Januar 2015 - feide-updates

[Feide Updates] Feide IdP certificate change Thursday 22 January at 14:00
by Olav Morken 18 Feb '15

18 Feb '15

Hi, the Feide IdP certificate expire Friday 20 February, so we have ordered and received new certificates. The new certificates will be installed Thursdag 22 January at 14:00. The largest change with the new certificates is that they are signed using SHA-2 signatures. This should be supported by all major browsers, so we do not expect any problems with that change. Best regards, Olav Morken UNINETT / Feide

1 5

[Feide Updates] Feide IdP reboot between 10:00 and 12:00 today
by Olav Morken 12 Feb '15

12 Feb '15

Hi, due to a recently disclosed vulnerability in glibc, we will be rebooting the Feide production servers between 10:00 and 12:00 today. We are not aware of any applications on the login servers that are vulnerable to the issue, but to be certain the servers will be rebooted. Since the servers will be rebooted one-by-one, the reboots will not directly affect user logins. However, because all Feide session data is stored in-memory, user who have logged in before we the reboot will lose their single-signon session and must enter their username and password the next time they access the Feide login page. For more information about the vulnerability, see the following article at Ars Technica: http://arstechnica.com/security/2015/01/highly-critical-ghost-allowing-code… Best regards, Olav Morken UNINETT / Feide

1 3

[Feide Updates] Feide consent database reboot at 21:00 this evening (Wednesday 28 January)
by Olav Morken 29 Jan '15

29 Jan '15

Hi, like our IdPs, the Feide consent database needs to be rebooted to install a the security update. Since these servers aren't exposed directly to the Internet, the update is less urgent, and has been scheduled for 21:00 this evening. During the reboot, users will have to give consent for every service they access through Feide, but other than that, this shouldn't have any user-visible impact. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP update Thursday 15 January at 14:00
by Olav Morken 15 Jan '15

15 Jan '15

Hi, we will deploy a new IdP update Thursday 15 January at 14:00. The changes since the previous update in November are: - Add a new encrypted Google Authenticator twofactor method. This allows the Google Authenticator secret to be stored encrypted in the user directory. (The old "gatest" method will still work, but will be removed in the future.) - Ensure that the userPassword attribute (which may contain the hashed password of the user) never shows up on https://innsyn.feide.no/ . - Log a _very_ truncated hash of the password, to make it easier to tell if a bunch of failed logins are an attempt at brute forcing the password or if it is a browser failure. The logged hash isn't enough to determine the password (too many passwords will share the same value), but it allows us to see if more than one password was attempted. - Include more information about the original cause of the error in the case of authentication errors. E.g. the LDAP error we got when authenticating with the system user. - Various small twofactor cleanups & fixes: - Fix translation for twofactor SMS web pages. - Fix autofocus on twofactor input fields. - Some more debug logging and statistics wrt. twofactor use. - Consistently redirect on the twofactor-pages, to make sure the language selectors are always present. - Simplify code to make API calls to twofactor SMS providers. - Some code cleanup of the twofactor code. Best regards, Olav Morken UNINETT / Feide

1 1