Metadata Registration Practice Statement for Feide
Version 1.0.2, last edited November 5th 2021.
Practices on Identity Provider Registration
Feide operates a single Identity Provider on behalf of educational and research institutions in Norway. The Feide operational team manually maintains the metadata entry for this Identity Provider.
Users of the Feide Identity Provider select which institution to login on during the login process. Feide operates a opt-in model for institutions, where the institution must explicitly agree to accept eduGAIN connectivity before users are allowed to login through a given institution for any Service Provider within eduGAIN.
Before new institutions are connected to the eduGAIN through Feide Identity Provider, the following requirements must be fulfilled:
Institution sends a request to join Feide.
Institution fills out a registration form on the technical connectivity, user storage and user registration practices.
Feide validates the gather information, and may inspect the user storage to review if requirements are fulfilled, before accepting the institution to be connected.
Institution explicitly requests to connect to eduGAIN services through the Feide Customer Portal.
Practices on Service Provider Registration
Feide will only expose Service Providers to eduGAIN that are official services connected to the Feide federation production environment.
For a Service Provider to join the Feide federation, the following requirements must be met:
The Service provider must accept the terms and conditions in customer portal in order to publish a service.
The Service Provider must perform a technical test using the Feide Test Environment.
The Service Provider must fill out a registration form with necessary information about the service, including contact persons and attribute requirements.
The Service Provider provides SAML metadata to Feide.
Feide validates the provider information, including the attribute requirements, before accepting the Service Provider into the production environment.
Before the Service Provider is exposed to eduGAIN, the Service Provider also must fulfill these requirements:
The Service Provider must explicitly request to connect to eduGAIN through Feide.
Feide makes a sanity check that the setup is technically sound, and that the Service Provider consumes the eduGAIN metadata.
The metadata provided by the Service Provider will be manually processed by the Feide operational team, before being re-published through eduGAIN. For the Service Provider to make updates to the metadata entry, it must contact the Feide Helpdesk.
Feide Metadata Aggregate
Feide maintains an aggregate of all metadata it exposes to eduGAIN:
The metadata document signature can be validated using the following X.509 certificate:
-----BEGIN CERTIFICATE----- MIIEaDCCA1CgAwIBAgIJAIqK28Ft/k4fMA0GCSqGSIb3DQEBBQUAMH8xCzAJBgNV BAYTAk5PMRIwEAYDVQQIEwlUcm9uZGhlaW0xEjAQBgNVBAcTCVRyb25kaGVpbTEQ MA4GA1UEChMHVU5JTkVUVDEOMAwGA1UECxMFRmVpZGUxJjAkBgNVBAMTHW1ldGFk YXRhLXNpZ25pbmcta2V5LmZlaWRlLm5vMB4XDTExMDUwNTA2MTM0MVoXDTIxMDUw NDA2MTM0MVowfzELMAkGA1UEBhMCTk8xEjAQBgNVBAgTCVRyb25kaGVpbTESMBAG A1UEBxMJVHJvbmRoZWltMRAwDgYDVQQKEwdVTklORVRUMQ4wDAYDVQQLEwVGZWlk ZTEmMCQGA1UEAxMdbWV0YWRhdGEtc2lnbmluZy1rZXkuZmVpZGUubm8wggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCcKU4nXnyAnpV1ze7gPstxWOiG9CnC lT40n6ahOQNzp/RVhSHvr44YU5+hjKUYyEDKIfth94d3Zso/ytDieVcTaMKlvJLC rormiVIlcg/yQiXyAJSppScich/m1shUuOSiCWuO9wYF6IkIFXTT+kCTi8++s+iW XG8brorsyiTW5ztU4PUZ+ZyrWowbKl6DMybI5C9djbkgqeRgbJeTen8JGASS0Ezp YmuyHgmvy69X0cMr5a6fY2/f+bApiP/oPjr4AuoSASka4QQ8Fn0zWQfcIGAX+1iQ nbkpzaurz5YRfB06PjPrpYpobJ011tDrJqggxLxPB4AqZSSW1pCLI8DvAgMBAAGj geYwgeMwHQYDVR0OBBYEFAaysDNeH7PDb9Qoq7Jdm3D9gKbcMIGzBgNVHSMEgasw gaiAFAaysDNeH7PDb9Qoq7Jdm3D9gKbcoYGEpIGBMH8xCzAJBgNVBAYTAk5PMRIw EAYDVQQIEwlUcm9uZGhlaW0xEjAQBgNVBAcTCVRyb25kaGVpbTEQMA4GA1UEChMH VU5JTkVUVDEOMAwGA1UECxMFRmVpZGUxJjAkBgNVBAMTHW1ldGFkYXRhLXNpZ25p bmcta2V5LmZlaWRlLm5vggkAiorbwW3+Th8wDAYDVR0TBAUwAwEB/zANBgkqhkiG 9w0BAQUFAAOCAQEANcTJpNAeWg5R4PBBVvwNjCcpTCaMqpAXgNJMSCLIQrBHAQuT M/3dMJeUzo303erIpOsX9gJdhvKq/Ii8hF4/+J7aQZMg1E9yLU5P6/zUqS22vpAe DfVyIe38gTS3u67m3wSVjfp0THqIS7y6m+ID3KpeKFtdo1rSLFQBch/l+NivfIoU VVEZWWGHtxMSC9PM+x655f29wxVyAe74c+585nM62FUCUXGtli1B81GU2i/g7ADa Bv6Pp8GAajBToziaxSSsB0hmn6z0dxW1QsDlBKwPGr4e6BdRqnzqpUu5UPPVj4Z3 kUuV9JExHe7FRwcfxWcy3jyPpm2AUJmrHtYDFw== -----END CERTIFICATE-----