Copenhagen, Monday, November 26, 2012

Metadata Registration Practice Statement
Version 1.0.0
WAYF operates a hub and spoke federation in Denmark. The WAYF operational team maintains themetadata for the federation hub.
This document describes the registration practices for both Identity Providers and Service Providers, aswell as information on metadata aggregation for eduGAIN.

Identity Provider Practices
Identity Provider Registration Practices
WAYF serves public organizations, e.g.:•••••••••

Universities
University Colleges
Upper secondary schools
Public schools
Research institutesLibraries
Governmental agencies and departments
Danish healthcare regions
Municipalities and other local authorities

For an Identity Provider to join WAYF, the following requirements must be met:••••

The Identity Providers must sign a “Data processor contract” with WAYF.
The Identity Providers must deliver a description of their identity management practices, whichmust as a minimum comply with national Danish it-security requirements.
The Identity Provider must provide technical and administrative contact information.
The Identity Providers must have passed technical integration to WAYF.

Identity Provider Registration Practices for eduGAIN
All Identity Providers connected to WAYF are automatically included in eduGAIN, cf. the “Data processoragreement” between WAYF and the Identity Provider.
There are no additional eduGAIN practices for Identity Providers.

Service Provider Practices
Service Provider Registration Practices
For a Service Provider to join WAYF, the following requirements must be met:•••••

The Service Provider must sign the WAYF Service Provider contract.
The Service Provider must provide WAYF with a description of the service.
The Service Provider must provide technical and administrative contact information.
The Service Provider must agree with WAYF about which attributes are released.
The Service Providers must have passed technical integration to WAYF.

Service Provider Registration Practices for eduGAIN
The practices below are in addition to the “Service Provider Registration Practices” above:••••

The Service Provider must provide eduGAIN compliant SAML 2.0 metadata to WAYF
WAYF will only publish metadata to eduGAIN for Service Providers that are connected to theWAYF production environment
The Service Provider must explicitly request WAYF to be listed in the eduGAIN metadata
The metadata for the Service Provider is published by WAYF. Service Providers can request anupdate of their metadata by contacting WAYF operational team at operations@wayf.dk

WAYF Metadata Aggregate
WAYF maintains an aggregate of all metadata it exposes to eduGAIN on the following location:
https://metadata.wayf.dk/wayf-edugain-metadata.xml
The metadata document signature can be validated using the following X.509 certificate:-----BEGIN CERTIFICATE----MIIFJjCCBA6gAwIBAgIDCUBhMA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew
HhcNMTIxMTE3MTUyODQ3WhcNMTYxMTIwMDkzNzAxWjCBvzEpMCcGA1UEBRMgcHM0YVM5MW5FM2NBdmhtNGdwMC85N2JQdlB3c2lJZU0xEzARBgNVBAsTCkdUODU1NDI5MTUxMTAvBgNVBAsTKFNlZSB3d3cucmFwaWRzc2wuY29tL3Jlc291cmNlcy9jcHMg
KGMpMTIxLzAtBgNVBAsTJkRvbWFpbiBDb250cm9sIFZhbGlkYXRlZCAtIFJhcGlk
U1NMKFIpMRkwFwYDVQQDExBtZXRhZGF0YS53YXlmLmRrMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEAxr6rbSatSuukWVaqvA6sy63sbxaDa+1m8V0y7f9T
alphmsdqJhI+MwsBLg0PPUo0K7H/iWmhmeUNtVyUGll3xGCjaYLNXaJkazxGguCjlhS0nDpCuzEUAIMfaMNWhIXclVqio6qQSh66Nfdz+olCLO5nkImaRq2woLSedYFz
pahnQB7OhLmtIeQBM3SsaHdw5Yq9CRxXkMmTu2mWv1KTkqcYDeZraRDfIEeIeGty
38AEDLqhH/ouvUFkLJ9KwZuUgOzZ4XO7nyRlSx+XNuPwLgpm9b5M86MuKWjg292E
qvBwK/rFmLYPbdjtmj4xIEghotxBhtS/qXIRXYQbmmRSHwIDAQABo4IBqzCCAacw
HwYDVR0jBBgwFoAUa2k9ahhCSt2PAmU5/TUkhniRFjAwDgYDVR0PAQH/BAQDAgWg
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHREEFDASghBtZXRhZGF0YS53YXlmLmRrMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9yYXBpZHNzbC1jcmwuZ2VvdHJ1c3QuY29tL2NybHMvcmFwaWRzc2wuY3JsMB0GA1UdDgQWBBRBNLAB
9YBysFSki3QR66tKuRcclTAMBgNVHRMBAf8EAjAAMHgGCCsGAQUFBwEBBGwwajAt
BggrBgEFBQcwAYYhaHR0cDovL3JhcGlkc3NsLW9jc3AuZ2VvdHJ1c3QuY29tMDkG
CCsGAQUFBzAChi1odHRwOi8vcmFwaWRzc2wtYWlhLmdlb3RydXN0LmNvbS9yYXBp
ZHNzbC5jcnQwTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEW
JWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwDQYJKoZIhvcN
AQEFBQADggEBAD77vs/Ja1nUPS+spCnuhs2XMc5mKEzjl34czaWYHl16jY89kKju
YrOjm5JcXa1rOjtiSwEUP+TT67ZIGZKOZIfapklJJWIKk39XiwJAlDnerfpSGHj54cbi4B4KFxInLnnKcRCK+6/yrxved1zKVzFyAk23ZVrWtrmZbHCev0XVglOJQ0fC
o6CKe9W3dxir/sQ+HTeX/Z9mPqKEecrjq9/sXDGfEnFx5skzG+yith0f8APAK4hz
NHS0TDt1nO74APvHJWXJqjWM6qP2LNEYxpjikACo9AI2g0bjaKn/Z0GFtQSisgw5/VSJ96L0H0lAjYJ6HVu78Joxsjqsd6gDW5A=-----END CERTIFICATE-----