Network metadata

The Beheerorganisatie checks the participants' metadata for conformity, deletes the signatures and aggregates the metadata into one file.

The aggregated metadata consists of a signed EntitiesDecriptor element with an cacheDuration XML attribute with value "P7D" and an Name XML attribute with a value formatted as urn:etoegang:VERSIEAS:metadata:OMGEVING:VOLGNUMMER, whereby VERSIEAS indicates the version of the framework, OMGEVING the respective environment (P or A), and VOLGNUMMER is a sequence number that distinguishes the different versions of metadata. The signature MUST meet the requirements described in Information security requirements.

The EntitiesDescriptor element contains 5 EntitiesDescriptor elements with the names Authenticatiediensten, Machtigingenregisters, Koppelregisters, Interstelseldiensten and Herkenningsmakelaars (prefixed with 'urn:etoegang:role:') that contain the metadata from the participants in the different roles. Under the role "Interstelseldiensten" the eIDAS-berichtenservice is listed, HMs MUST treat this as if it were both an AD and MR. That is, in message validation it can regard it as an AD/MR depending on context. However for services classified as 'eIDAS-inbound' it MUST NOT list it as an AD for AD-selection by the user (instead, the DV must list this as a separate authentication option, not the HM). Furthermore, it MUST send requests as per Interface specifications HM-EB.

The EntitiesDescriptor element can also contain an additional Dienstverleners (service providers) element that contains fictitious service providers. Each Herkenningsmakelaar MUST process the named service providers. These service providers are named in the service catalogue and can be used by the Beheerorganisatie and for testing.

The EntitiesDescriptor element also contains an Extensions element that contains a PublicationInfo element with the URL and creation date of the metadata file, which MUST be filled by the Beheerorganisatie.

The Beheerorganisatie publishes the metadata in a fixed location. In order to maintain the privacy of the contacts' details in the metadata, the location is a non-indexed URL with server-side SSL that can only be shared with the participants. 

Example

<?xml version="1.0" encoding="UTF-8"?>
<md:EntitiesDescriptor 
    ID="[reference for dsig]"
    Name="urn:etoegang:1.13:metadata:P:36"
    cacheDuration="P7D"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

    <ds:Signature>...</ds:Signature>

    <md:Extensions>
    	<mdrpi:PublicationInfo publisher="https://.../productie_metadata.xml" creationInstant="2019-05-07T10:39:03Z"/>
	</md:Extensions>

    <md:EntitiesDescriptor Name="urn:etoegang:role:Authenticatiediensten">
        ...
    </md:EntitiesDescriptor>
    <md:EntitiesDescriptor Name="urn:etoegang:role:Machtigingenregisters">
        ...
    </md:EntitiesDescriptor>
    <md:EntitiesDescriptor Name="urn:etoegang:role:Koppelregisters">
        ...
    </md:EntitiesDescriptor>
    <md:EntitiesDescriptor Name="urn:etoegang:role:Herkenningsmakelaars">
        ...
    </md:EntitiesDescriptor>
    <md:EntitiesDescriptor Name="urn:etoegang:role:Interstelseldiensten"> 
       ...
    </md:EntitiesDescriptor>
</md:EntitiesDescriptor>

A participant MUST process the metadata periodically at a time that is predefined by the Beheerorganisatie. Data about the URL and the periodicity are described in Proces netwerkmetadata. 

A participant MUST use an automated process to process the metadata that finishes in 15 minutes. A participant MUST be able to start this automated process (e.g., manually) between the predefined periods in agreement with the Beheerorganisatie to accommodate a rollback or other changes.