edugain-discuss AT lists.geant.org

Subject: An open discussion list for topics related to the eduGAIN interfederation service.

List archive

[eduGAIN-discuss] Interpretation of CoCo v2 metadata checks in eduGAIN

From: Alex Stuart <Alex.Stuart AT jisc.ac.uk>
To: "edugain-discuss AT lists.geant.org" <edugain-discuss AT lists.geant.org>, "edugain-assembly AT lists.geant.org" <edugain-assembly AT lists.geant.org>
Subject: [eduGAIN-discuss] Interpretation of CoCo v2 metadata checks in eduGAIN
Date: Wed, 5 Aug 2026 09:55:19 +0000
Accept-language: en-GB, en-US
Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=jisc.ac.uk; dmarc=pass action=none header.from=jisc.ac.uk; dkim=pass header.d=jisc.ac.uk; arc=none
Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=s4E5zkJ80vFfusTxpOhdBvqRP5VfHYSv8H88PBfxWBg=; b=am/ao5rGRmPJDknN82rnOaBHoVARM0ziqiiR/QUeCo3SNh3gnQGCEQ+kcM9+THPwtF2CPiahe/V2j0qszzROWk5SX/0hgoHIcyRJlUmDp5dw8flOALwMqjLSt2W2St8Wb69tkw642vGoK1xjeRaMkvdyr1a4fvLWVGCXXX1TddIHf8uPQBV6cHnkxjyxOhMGhcMg/87FH7pNibt51nQ7kaL8TADzSJ0yFqi4/F5b00JmA+YVvXMTkVxTHXKgd7HYudki3zrS17UHmllW4pme9Mjjx1od2tbZF64PMvVx+iPfoSaDkdRRt70Zpli8Mwj7uUZKOpWWDHwhqaWgMSnX2w==
Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HnwCekf9iHMMfKx7oMuPal4OEYKPJaR6Hj2wI3NQ3uFbubH+opZoySQroK1HwNYOukDmIaqFD6V0WpmHCFrg4w97Al/ged2wDb0ak6naMHwx6LLvNTHSzj5oGncV2aAMRVfF7Go05efwKe5+l8uepVoaRYHkkji6YtgC2HNtKjAiqGF4M1kXq2blYJytcn2Hx30pcCUOGFwkcyYqHo7veyjxGnm2zwlmrAjV5LaFsMUiv5k4vKJRHf60mHGe/H6M3w1Jk96vlOu6YsSIKuvrAJwPDa76eGy7yZNFZ1WkAO5ExHk4tFPXxa0w5fni0ETp8uTlaG6iNPyscNtrSHT2zg==
Authentication-results: mail.geant.org; dkim=pass (2048-bit key; unprotected) header.d=jisc.ac.uk header.i= AT jisc.ac.uk header.a=rsa-sha256 header.s=selector2 header.b=crQ1sk5j; dkim-atps=neutral
Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=jisc.ac.uk;
Msip_labels: MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_Enabled=True;MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_SiteId=48f9394d-8a14-4d27-82a6-f35f12361205;MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_SetDate=2026-08-05T09:54:48.3251291Z;MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_Name=Public;MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_ContentBits=0;MSIP_Label_628f3288-8b3e-408d-a4e1-b1f65b180f66_Method=Privileged

Dear colleagues in eduGAIN,

The eduGAIN Operations Team received a question about validation of the REFEDS Data Protection Code of Conduct (CoCo v2) [1]. The eduGAIN Metadata Distribution Service is one of the deployments which verifies that CoCo v2 has been asserted correctly, so we'd like to share our findings with the eduGAIN community.

Section 5.1 of the specification describes the requirements for MDUI and specifically 5.1.4 states "For all mdui elements, at least an English version of the element MUST be available, indicated by an xml:lang=”en” attribute".

The Operations Team note that 5.1.4 of CoCo v2 cannot be read in isolation. The mdui schema does not allow xml:lang elements on all mdui elements, for example mdui:IPHint, mdui:DomainHint and mdui:GeolocationHint are all defined as simple types in the schema. Therefore the "all" in 5.1.4 cannot literally mean "all" and must be constrained somehow.

We think that 5.1.4 should be interpreted as "For all mdui elements specified in section 5.1, at least an English version of the element MUST be available, indicated by an xml:lang=”en” attribute." Therefore the eduGAIN MDS will only check for the English variant on mdui:PrivacyStatementURL, mdui:DisplayName and mdui:Description. Maja added that change to the validators last week.

I'll note that this interpretation is consistent with the checking ruleset which Phil, Szeto and I introduced into the UK federation [2].

Regards,

Alex

[1] REFEDS Data Protection Code of Conduct Entity Category

https://refeds.org/category/code-of-conduct/v2

[2] UK federation checking ruleset for CoCo v2

https://github.com/ukf/ukf-meta/blob/master/mdx/_rules/check_coco_v2_ec.xsl

Alex Stuart (he/him)
T&I technical architect

+44 (0)300 300 2212
Jisc, 4 Portwall Lane, Bristol, BS1 6NB

Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

[eduGAIN-discuss] Interpretation of CoCo v2 metadata checks in eduGAIN, Alex Stuart, 08/05/2026