An open discussion list for topics related to the eduGAIN interfederation service.

[Thijs Kinkhorst <thijs.kinkhorst AT surf.nl>]

Hoi Peter,

Op 06-04-2021 om 16:23 schreef Peter Schober:
> In addition to the severe technical limitations of the MS
> implementation there's also the policy issue of the entityID values of
> Azure AD "tenant" IDPs:
> There is no know established/documented process that would allow an
> Azure AD "tenant" to demonstrate ownership (or the right to use) of an
> entityID of the form "https://sts.windows.net/<UUID>/", leading to the
> problem of potential IDP impersonation within eduGAIN.

Of course we have a policy to establish that an IdP we register is 
legitimate. I do not agree that this must and can only be established by 
in some way technically analysing the entityID itself.

Our procedures stipulate that any change to a production IdP can only be 
done when authorized by the registered SURFconext contact person at the 
instiution. They will have to confirm a whan new IdP is to be 
registered. Therefore you cannot register an Azure AD tenant for an 
institution you are not authoritative for.

Who is/are these authorized persons is in turn determined by the primary 
contact person (decision maker) of the institution to SURF, which 
utimately follows from the SURF membership contract. There are 
procedures in place within SURF to ensure these delegations of power are 
authorized.

Our approach is technlogy agnostic. eduGAIN does for example allow URN 
entityID's. They cannot be verified in DNS either.
In fact, I will argue that the approach of just looking at the DNS 
domain name is far from satisfactory for me. It would mean that the only 
power you need is to be able to create a DNS entry somewhere under the 
institution's domain. In big institutions, which also often have 
delegated subzones, this can usually be done by orders of magnitude more 
people than are authoritative about the Identity Provider.

But even then, we do also always require scopes to be set, which _are_ 
validated via whois to be owned by the registring institution.

I will admit that our MDRPS (which stems from 2012) is currently quite a 
high level documnet and a next revision could elaborate more on 
different aspects of our procedures.

> Some federations filter our such entities and therefore interoperation
> across eduGAIN is not at all ensured for these entities.

I have doubts that this is reasonable to do wholesale. The registering 
federation can be asked to clarify if there are doubts about its 
registration policy, or held accountable if there are concerns about a 
specific entity.

Kind regards,
Thijs