Metadata Registration Practice Statement

1. Scope

Applies to every entity carrying mdrpi:RegistrationInfo with registrationAuthority https://md.kren-ks.eu. Entities of other federations received through eduGAIN are out of scope.

2. Members

KREN verifies that the institution exists, is eligible under the federation policy and that the signatory may bind it. The Member names authorised representatives and technical, support and security contacts; KREN confirms them by email.

3. Registration

• Requests are accepted only from authorised representatives, by ticket at tiketa.kren-ks.eu.
• entityID: an absolute https:// URL in a domain the Member controls (or a urn: in its namespace); never reassigned.
• Scope: a DNS domain the Member controls, regexp="false", verified through Entra ID or a DNS TXT record. Every scope and entity category is explicitly granted by KREN.
• Checked: schema, HTTPS, RSA keys ≥ 2048 bits, Organization and contacts in English, mdui (and PrivacyStatementURL for SPs).
• registrationInstant is set at first publication and never changed.

4. Changes and removal

Changes follow the same route. KREN may change or remove an entity that breaks this statement or the policy, or poses a security risk, informing the Member's contacts. A Member may request removal at any time.