This article will guide you through the modifications necessary to ensure your Service Provider is utilising Highly Available Metadata compared to the older Metadata which does not have HA enabled. The older link will continue to function for a period of time and once it’s depreciation has been planned, a notification email will be sent to all subscribers confirming the date and time of its removal.
The AAF strongly recommends modification during a maintenance window. Please contact AAF support if you need any further details.
- Metadata documents are only accessible by https request
- Our metadata endpoints DO NOT automatically redirect HTTP requests
All metadata documents are signed by the AAF. Subscribers MUST use the public key available at https://md.aaf.edu.au/aaf-metadata-certificate.pem to verify metadata documents whenever they are retrieved.
Please check your key against the following to ensure the accuracy of information. It is vital that each key conform to the follow format:
$> openssl x509 -subject -dates -fingerprint -in aaf-metadata-certificate.pem subject= /O=Australian Access Federation/CN=AAF Metadata notBefore=Nov 24 04:27:20 2015 GMT notAfter=Dec 9 04:27:20 2035 GMT SHA1 Fingerprint=E2:FC:CC:CB:0E:0F:3B:32:FA:55:87:29:08:DE:E0:34:DA:A2:15:5A
AAF Metadata document locations:
https://md.aaf.edu.au/aaf-metadata.xml – Containing all AAF subscribers
https://md.aaf.edu.au/aaf-edugain-metadata.xml – Containing IdP and SP which have been approved for consumption by AAF subscribers from the global eduGAIN metadata source
https://md.aaf.edu.au/aaf-edugain-export-metadata.xml – Containing AAF subscribed IdP and SP which have been approved for publishing to the global eduGAIN metadata source
To get started locate your Shibboleth SP configuration directory, generally /etc/shibboleth
Updates for Metadata
1. Edit the file shibboleth2.xml
2. Find the following within the MetadataProvider tag:
uri="Error! Hyperlink reference not valid."
(you might also have metadata.aaf.signed.minimal.xml or metadata.aaf.signed.xml in your URL these are all roughly equivalent and all need to use the same new URL below)
4. Save the file an exit
You should now restart your shibd daemon. When it comes back online it will be using the highly available sources for AAF metadata as we've configured above ensuring any chance of outage during maintenance windows or unscheduled outages of core AAF services such as Federation Registry are reduced to almost nil.
If you restart shibd, and your metadata is not updating, and you are seeing SSL related errors in shibd's logs, you may need to verify the certificate used to sign the metadata document. if you encounter any issues , you should log a support call with AAF support email@example.com to help you resolve the issue.