feide-updates

feide-updates@lister.sikt.no

128 discussions

Feide IdP update Tuesday 20.02 at 19:30
by Morten Knutsen 22 Feb '24

22 Feb '24

We will be updating the Feide IdP at idp.feide.no Tuesday 20.02 at 19:30. The update includes will invalidate any existing sessions, meaning that users might need to reauthenticate. If you have any questions regarding this update, we can be reached at kontakt(a)sikt.no. Best Regards, Morten Knutsen Sikt / Feide

2 3

Migration of Feide SAML service Tuesday 16 January at 18:00
by Olav Morken 16 Jan '24

16 Jan '24

Hi, we are going to migrate the Feide SAML service to the same platform as our other services. We will perform this change Tuesday 16 January at 18:00. This change affects our SAML login service, running at idp.feide.no. When we make the change, existing sessions for users will be interrupted, so users will have to log in again. A few users will also receive the information screen about attribute transfer to services again after the migration. Other than this, the change will not have any user visible impact. As a result of this change, the IP addresses of idp.feide.no will change to the following IP addresses: * 13.48.34.249 * 13.49.91.81 * 13.49.105.9 * 2a05:d016:15b:5a06:1e46:c4a8:af23:9ff5 * 2a05:d016:15b:5a07:769e:3dc3:91e8:1746 * 2a05:d016:15b:5a08:119a:4e53:5a88:5785 If you have any firewalls that restrict outgoing connections, you may have to update them to allow connections to the new IP addresses. This change also removes support for an old TLS cipher: * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 This cipher is used by some old versions of Safari. It is already disabled for services logging in using OpenID connect, so this change should not affect many users. The IP addresses that Feide uses to contact the LDAP servers at the organizations as part of the login process will change, but the new IP addresses are already in use for other parts of Feide. All organizations already allow access from the new IP addresses. The issuer of the certificate for idp.feide.no will change. The current certificate is issued by Sectigo, while the new certificate will be issued by Let's Encrypt. If you have any questions or concerns wrt. this change, please contact us at: kontakt(a)sikt.no Best regards, Olav Morken Sikt / Feide

1 1

Feide IdP update on Thursday March 23rd at 13:00
by Morten Knutsen 23 Mar '23

23 Mar '23

On Thursday the 23rd of March at 13:00 we will update the Feide login systems. Changes: * Code changes to support upcoming test of Ansattporten login * Code changes to support upcoming needs of LUMI/MyAccessID * Minor bugfixes and internal improvements If you have any questions or concerns about this update, please contact us at kontakt(a)sikt.no and refer to change #350896. -- Regards, Morten Knutsen Sikt / Feide

1 1

Scheduled maintenance for Feide infrastructure Monday 06.03.23 at 16:00
by Morten Knutsen 06 Mar '23

06 Mar '23

We will be performing some infrastructure maintenance on Monday 06.03.23 from 16:00 to 17:00. The infrastructure hosts these services: * OpenID Connect services at https://auth.dataporten.no * APIs at https://api.dataporten.no and https://groups-api.dataporten.no * API Gatekeeper services for third party data sources at https://*.dataporten-api.no We don't expect any outages as a result of this work, though there may be shorter periods of instability. If you have any questions about this work, please contact us at kontakt(a)sikt.no and refer to change #348195. Thanks, Morten Knutsen Sikt / Feide

1 1

Change to the OpenID Connect userinfo endpoint response Tuesday 14th 12:30 CET
by Morten Knutsen 14 Feb '23

14 Feb '23

On Tuesday the 14th at 12:30 CET we will be deploying a change adding a "aud" claim containing the client id to the response from the OpenID Connect userinfo endpoint. This should not impact any services. The change is made primarily to ease migration from the old, deprecated userinfo endpoint. Example userinfo response before the change: { "sub": "76a7a061-3c55-430d-8ee0-6f82ec42501f", "dataporten-userid_sec": [ "feide:andreas@uninett.no" ], "https://n.feide.no/claims/userid_sec": [ "feide:andreas@uninett.no" ], "https://n.feide.no/claims/eduPersonPrincipalName": "andreas(a)uninett.no", "name": "Andreas \u00c5kre Solberg", "email": "andreas.solberg(a)uninett.no", "email_verified": false, "picture": "https://api.dataporten.no/userinfo/v1/user/media/p:a3019954-902f-45a3-b4ee-…" } Example userinfo response after the change, containing an "aud" claim with the client id: { "aud": "5578630b-cb54-4da4-8f15-eedaa8ec46c5", "sub": "76a7a061-3c55-430d-8ee0-6f82ec42501f", "dataporten-userid_sec": [ "feide:andreas@uninett.no" ], "https://n.feide.no/claims/userid_sec": [ "feide:andreas@uninett.no" ], "https://n.feide.no/claims/eduPersonPrincipalName": "andreas(a)uninett.no", "name": "Andreas \u00c5kre Solberg", "email": "andreas.solberg(a)uninett.no", "email_verified": false, "picture": "https://api.dataporten.no/userinfo/v1/user/media/p:a3019954-902f-45a3-b4ee-…" } If you have any questions about this change, please contact kontakt(a)sikt.no and refer to change #346136. -- Regards, Morten Knutsen Sikt / Feide

1 1

Scheduled maintenance for Feide infrastructure Monday 16.01.23 at 16:00
by Morten Knutsen 16 Jan '23

16 Jan '23

We will be performing some infrastructure maintenance on Monday 16.01.23 from 16:00 to 17:00. The infrastructure hosts these services: * OpenID Connect services at https://auth.dataporten.no * APIs at https://api.dataporten.no and https://groups-api.dataporten.no * API Gatekeeper services for third party data sources at https://*.dataporten-api.no We don't expect any outages as a result of this work, though there might be shorter periods of instability. If you have any questions about this work, please contact us at kontakt(a)sikt.no Thanks, Morten Knutsen Sikt / Feide

1 1

Upcoming changes for auth.dataporten.no
by Arve Sellesbakk 25 Nov '22

25 Nov '22

Correction for production deployment date. The date for deployment is Friday 09.12.22 and not Thursday which was incorrectly mentioned in the original notification. Change notification for https://auth.dataporten.no<https://auth.dataporten.no/>. The described changes will be deployed to production on Thursday 09.12.22 at 13:00 /openid/userinfo: As part of our work to bring claims produced by openid/userinfo more in line with the claims contained in the ID token, custom claims not defined in the OpenID Connect standard will be prefixed with "https://n.feide.no/claims/". This will make custom claims better citizens in the ecosystem. - Claim “email_verified” will be set to false since Feide does not really verify email addresses in the user directories as such. - Claim “connect-userid_sec” is now marked as deprecated and will be phased out within 6 months. - Claim “dataporten-userid_sec” is now marked as deprecated, but the claim will not be phased out in the near future. - Claim "https://n.feide.no/claims/userid_sec" is added, and will replace the now deprecated “dataporten-userid_sec” in the future. - Introduction of new claim "https://n.feide.no/claims/eduPersonPrincipalName" that contains eduPersonPrincipalName(Full Feide name) for valid Feide users. - Introduction of new claim "https://n.feide.no/claims/nin" that contains the Norwegian national identity number (fødselsnummer) for users who logged in with ID-porten. /userinfo: This endpoint was implemented before OpenID Connect was standardized, and will be phased out within 6 months. Applications still using this endpoint should migrate to OpenID Connect /openid/userinfo as soon as possible. If you have any questions about the changes described above, please contact kontakt(a)sikt.no. Med vennlig hilsen Arve Sellesbakk SenioringeniørUtvikling Telefon: (+47) 458 62 536 [cid:748fef0c-7467-4b56-b84f-bfc7fc5f34e7] Sikt – Kunnskapssektorens tjenesteleverandør

1 0

Change of certificate provider
by Jon Kåre Hellan 24 Nov '22

24 Nov '22

At 19:00 on Thursday, November 24, we will change to certificates issued by Let's Encrypt for the Feide https endpoints api.dataporten.no, groups-api.dataporten.no and *.dataporten-api.no. Although we do not expect any disruption, please do not hesitate to contact support(a)sikt.no if you experience problems. Regards Jon Kåre Hellan, Sikt/Feide

2 2

Upcoming changes for auth.dataporten.no
by Arve Sellesbakk 24 Nov '22

24 Nov '22

Change notification for https://auth.dataporten.no. The described changes will be deployed to production on Thursday 09.12.22 at 13:00 /openid/userinfo: As part of our work to bring claims produced by openid/userinfo more in line with the claims contained in the ID token, custom claims not defined in the OpenID Connect standard will be prefixed with "https://n.feide.no/claims/". This will make custom claims better citizens in the ecosystem. - Claim “email_verified” will be set to false since Feide does not really verify email addresses in the user directories as such. - Claim “connect-userid_sec” is now marked as deprecated and will be phased out within 6 months. - Claim “dataporten-userid_sec” is now marked as deprecated, but the claim will not be phased out in the near future. - Claim "https://n.feide.no/claims/userid_sec" is added, and will replace the now deprecated “dataporten-userid_sec” in the future. - Introduction of new claim "https://n.feide.no/claims/eduPersonPrincipalName" that contains eduPersonPrincipalName(Full Feide name) for valid Feide users. - Introduction of new claim "https://n.feide.no/claims/nin" that contains the Norwegian national identity number (fødselsnummer) for users who logged in with ID-porten. /userinfo: This endpoint was implemented before OpenID Connect was standardized, and will be phased out within 6 months. Applications still using this endpoint should migrate to OpenID Connect /openid/userinfo as soon as possible. If you have any questions about the changes described above, please contact kontakt(a)sikt.no. Med vennlig hilsen Arve Sellesbakk SenioringeniørUtvikling Telefon: (+47) 458 62 536 [cid:4480ba86-7354-453d-a8ad-63a43a4e1d35] Sikt – Kunnskapssektorens tjenesteleverandør

1 0

Feide API Gatekeeper update
by Jon Kåre Hellan 23 Nov '22

23 Nov '22

On Tuesday, November 22, 2022, we will update the Feide API gatekeeper. API endpoints must be able to accept requests from the following new address ranges in addition to the existing ranges: - 2a05:d014:909:ad00::/56 - 2a05:d016:15b:5a00::/56 - 13.49.2.131 - 13.49.86.217 - 13.49.194.146 - 18.192.97.158 - 18.193.183.248 - 18.198.58.80 You can find the complete list of address ranges at https://docs.feide.no/service_providers/provide_and_protect_data/api_gateke… If you have any questions or concerns about this update, please contact us at kontakt(a)sikt.no. Jon Kåre Hellan, Sikt / Feide

1 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

feide-updates