SWITCHaai Metadata

The metadata describe Identity Providers (IdP) and Service Providers (SP) of the respective federation. The files are updated hourly, usually every full hour.

SAML 2.0 metadata

SWITCHaai Federation
AAI Test Federation

The federation metadata files are digitally signed with the SWITCHaai Metadata Signer certificate. This certificate chains to the SWITCHaai Root CA certificate which should be configured as the trust anchor for PKIX-based validation of the metadata signature.

Update of Federation Metadata

AAI-enabled systems in the SWITCHaai federation are requested to update the metadata at least daily. Hourly updates are strongly recommended in order to support fast propagation of metadata changes.

Instructions for configuring the above metadata with an automatic hourly refresh and signature validation based on the SWITCHaai Root CA trust anchor can be found in our SP deployment guide and the IdP deployment guide, respectively (MetadataProvider elements in the XML configuration files).

If the SP or IdP downloading metadata is behind a firewall or proxy, please be aware that the IP address of the metadata.aai.switch.ch host may change without notice. Creating IP-based filter rules is therefore discouraged, and we strongly recommend configuring the SP to use a proxy and the IdP to use a proxy instead.

Special Use Case

SWITCH edu-ID IdP Metadata only

The following metadata files get updated and are digitally signed the same way as the standard metadata files above.

SWITCH edu-ID IdP - registered in the SWITCHaai Federation
http://metadata.aai.switch.ch/entities/eduid contains only the SWITCH edu-ID IdP
SWITCH edu-ID [Test] IdP - registered in the AAI Test Federation
http://metadata.aai.switch.ch/entities/eduid-test contains only the SWITCH edu-ID [Test] IdP