feide-updates

feide-updates@lister.sikt.no

129 discussions

[Feide Updates] Feide IdP update Tuesday 30th of June at 13:00
by Olav Morken 30 Jun '15

30 Jun '15

Hi, we will upgrade the version of the SimpleSAMLphp library that we use on the Feide IdP next week. We are deploying version 1.13.2. This update is currently deployed to our test system. There should not be any changes to the SAML messages that we send to the service provider as a result of this upgrade, however if you have a service provider connected to our test system, you are still encouraged to do a quick check to verify that both login and logout still works. (We are planning another update in a couple of weeks to get in preliminary support for version 1.6 of the norEduPerson schema, as well as new attributes for two-factor authentication.) Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP server restart Tuesday 11 May at 13:00
by Olav Morken 12 Mai '15

12 Mai '15

Hi, we are going to replace the https-certificates at the administration interfaces of our production servers tomorrow at 13:00. To activate the new certificates, the web server processes need to be restarted. The servers will be restarted one-by-one, so no downtime is required. The certificates replaced are on our administration interfaces. These are not interfaces accessed by anything than internal tools and for administration purposes, so the change is not visible to anything else. Best regards, Olav Morken UNINETT / Feide

1 1

Re: [Feide Updates] Updates to load balancers and performance testing on April 11
by Snorre Løvås 14 Apr '15

14 Apr '15

The switch to the new load balancers went well, and we are now running with those on the production system The subsequent performance testing went as expected. The short version is that there should not be any performance issues the coming semesters with the current setup and configuration. We have identified a some bottlenecks we would like to eliminate. Snorre On 07.04.15, 15.37, "Snorre Løvås" <snorre.lovas(a)uninett.no> wrote: >We will install new load balancers for the Feide production system on Saturday the 11th of April. The login service will run on our secondary system while we are working, so no end users should be affected. The new load balancers have been handling the test system for a month now. > >After the new load balancers are operational, we will run a series of performance tests before returning the login service to the production system. > >Usually, we run the performance tests up to a predefined level based on the number of logins per minute/second we expect in the coming period and with a considerable safety margin. In the performance test on Saturday, our intention is to test the limits of the current setup and look for potential bottlenecks. > > > >Snorre > >-- >Snorre Løvås >UNINETT / Feide > >

1 0

[Feide Updates] Updates to load balancers and performance testing on April 11
by Snorre Løvås 07 Apr '15

07 Apr '15

We will install new load balancers for the Feide production system on Saturday the 11th of April. The login service will run on our secondary system while we are working, so no end users should be affected. The new load balancers have been handling the test system for a month now. After the new load balancers are operational, we will run a series of performance tests before returning the login service to the production system. Usually, we run the performance tests up to a predefined level based on the number of logins per minute/second we expect in the coming period and with a considerable safety margin. In the performance test on Saturday, our intention is to test the limits of the current setup and look for potential bottlenecks. Snorre -- Snorre Løvås UNINETT / Feide

1 0

[Feide Updates] Feide IdP update Thursday 26th of March at 13:30
by Jaime Perez Crespo 26 Mar '15

26 Mar '15

Hi, We will deploy an IdP update on Thursday 26th of March at 13:30. This update provides several improvements, mostly related to two-factor authentication: * New SMS provider. This should alleviate a problem we have observed occasionally about excessively long delivery times. * Phone numbers are anonymized now when displayed through the two-factor authentication pages. * Disable autocompletion on the two-factor authentication input forms. * Support fully-compliant JWE tokens for use with Google Authenticator. * Better logging for two-factor authentication. This will allow us to debug issues more easily. * Other minor fixes and enhancements to the Feide code. This update has been running for a while in the testing infrastructure and no issues has been observed so far. Regards, -- Jaime Pérez UNINETT / Feide mail: jaime.perez(a)uninett.no xmpp: jaime(a)jabber.uninett.no "Two roads diverged in a wood, and I, I took the one less traveled by, and that has made all the difference." - Robert Frost

1 1

[Feide Updates] Feide load balancer change Tuesday 24 February at 14:00
by Olav Morken 09 Mar '15

09 Mar '15

Hi, as part of the process of replacing our current load balancer hardware, we will move our test system to new load balancers Tuesday 24 February at 14:00. Moving the test system to the new load balancers requires a configuration change on our existing load balancers, which is also hosting our production system. However, we do not expect the removal of the test system from the load balancers to have any effect on the production system. Once we have run our test system on the new load balancers for a while, we will transition the production system to the new load balancers as well. We will send a separate notification about that change when we decide on a time for moving the production system. Best regards, Olav Morken UNINETT / Feide

1 3

[Feide Updates] Feide IdP certificate change Thursday 22 January at 14:00
by Olav Morken 18 Feb '15

18 Feb '15

Hi, the Feide IdP certificate expire Friday 20 February, so we have ordered and received new certificates. The new certificates will be installed Thursdag 22 January at 14:00. The largest change with the new certificates is that they are signed using SHA-2 signatures. This should be supported by all major browsers, so we do not expect any problems with that change. Best regards, Olav Morken UNINETT / Feide

1 5

[Feide Updates] Feide IdP reboot between 10:00 and 12:00 today
by Olav Morken 12 Feb '15

12 Feb '15

Hi, due to a recently disclosed vulnerability in glibc, we will be rebooting the Feide production servers between 10:00 and 12:00 today. We are not aware of any applications on the login servers that are vulnerable to the issue, but to be certain the servers will be rebooted. Since the servers will be rebooted one-by-one, the reboots will not directly affect user logins. However, because all Feide session data is stored in-memory, user who have logged in before we the reboot will lose their single-signon session and must enter their username and password the next time they access the Feide login page. For more information about the vulnerability, see the following article at Ars Technica: http://arstechnica.com/security/2015/01/highly-critical-ghost-allowing-code… Best regards, Olav Morken UNINETT / Feide

1 3

[Feide Updates] Feide consent database reboot at 21:00 this evening (Wednesday 28 January)
by Olav Morken 29 Jan '15

29 Jan '15

Hi, like our IdPs, the Feide consent database needs to be rebooted to install a the security update. Since these servers aren't exposed directly to the Internet, the update is less urgent, and has been scheduled for 21:00 this evening. During the reboot, users will have to give consent for every service they access through Feide, but other than that, this shouldn't have any user-visible impact. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP update Thursday 15 January at 14:00
by Olav Morken 15 Jan '15

15 Jan '15

Hi, we will deploy a new IdP update Thursday 15 January at 14:00. The changes since the previous update in November are: - Add a new encrypted Google Authenticator twofactor method. This allows the Google Authenticator secret to be stored encrypted in the user directory. (The old "gatest" method will still work, but will be removed in the future.) - Ensure that the userPassword attribute (which may contain the hashed password of the user) never shows up on https://innsyn.feide.no/ . - Log a _very_ truncated hash of the password, to make it easier to tell if a bunch of failed logins are an attempt at brute forcing the password or if it is a browser failure. The logged hash isn't enough to determine the password (too many passwords will share the same value), but it allows us to see if more than one password was attempted. - Include more information about the original cause of the error in the case of authentication errors. E.g. the LDAP error we got when authenticating with the system user. - Various small twofactor cleanups & fixes: - Fix translation for twofactor SMS web pages. - Fix autofocus on twofactor input fields. - Some more debug logging and statistics wrt. twofactor use. - Consistently redirect on the twofactor-pages, to make sure the language selectors are always present. - Simplify code to make API calls to twofactor SMS providers. - Some code cleanup of the twofactor code. Best regards, Olav Morken UNINETT / Feide

1 1

← Newer
1
...
5
6
7
8
9
10
11
12
13
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

feide-updates