- feide-updates - lister.unit.no

Scheduled maintenance for Feide infrastructure Monday 16.01.23 at 16:00
by Morten Knutsen 16 Jan '23

16 Jan '23

We will be performing some infrastructure maintenance on Monday 16.01.23 from 16:00 to 17:00. The infrastructure hosts these services: * OpenID Connect services at https://auth.dataporten.no * APIs at https://api.dataporten.no and https://groups-api.dataporten.no * API Gatekeeper services for third party data sources at https://*.dataporten-api.no We don't expect any outages as a result of this work, though there might be shorter periods of instability. If you have any questions about this work, please contact us at kontakt(a)sikt.no Thanks, Morten Knutsen Sikt / Feide

1 1

Upcoming changes for auth.dataporten.no
by Arve Sellesbakk 25 Nov '22

25 Nov '22

Correction for production deployment date. The date for deployment is Friday 09.12.22 and not Thursday which was incorrectly mentioned in the original notification. Change notification for https://auth.dataporten.no<https://auth.dataporten.no/>. The described changes will be deployed to production on Thursday 09.12.22 at 13:00 /openid/userinfo: As part of our work to bring claims produced by openid/userinfo more in line with the claims contained in the ID token, custom claims not defined in the OpenID Connect standard will be prefixed with "https://n.feide.no/claims/". This will make custom claims better citizens in the ecosystem. - Claim “email_verified” will be set to false since Feide does not really verify email addresses in the user directories as such. - Claim “connect-userid_sec” is now marked as deprecated and will be phased out within 6 months. - Claim “dataporten-userid_sec” is now marked as deprecated, but the claim will not be phased out in the near future. - Claim "https://n.feide.no/claims/userid_sec" is added, and will replace the now deprecated “dataporten-userid_sec” in the future. - Introduction of new claim "https://n.feide.no/claims/eduPersonPrincipalName" that contains eduPersonPrincipalName(Full Feide name) for valid Feide users. - Introduction of new claim "https://n.feide.no/claims/nin" that contains the Norwegian national identity number (fødselsnummer) for users who logged in with ID-porten. /userinfo: This endpoint was implemented before OpenID Connect was standardized, and will be phased out within 6 months. Applications still using this endpoint should migrate to OpenID Connect /openid/userinfo as soon as possible. If you have any questions about the changes described above, please contact kontakt(a)sikt.no. Med vennlig hilsen Arve Sellesbakk SenioringeniørUtvikling Telefon: (+47) 458 62 536 [cid:748fef0c-7467-4b56-b84f-bfc7fc5f34e7] Sikt – Kunnskapssektorens tjenesteleverandør

1 0

Change of certificate provider
by Jon Kåre Hellan 24 Nov '22

24 Nov '22

At 19:00 on Thursday, November 24, we will change to certificates issued by Let's Encrypt for the Feide https endpoints api.dataporten.no, groups-api.dataporten.no and *.dataporten-api.no. Although we do not expect any disruption, please do not hesitate to contact support(a)sikt.no if you experience problems. Regards Jon Kåre Hellan, Sikt/Feide

2 2

Upcoming changes for auth.dataporten.no
by Arve Sellesbakk 24 Nov '22

24 Nov '22

Change notification for https://auth.dataporten.no. The described changes will be deployed to production on Thursday 09.12.22 at 13:00 /openid/userinfo: As part of our work to bring claims produced by openid/userinfo more in line with the claims contained in the ID token, custom claims not defined in the OpenID Connect standard will be prefixed with "https://n.feide.no/claims/". This will make custom claims better citizens in the ecosystem. - Claim “email_verified” will be set to false since Feide does not really verify email addresses in the user directories as such. - Claim “connect-userid_sec” is now marked as deprecated and will be phased out within 6 months. - Claim “dataporten-userid_sec” is now marked as deprecated, but the claim will not be phased out in the near future. - Claim "https://n.feide.no/claims/userid_sec" is added, and will replace the now deprecated “dataporten-userid_sec” in the future. - Introduction of new claim "https://n.feide.no/claims/eduPersonPrincipalName" that contains eduPersonPrincipalName(Full Feide name) for valid Feide users. - Introduction of new claim "https://n.feide.no/claims/nin" that contains the Norwegian national identity number (fødselsnummer) for users who logged in with ID-porten. /userinfo: This endpoint was implemented before OpenID Connect was standardized, and will be phased out within 6 months. Applications still using this endpoint should migrate to OpenID Connect /openid/userinfo as soon as possible. If you have any questions about the changes described above, please contact kontakt(a)sikt.no. Med vennlig hilsen Arve Sellesbakk SenioringeniørUtvikling Telefon: (+47) 458 62 536 [cid:4480ba86-7354-453d-a8ad-63a43a4e1d35] Sikt – Kunnskapssektorens tjenesteleverandør

1 0

Feide API Gatekeeper update
by Jon Kåre Hellan 23 Nov '22

23 Nov '22

On Tuesday, November 22, 2022, we will update the Feide API gatekeeper. API endpoints must be able to accept requests from the following new address ranges in addition to the existing ranges: - 2a05:d014:909:ad00::/56 - 2a05:d016:15b:5a00::/56 - 13.49.2.131 - 13.49.86.217 - 13.49.194.146 - 18.192.97.158 - 18.193.183.248 - 18.198.58.80 You can find the complete list of address ranges at https://docs.feide.no/service_providers/provide_and_protect_data/api_gateke… If you have any questions or concerns about this update, please contact us at kontakt(a)sikt.no. Jon Kåre Hellan, Sikt / Feide

1 2

Feide IdP update on Wednesday October 12th at 11:30
by Morten Knutsen 12 Okt '22

12 Okt '22

On Wednesday the 12th of October at 11:30 we will update the Feide login systems. Important: This update includes a change to prevent external sites from embedding the login page using iframes. This is done to improve security with regards to clickjacking attacks. Any services where more than 1% of logins have been done through embedding will continue to work as before for now. If you are relying on embedding the login page, please start work on alternate flows as soon as possible. Changes: * Send headers for login page to prevent embedding in iframes * Update of underlying SimpleSAMLphp library version * Minor bugfixes and internal improvements If you have any questions or concerns about this update, please contact us at kontakt(a)sikt.no. A side note: This message is sent via our new mailing list feide-updates(a)lister.sikt.no. All existing subscribers have been transfered. -- Regards, Morten Knutsen Sikt / Feide

1 1

Feide network update on Tuesday October 11th at 13:00
by Morten Knutsen 11 Okt '22

11 Okt '22

On Tuesday the 11th of October at 13:00 we will update the Feide login systems. All endpoints serving OpenID Connect authentication and APIs will get IPv6 addresses in addition to their existing IPv4 addresses. This includes the hosts: auth.dataporten.no api.dataporten.no The endpoints serving SAML authentication already have IPv6 addresses, and these will not change. If you have any questions or concerns about this update, please contact us at kontakt(a)sikt.no. -- Regards, Morten Knutsen Sikt / Feide

1 1

[Feide Updates] Feide IdP update Tuesday 05 July at 12:30
by Morten Knutsen 28 Jun '22

28 Jun '22

We will update the Feide login service on Tuesday 05 July at 12:30 with the following changes: * Option to show/hide password in login form * More translations * Improvements to the new organization selector in sorting and searching * Various internal bug fixes and improvements If you have any questions regarding this update, please contact kontakt(a)sikt.no Best Regards, Morten Knutsen Sikt

1 0

[Feide Updates] Feide maintenance Tuesday June 21st 20:00
by Morten Knutsen 21 Jun '22

21 Jun '22

We are adjusting the way we deploy updates to our OpenID Connect login systems, and we will need a short period of downtime to complete the transition. We have scheduled the work for Tuesday June 21st. The work will start at 20:00 CEST and will finish at 20:30 CEST. OpenID Connect login services will be unavailable for short periods within this time window. If you have any questions regarding this work, please contact kontakt(a)sikt.no -- Morten Knutsen Sikt / Feide

1 1

[Feide Updates] Upcoming change to Feide client credentials flow
by Jon Kåre Hellan 16 Mar '22

16 Mar '22

>From Monday, March 21, we are going to require that Feide services which use the OAuth/OpenID Connect client credentials flow are registered as “confidential” in the customer portal. It was an oversight that this wasn’t required previously. The handful of services which are affected has already been notified. Jon Kåre Hellan, Sikt

1 0