadata is considered to be ''current'', when it is available and the file is generated not earlier than ''8 hours''.
−
−	~~Federation Operator provides Metadata which is '''available in 99.9%''' and '''current in 99%''' of time within any 12 months time frame.~~
−	~~=== Resource Registry ===~~
−	Resource Registry allows administration of the entities of the federation. (Only administrators of Members and the Federation Operators are allowed to use this service). It is considered to be ''available'' if administrator login is possible (given that the Identity Provider is working properly).
−
−	~~Federation Operator provides Resource Registry which is available in '''98%''' of time within any 12 months time frame.~~
−	~~=== Discovery Service ===~~
−	Discovery Service is a web form which displays the available Identity Providers of the federation. It uses the [http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cs-01.pdf SAML2 Discovery Profile]. It is considered to be available if it is possible to select Identity Providers according to the named profile (given that the Service Provider is working properly).
−
−	~~Federation Operator provides Discovery Service which is available in '''99.9%''' of time within any 12 months time frame.~~
−	~~=== Virtual Home Organization ===~~
−	Virtual Home Organization is an Identity Provider for registering individuals without a Home Organisation. It is considered to be available if it is able to work as an Identity Provider in terms of the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML2 SSO Profile]
−
−	~~Federation Operator provides Virtual Home Organization which is available in '''99%''' of time within any 12 months time frame.~~

@@ 88. sor: / 88. sor: @@
 === Metadata ===
-Information about the entities of the Federation is maintained in a signed XML document, called the federation metadata.
+[[HREFMetadataSpecEN | Metadata Specification]] is maintained in a separate document.
 == Service levels of Federation Operator Services ==

@@ 1. sor: / 1. sor: @@
 == Purpose of this document ==
-This document is a collection of the information specified in several specific documents written in Hungarian. Since only Hungarian educational and research institutions are expected to be Federation Members (ie. operate an Identity Provider), this document focuses on rules relevant to (international) Federation Partners.
+This document is a collection of the information specified in several specific documents written in Hungarian. Since only Hungarian educational and research institutions are expected to be Federation Members (ie. operate an Identity Provider), this document focuses on rules what are relevant to (international) Federation Partners.
 == About the federation ==
-Hungarian Research and Educational Federation (HREF) is an identity federation of Hungarian higher education and research institutions, and for public collections and other content providers. For the end-users, the federation aims to be transparent, therefore the login procedure is communicated as '''''eduID login'''''.
+Hungarian Research and Educational Federation (HREF) is a SAML2-based Identity Federation of Hungarian higher education and research institutions, public collections and other content providers. For the end-users, the federation aims to be transparent, therefore the login procedure is communicated as '''''eduID login'''''.
 === Contacts ===
 The Federation is operated by [http://www.niif.hu NIIF Institute] as a Federation Operator. Questions, concerns or any kind of requests about the Federation should be directed to any of the following addresses:
@@ 12. sor: / 12. sor: @@
 :Hungary
-News and information about the federation is located at http://eduid.hu (Hungarian only)
+News and information about the federation is published at http://eduid.hu (Hungarian only)
 === Policy and principles of interoperation ===
 ==== Basic principles ====
@@ 28. sor: / 28. sor: @@
 * Prior joining the federation, every entity needs to publish the Data Protection Policy under which it operates. This policy must be kept up-to-date.
 * Whenever the Data Protection Policy changes, the Federation Operator must be notified.
-* Transfer of personal data is only allowed when
+* Transfer of personal data is only allowed when either
-** authorised by law,
+** authorised by law, or
 ** the user expressed his or her consent on the data transfer.
@@ 39. sor: / 39. sor: @@
 #* Institutions of secondary education;
 #* Public collections.
-# Any organisation might join as '''Partners'''.
+# Any organisation might join as a '''Partner'''.
 # All Members and Partners of the Federation might provide services.
 # A Partner might participate in the meeting of the Members' Board as an observer, without having rights to vote.
 # Only Members are entitled to
-#* supply user information to the federation
+#* supply user identity information to the federation
 #* send representatives into the Members' Board with a right to vote.
@@ 55. sor: / 55. sor: @@
 * accept application of new Members and Partners
-Partners are also may send representatives for MB meetings, without voting rights.
+Partners may also send representatives for MB meetings, without voting rights.
 === Legal ===
-The Federation itself is not a legal entity, Members and Partners establish a legal connection to the Federation Operator. Any legal claims shall be directed to the organisation operating the Identity Provider or the Service Provider.
+The Federation itself is not a legal entity, Members and Partners establish a legal connection to the Federation Operator. Any legal claims between Members and/or Partners shall be directed to the organisation operating the Identity Provider or the Service Provider.
 == Technical information ==
@@ 92. sor: / 92. sor: @@
 The metadata file is available both at http://metadata.eduid.hu/current/href.xml and https://metadata.eduid.hu/current/href.xml, however the unencrypted method is preferred. The file is stored on a highly available file server.
-The information inside the metadata file must not be trusted after the date specified in the <code>validUntil</code> field of the topmost <code>EntitiesDescriptor</code>. The expiration date of a metadata file is '''7 days''' after the date of the signature.
+The information inside the metadata file must not be trusted after the date specified in the <code>validUntil</code> field of the topmost <code>EntitiesDescriptor</code> is expired. The expiration time is is set to '''7 days''' after the instant of the signature.
-The metadata file is re-signed daily or whenever the entity information changes (eg. entities are added or modified). Entities are expected to refresh metadata information regularly.
+The metadata file is re-signed every ''4 hours'' or whenever the entity information changes (eg. entities are added or modified). Entities are expected to refresh metadata information regularly, although the  <code>cacheDuration</code> attribute is currently not set (for interoperability reasons).
 ==== Trust in metadata ====
 ===== Verification of the metadata file =====
@@ 105. sor: / 105. sor: @@
 * Availability: from <code>Oct 5 08:18:46 2011 GMT</code> until <code>Sep 30 08:18:46 2031 GMT</code>
-The certificate used for signing can be downloaded from https://metadata.eduid.hu/href-metadata-signer-2011.crt , which link should lead to a page without certificate warnings with most browsers. It is recommended to request the signing certificate from the Federation Operator by using other verifiable transport as well (such as PGP-signed email).
+The certificate used for signing can be downloaded from https://metadata.eduid.hu/href-metadata-signer-2011.crt , which link should lead to a page without certificate warnings with most browsers. It is recommended to request the signing certificate from the Federation Operator by using some other verifiable transport as well (such as PGP-signed email).
 ===== Signing procedure =====
-Information about the entities is retrieved from the Resource Registry by using strong server authentication. If the contents of the metadata changes, it is saved to a version control system and sent to a public mailing list ([https://listserv.niif.hu/mailman/listinfo/href-metadata-changes href-metadata-changes])
+Information about the entities is retrieved from the Resource Registry by using strong server authentication. If the contents of the metadata changes, it is saved to a version control system and the 'diff' is sent to a public mailing list ([https://listserv.niif.hu/mailman/listinfo/href-metadata-changes href-metadata-changes])
 The signature is done by a PIN-protected hardware token.
@@ 113. sor: / 113. sor: @@
 Changes of the signing key/certificate is always negotiated with the technical contacts of all federation entities.
 ==== Authenticating peer entities ====
-It is recommended for all entities to use self-signed certificates, however, even if an entity uses a certificate signed by an external CA, it shall not be assumed that peers use any kind of path validation or revocation checking.
+It is recommended for all entities to use self-signed certificates, however, even if an entity uses a certificate signed by an external CA, it shall not be assumed that peers use any kind of PKI path validation or revocation checking.
 ===== Entity certificate change or revocation =====
 An entity should change its signing certificate by allowing a time frame, when both the old and the new certificate is available in the metadata.
@@ 122. sor: / 122. sor: @@
 Extension elements should be either interpreted according to their specification or ignored completely (while they are valid XML).
-==== Other metadata sets available ====
+==== Other available metadata sets ====
 The federation signing engine is able to produce files other than the federation metadata (called metadata sets). These files are available at https://metadata.eduid.hu/current/, all signed by the same credentials as the federation metadata, therefore it is easy to add them as an auxiliary metadata source.
 * <code>href-test.xml</code>: staging federation metadata. Any federation member may put entities to this set.
 * <code>href-edugain.xml</code>: entities that are '''exported''' to [http://edugain.org eduGAIN] confederation. This file is consumed by eduGAIN MDS. As eduGAIN follows an opt-in policy, only those entities are present in this set, whose administrators explicitly requested to be published in eduGAIN.
 * <code>edugain.xml</code>: entities that are '''imported''' from [http://edugain.org eduGAIN] confederation (minus Hungarian entities).
-* <code><institution>.xml</code>: institution-specific metadata sets, which are maintained by institutional administrators. SPs inside this set are not required to be accepted by the federation, thus they can only be used within the institution.
+* <code><institution>.xml</code>: institution-specific metadata sets, which are maintained by the administrators of the institution. SPs inside this set are not required to be accepted by the federation, thus they are assumed to be used within the institution.
-== Service level of Federation Operator services ==
+== Service levels of Federation Operator Services ==
 === Metadata distribution ===
-Metadata is considered to be ''available'', if the federation metadata file is available and can be validated by using the signing certificate of the Federation Operator. Metadata is considered to be ''current'', when it is available and the file is generated not earlier than ''2 hours''.
+Metadata is considered to be ''available'', if the federation metadata file is available and can be validated by using the signing certificate of the Federation Operator. Metadata is considered to be ''current'', when it is available and the file is generated not earlier than ''8 hours''.
 Federation Operator provides Metadata which is '''available in 99.9%''' and '''current in 99%''' of time within any 12 months time frame.
 === Resource Registry ===
-Resource Registry allows administration of the entities of the federation. It is considered ''available'' if administrator login is possible (given that the Identity Provider is working properly).
+Resource Registry allows administration of the entities of the federation. (Only administrators of Members and the Federation Operators are allowed to use this service). It is considered to be ''available'' if administrator login is possible (given that the Identity Provider is working properly).
 Federation Operator provides Resource Registry which is available in '''98%''' of time within any 12 months time frame.
 === Discovery Service ===
-Discovery Service is a web form which displays the available Identity Providers of the federation. It uses the [http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cs-01.pdf SAML2 Discovery Profile]. It is considered available if it is possible to select Identity Providers according to the named profile (given that the Service Provider is working properly).
+Discovery Service is a web form which displays the available Identity Providers of the federation. It uses the [http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery-cs-01.pdf SAML2 Discovery Profile]. It is considered to be available if it is possible to select Identity Providers according to the named profile (given that the Service Provider is working properly).
 Federation Operator provides Discovery Service which is available in '''99.9%''' of time within any 12 months time frame.
 === Virtual Home Organization ===
-Virtual Home Organization is an Identity Provider for registering individuals without Home Institution. It is considered available if it is able to work as an Identity Provider in terms of the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML2 SSO Profile]
+Virtual Home Organization is an Identity Provider for registering individuals without a Home Organisation. It is considered to be available if it is able to work as an Identity Provider in terms of the [http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf SAML2 SSO Profile]
 Federation Operator provides Virtual Home Organization which is available in '''99%''' of time within any 12 months time frame.