6
szerkesztés
Módosítások
Új oldal, tartalma: „== Introduction == The Hungarian Research and Educational Federation is migrating to a new metadata signing certificate (HREF-2025). All HREF members and partners mus…”
== Introduction ==
The Hungarian Research and Educational Federation is migrating to a new metadata signing certificate (HREF-2025).
All HREF members and partners must update their IdP and SP configurations with the new signing certificate by June 14, 2025, in order to ensure uninterrupted access to federated services supporting eduID.hu. After this date, the old signing certificate (HREF-2020), which has been in use for more than 4 years, will be decommissioned, and 10 days after its last use, the old metadata will become invalid.
The tables below contain all necessary data for the transition. Where possible, configuration examples offer solutions that allow simultaneous use of both the old and new metadata.
== Key Rollover ==
=== Code names ===
{| class="wikitable"
! Code name || Metadata signing certificate || Date of expiration
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2025 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}
=== SHA1 fingerprints ===
{| class="wikitable"
! Code name || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE</code>
|}
=== Domain names ===
{| class="wikitable"
|-
! Domain || URL || Key || Status
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}
== Shibboleth Service Provider beállítások ==
https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider
=== XML ===
https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>
=== MDX ===
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 2.X ====
<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>
== Shibboleth Identity Provider beállítások ==
=== XML ===
==== Shibboleth 4.X ====
https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataProvider>
</syntaxhighlight>
=== MDX ===
==== Shibboleth 4.X ====
https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>
</MetadataProvider>
</syntaxhighlight>
== SimpleSAMLphp ==
=== MDX ===
<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE'
],
],
</syntaxhighlight>
=== metarefresh ===
https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3
https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md
<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>
<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>
The Hungarian Research and Educational Federation is migrating to a new metadata signing certificate (HREF-2025).
All HREF members and partners must update their IdP and SP configurations with the new signing certificate by June 14, 2025, in order to ensure uninterrupted access to federated services supporting eduID.hu. After this date, the old signing certificate (HREF-2020), which has been in use for more than 4 years, will be decommissioned, and 10 days after its last use, the old metadata will become invalid.
The tables below contain all necessary data for the transition. Where possible, configuration examples offer solutions that allow simultaneous use of both the old and new metadata.
== Key Rollover ==
=== Code names ===
{| class="wikitable"
! Code name || Metadata signing certificate || Date of expiration
|-
|-
| HREF-2011 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2011.crt href-metadata-signer-2011.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2015 || style="text-align:center;" | [https://metadata.eduid.hu/certs/mdx-test-signer-2020.crt mdx-test-signer-2015.crt] || style="text-align:center;" | 2022.01.01.
|-
| HREF-2020 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2020.crt href-metadata-signer-2020.crt] || style="text-align:center;" | 2025.06.14.
|-
| HREF-2025 || style="text-align:center;" | [https://metadata.eduid.hu/certs/href-metadata-signer-2025.crt href-metadata-signer-2025.crt] || style="text-align:center;" | 2030.06.14.
|}
=== SHA1 fingerprints ===
{| class="wikitable"
! Code name || SHA1 fingerprint
|-
|-
| HREF-2011 || style="text-align:center;" | <code>FE:AE:0B:E8:FB:59:ED:F7:CB:7F:69:DF:19:4F:8B:6D:C7:F6:96:66</code>
|-
| HREF-2015 || style="text-align:center;" | <code>91:81:AD:2B:F1:C1:4E:47:93:A2:9D:49:34:B7:77:62:4F:2F:98:43</code>
|-
| HREF-2020 || style="text-align:center;" | <code>C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61</code>
|-
| HREF-2025 || style="text-align:center;" | <code>45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE</code>
|}
=== Domain names ===
{| class="wikitable"
|-
! Domain || URL || Key || Status
|-
| rowspan="3" | metadata.eduid.hu || <code>metadata.eduid.hu/2011/href.xml</code> || HREF-2011 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2020/href.xml</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>metadata.eduid.hu/2025/href.xml</code> || HREF-2025 || style="text-align:center;" | Prod
|-
| rowspan="3" | mdx.eduid.hu || <code>mdx-2015.eduid.hu</code> || HREF-2015 || style="text-align:center;" | Prod
|-
| <code>mdx-2020.eduid.hu</code> || HREF-2020 || style="text-align:center;" | Prod
|-
| <code>mdx-2025.eduid.hu</code> || HREF-2025 || style="text-align:center;" | Prod
|}
== Shibboleth Service Provider beállítások ==
https://wiki.shibboleth.net/confluence/display/SP3/MetadataProvider
=== XML ===
https://wiki.shibboleth.net/confluence/display/SP3/XMLMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider type="Chaining">
<MetadataProvider type="XML" id="href-2020" url="https://mdx-2020.eduid.hu" backingFilePath="href-2020.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="XML" id="href-2025" url="https://mdx-2025.eduid.hu" backingFilePath="href-2025.xml">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</MetadataProvider>
</syntaxhighlight>
=== MDX ===
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider type="MDQ" id="href-2020" ignoreTransport="true" baseUrl="https://mdx-2020.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
<MetadataProvider type="MDQ" id="href-2025" ignoreTransport="true" baseUrl="https://mdx-2025.eduid.hu/">
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="864000"/>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 2.X ====
<syntaxhighlight lang="xml">
<MetadataProvider type="Dynamic" id="href-2020" ignoreTransport="true">
<Subst>https://mdx-2020.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2020.crt"/>
</MetadataProvider>
<MetadataProvider type="Dynamic" id="href-2025" ignoreTransport="true">
<Subst>https://mdx-2025.eduid.hu/entities/$entityID</Subst>
<MetadataFilter type="Signature" certificate="href-metadata-signer-2025.crt"/>
</MetadataProvider>
</syntaxhighlight>
== Shibboleth Identity Provider beállítások ==
=== XML ===
==== Shibboleth 4.X ====
https://wiki.shibboleth.net/confluence/display/IDP4/FileBackedHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/IDP30/FileBackedHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="RemoteMetadataAggregate" xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/href-2025.xml"
metadataURL="https://metadata.eduid.hu/2025/href.xml">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/conf/metadata/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataProvider>
</syntaxhighlight>
=== MDX ===
==== Shibboleth 4.X ====
https://wiki.shibboleth.net/confluence/display/IDP4/DynamicHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>
</MetadataProvider>
</syntaxhighlight>
==== Shibboleth 3.X ====
https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider
<syntaxhighlight lang="xml">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT2S"
connectionTimeout="PT2S"
socketTimeout="PT4S">
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/href-metadata-signer-2025.crt"/>
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P9D"/>
<MetadataQueryProtocol>https://mdx-2025.eduid.hu/</MetadataQueryProtocol>
</MetadataProvider>
</syntaxhighlight>
== SimpleSAMLphp ==
=== MDX ===
<syntaxhighlight lang="php">
//config/config.php
'metadata.sources' => [
['type' => 'flatfile'], // ez a *-hosted metadata konfiguráció betöltése miatt szükséges
[
'type' => 'mdq',
'server' => 'https://mdx-2025.eduid.hu',
/* --- */
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE'
],
],
</syntaxhighlight>
=== metarefresh ===
https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_3
https://github.com/simplesamlphp/simplesamlphp-module-metarefresh/blob/master/docs/simplesamlphp-automated_metadata.md
<syntaxhighlight lang="php">
// config/config-metarefresh.php
$config = [
'sets' => [
'href-2020' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2020/href.xml',
'validateFingerprint' => 'C3:72:DC:75:4C:FA:BA:65:63:52:D9:6B:47:5B:44:7E:AA:F6:45:61',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2020/',
'outputFormat' => 'flatfile',
],
'href-2025' => [
'cron' => ['hourly'],
'sources' => [
[
'src' => 'https://metadata.eduid.hu/2025/href.xml',
'validateFingerprint' => '45:B2:33:96:7C:4F:7E:42:86:8D:CC:CF:CC:0E:3E:1C:2E:24:C2:DE',
],
],
'expireAfter' => 777600, // 9 nap.
'outputDir' => 'metadata/metarefresh-href-2025/',
'outputFormat' => 'flatfile',
],
],
];
</syntaxhighlight>
<syntaxhighlight lang="php">
// config/config.php
'metadata.sources' => [
['type' => 'flatfile'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2020'],
['type' => 'flatfile', 'directory' => 'metadata/metarefresh-href-2025'],
],
</syntaxhighlight>
