Requirements for SAML2 Identity Providers v20160916 (Draft)

The following describes the technical and administrative checks that will be made before an identity provider is admitted into the SAFIRE federation within the SAML2 Technology Profile. It also serves as a checklist for identity provider operators for assessing their readiness to participate.

Metadata

  • MUST1 have an entityID that is a URL (well-known location). The URL SHOULD use the https scheme and it is RECOMMENDED that valid metadata be available at this URL.

  • MUST use secure (https) end-points for any <md:SingleSignOnService> or <md:SingleLogoutService>.

  • MUST contain shibmd:Scope elements detailing every possible scoping value (domain) for eduPersonPrincipalName and mail. These MUST NOT be regular expressions. All scopes MUST be valid DNS domain names and those domains MUST be owned by the organisation (or have written confirmation from the domain owner).

  • MUST contain an <md:Organization> element, where:

    • <md:OrganizationName> MUST reflect the legal name of the juristic person.

    • <md:OrganizationDisplayName> MAY reflect a commonly known or shortened version of the organisation’s name.

    • <md:OrganizationURL> SHOULD contain the organisation’s web site address.

  • MUST contain at least one <md:ContactPerson> of contactType=“technical” and SHOULD contain one of contactType=“support”. Where md:EmailAddress is given this SHOULD be a role account rather than an individual.

  • SHOULD contain an <mdui:UIInfo>, with at least the following elements set:

    • <mdui:DisplayName> — meaningful name for the identity provider.

    • <mdui:Description> — short (max 140 chars) description of the purpose.

  • It is RECOMMENDED that <mdui:PrivacyStatementURL> be set and point at the organisation’s privacy policy. This MAY be required in future.

  • It is RECOMMENDED that a <mdui:Logo> be provided. Any logo MUST be served from a secure (https) server. Logos SHOULD have an aspect ratio as close to 1:1 as possible and SHOULD be at least 100x100 pixels (although it can be larger).

  • SHOULD NOT contain a <mdrpi:RegistrationInfo> element (any existing one SHALL be removed by the federation aggregator).

  • SAML certificates included in metadata SHOULD be self-signed.

  • Web server certificates used for end-points MUST use PKI that is reasonably likely to be embedded in the browser of all users of the identity provider. Unless an explanation is provided, these SHALL be tested against the root CA lists of common browsers.

Technical

  • Clocks MUST must be synchronised via the Network Time Protocol (NTP; SNTP) or equivalent such that they ultimately derive their time from the South African master clock maintained by National Metrology Institute of South Africa or an acceptable alternative (e.g. za.pool.ntp.org).

  • Logs of successful authentications MUST be retained for at least 184 days.

  • Federation metadata SHOULD be refreshed at least once per day and MUST be refreshed at least once per cacheDuration.

Administrative

  • Participants that are not already signatories of the REN Service Agreement MUST provide documentary proof of legal name, by means of one of the following:

    • CIPC registration certificate;

    • Trust deed;

    • SARS tax clearance certificate;

    • NPO registration; OR

    • Any other mutually acceptable means.

  • Participants MUST have signed a Participation Agreement.

  • Written permission MUST be provided for the use domains in <shibmd:Scope> if not verifiable by whois.

  • Each entity must be accompanied by a separate registration request form, including:

  • Only one <md:IDPSSODescriptor> per juristic person will be registered.

1 The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

South African Identity Federation