- feide-updates - lister.unit.no

[Feide Updates] Feide IdP certificate change Thursday 22 January at 14:00
by Olav Morken 18 Feb '15

18 Feb '15

Hi, the Feide IdP certificate expire Friday 20 February, so we have ordered and received new certificates. The new certificates will be installed Thursdag 22 January at 14:00. The largest change with the new certificates is that they are signed using SHA-2 signatures. This should be supported by all major browsers, so we do not expect any problems with that change. Best regards, Olav Morken UNINETT / Feide

1 5

[Feide Updates] Feide IdP reboot between 10:00 and 12:00 today
by Olav Morken 12 Feb '15

12 Feb '15

Hi, due to a recently disclosed vulnerability in glibc, we will be rebooting the Feide production servers between 10:00 and 12:00 today. We are not aware of any applications on the login servers that are vulnerable to the issue, but to be certain the servers will be rebooted. Since the servers will be rebooted one-by-one, the reboots will not directly affect user logins. However, because all Feide session data is stored in-memory, user who have logged in before we the reboot will lose their single-signon session and must enter their username and password the next time they access the Feide login page. For more information about the vulnerability, see the following article at Ars Technica: http://arstechnica.com/security/2015/01/highly-critical-ghost-allowing-code… Best regards, Olav Morken UNINETT / Feide

1 3

[Feide Updates] Feide consent database reboot at 21:00 this evening (Wednesday 28 January)
by Olav Morken 29 Jan '15

29 Jan '15

Hi, like our IdPs, the Feide consent database needs to be rebooted to install a the security update. Since these servers aren't exposed directly to the Internet, the update is less urgent, and has been scheduled for 21:00 this evening. During the reboot, users will have to give consent for every service they access through Feide, but other than that, this shouldn't have any user-visible impact. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP update Thursday 15 January at 14:00
by Olav Morken 15 Jan '15

15 Jan '15

Hi, we will deploy a new IdP update Thursday 15 January at 14:00. The changes since the previous update in November are: - Add a new encrypted Google Authenticator twofactor method. This allows the Google Authenticator secret to be stored encrypted in the user directory. (The old "gatest" method will still work, but will be removed in the future.) - Ensure that the userPassword attribute (which may contain the hashed password of the user) never shows up on https://innsyn.feide.no/ . - Log a _very_ truncated hash of the password, to make it easier to tell if a bunch of failed logins are an attempt at brute forcing the password or if it is a browser failure. The logged hash isn't enough to determine the password (too many passwords will share the same value), but it allows us to see if more than one password was attempted. - Include more information about the original cause of the error in the case of authentication errors. E.g. the LDAP error we got when authenticating with the system user. - Various small twofactor cleanups & fixes: - Fix translation for twofactor SMS web pages. - Fix autofocus on twofactor input fields. - Some more debug logging and statistics wrt. twofactor use. - Consistently redirect on the twofactor-pages, to make sure the language selectors are always present. - Simplify code to make API calls to twofactor SMS providers. - Some code cleanup of the twofactor code. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP update Thursday 6 November at 13:30
by Olav Morken 06 Nov '14

06 Nov '14

Hi, we will deploy a IdP update Thursday 6 November at 13:30. This update contains a few small fixes: * Adjust the text of the SMS messages sent for twofactor authentication. * Change button order for SMS twofactor page to put the buttons in the most common order expected by users. * Clearer error message to the end user when the login fails due to an error in the user directory. * Add eduPersonOrgUnitDN:norEduOrgAcronym as a attribute that can be displayed on https://innsyn.feide.no/ . * Fix a bug triggering a warning in log files. (The bug didn't affect end users, it only triggered a warning in the log.) The update also adds the HTTP user agent to statistics events generated during login, which will allow us to more easily generate up-to-date statistics on browser usage. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Deactivation of SSL 3.0 in Feide
by Olav Morken 16 Okt '14

16 Okt '14

Hi, a bit before 11:00 today, we deactivated SSL version 3.0 in Feide. This was done to mitigate the "POODLE" attack against SSL 3.0 that was announced yesterday. Since almost nobody uses browsers that are so old that they do not support newer protocols, we do not expect many users to be affected by this change. For those that are affected, the solution is to switch to a more modern browser. See the following announcement (in Norwegian) for more information: https://www.feide.no/nyhet/deaktivering-av-ssl-30-i-feide Best regards, Olav Morken UNINETT / Feide

1 0

[Feide Updates] Feide IdP update Tuesday 16 September at 13:30
by Olav Morken 16 Sep '14

16 Sep '14

Hi, we will deploy a IdP update Tuesday 16 September at 13:30. This update contains several minor fixes and improvements to the Feide IdP. It does not alter the messages sent from the Feide IdP in any way. Changes in this release: * Make sure that the user makes an active choice of home organization on the page where they choose the home organization. This is done by removing the default choice of home organization, so that the user cannot continue unless they make a choice. This should hopefully reduce cases where users just click "continue" and end up contacting the user support for whatever organization happened to be the default when the login fails. * Add a link to the page with support addresses for all user home organizations connected to Feide to the page where the user chooses their home organization. This should give users a place to look if they can't find their home organization. * Increase the threshold for showing the "too short interval" page. Due to prefetching in browsers, this page may sometimes be shown without there being an actual error in the SP. We now allow three logins for the same user to the same SP in a 10 second window before we display that error. * Also improve the text on the that page, so that it is clearer that it is a sort of redirect loop between the service provider and Feide. * Hide the national identity number on https://innsyn.feide.no/ , like we already do for the consent page. The user will now have to click a link before the national identity number is shown. * More statistics data for uses of the organization preselection handler. * A slightly better Feide logo in the "more information" section on the login page. * Add the new hot-standby backup hosts to the configuration files, to make it possible to execute various monitoring commands from those hosts (e.g. firewall checks, so that we can make sure that host organizations allow connections from those hosts to their user directories.) The update has been running on the test system since Monday 8 September. Best regards, Olav Morken UNINETT / Feide

1 1

[Feide Updates] Feide IdP update Tuesday 2. September at 13:00
by Snorre Løvås 02 Sep '14

02 Sep '14

Hi, We will deploy an IdP update Tuesday September 2nd at 13:00. The main change in this update is preparation for twofactor authentication in Feide and it¹s pilot project. https://www.feide.no/nyhet/pilot-feide-p%C3%A5logging-med-h%C3%B8yere-sikke rhet Regards, Snorre -- Snorre Løvås UNINETT / Feide

2 1

[Feide Updates] Feide performance test Thursday 10 July
by Olav Morken 08 Jul '14

08 Jul '14

Hi, we will be running some light performance tests against the Feide production system on Thursday. The performance tests will not be very intensive, so they should not affect people logging into the production system. Best regards, Olav Morken UNINETT / Feide

1 0

[Feide Updates] Feide IdP update Tuesday 8 July at 14:00
by Olav Morken 08 Jul '14

08 Jul '14

Hi, we will deploy a IdP update Tuesday 8 July at 14:00. This update removes the old signing key and certificates from the Feide IdP. We are currently signing all messages sent from the IdP using the new key & certificate, so this change doesn't actually directly affect any SPs. The removal of the old key & certificate means that they no longer show up in the metadata for Feide, but that shouln't have any effect on SPs connected to Feide. In addition to removing the old key & certificate, we also do a few minor updates to the IdP software: * Ignore whitespace in the beginning or end of the username. * Update the UNINETT-logo to the new logo. * Update the LDAP validator / error logger to accept "-" as a valid character in domain names, and fix logging of some whitespace errors so that they are only reported once. Best regards, Olav Morken UNINETT / Feide

1 1