The Fedkom production environment is accessible only to members of Fedkom and opted-in members from Sambi and Skolfederation. All member metadata published in the Fedkom aggregated metadata feed is by confirmed member organizations, that must comply with the trust framework and technical requirements.

Access to Fedkom production environment

All members of Fedkom gain automatic access to the production environment.

Uploading metadata to Fedkom

Metadata opt-in from Skolfederation or Sambi

If your member organization is a Swedish municipality and a member of either Skolfederation or Sambi, you have the option to include existing or new entities in Fedkom. This is done by:

Applying the opt-in Entity Attribute as defined in the Fedkom policy
Uploading the entity metadata to Skolfederation or Sambi via Federationsadmin

Example:

<md:EntityDescriptor
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
    xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
    entityID="https://openfed.swefed.se/placeholder/internetstiftelsen/sp-prod">
    <md:Extensions>
    	<mdattr:EntityAttributes>
    		<saml:Attribute Name="https://id.openfed.se/entityattributes/opt-in" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    			<saml:AttributeValue>https://id.openfed.se/entityattributes/opt-in/yes</saml:AttributeValue>
            </saml:Attribute>
        </mdattr:EntityAttributes>
	</md:Extensions>
...
...
</md:EntityDescriptor>

Once the opt-in Entity Attribute is correctly applied and the metadata has been published, the entity will be included in Fedkom in accordance with the federation policy.

After publishing your entity with the opt-in Entity Attribute, it may take up to approximately one hour before the entity is published in the Fedkom feeds.

This delay is due to differences in metadata aggregation and publishing cycles between the federations and Fedkom.

Sending metadata manually to federation operator

If your member organization is not a member of Skolfederation or Sambi, you can upload metadata by sending the metadata to the federation operator for validation and verification. If there are errors, the federation operator will request corrections. If everything is ready for upload, the federation operator will contact the Technical Contact to validate metadata checksum (SHA1) before publication to federation.

Technical information

Metadata

Fedkom produces three metadata feeds available for consumption:

Metadata feed	URL
All entities (IdP and SP)	https://md.openfed.se/prod/md/metadata_set1_01.xml
All SP's only	https://md.openfed.se/prod/md/metadata_set1_sp_01.xml
All IdP's only	https://md.openfed.se/prod/md/metadata_set1_idp_01.xml

Public key for verifying signature of all Fedkom metadata feeds is found below.

Certificate file: openfed-saml-signer-prod-1_0.crt

SHA-256 fingerprint: 
EE:A2:A9:C3:05:06:72:BD:B5:4E:81:1E:97:7A:11:B4:A6:DC:08:7B:C5:15:D5:B8:6F:0D:0C:88:37:F1:BA:B6

We recommend verifying the fingerprint of the signing certificate with the federation operator before adding the certificate to your IdP/SP trust. After trusting the certificate, always verify federation metadata signature with signing certificate to guarantee metadata integrity.

Discovery Service (DS)

A centralized SAML 2.0 Discovery Service for Fedkom is found below.

https://md.openfed.se/prod/ds/

The DS is populated with all IdP's from the Fedkom metadata. The names shown in the DS are based on the OrganizationDisplayName attribute from the IdP metadata.

Note that the federation operator does not recommend the usage of the centralized DS for discovery of IdP's in production environments, due to limitations in user experience. If required, service providers are recommended to implement a method of discovery better suited to their service.

Generic errorURL handler

A generic errorURL handler is provided in the federation. More information: Generic errorURL handler.