All work

Make InResponseTo validation optional

Spurious warning on unsigned SAML redirect messages

SAML MessageDecoders should enforce that SAMLRequest/SAMLResponse contain correct message type

Simple signature verification fails to detect parameter smuggling

Consider clearing storage "dirty" flag in more appropriate spot

IdP keeps repeatedly attempting to delete local storage data

opensaml-bom forces the version of Spring Framework

Consider guarding classloading of ECNamedCurveTable

Support EDS-compatible discovery feed for batch resolvers

Generated metadata is not valid

SAML20AssertionValidator allows non-Entity Issuers

SAML20AssertionValidator creates mis-formatted error string

Allow various classes to skip servlet request check at init time

MessageHandler to flag SAML responses with error status codes

Test coverage for disallowed encryption or signing algorithms

Suspicious comparison of Boolean references in SAML2AuthnRequestsSignedSecurityHandler

Suspicious comparison of Integer references in AttributeConsumingServiceSelector

StorageService implementations compare version improperly.

Metadata unmarshalling fails on comment element

Remove cryptacular dependency

Metadata generation template missing space before entityID

Review effects of Bouncy Castle 1.78's change to PEM parsing

Request to make opensaml compatible with httpclient-4.* or httpclient5

Seems to produce SamlResponses which are against XML encryption specification

CompositeMetadataResolver.setId is not accessible

MD generator creates invalid metadata - lang attributes missing for DisplayName and Description

Metadata generation omits xml:lang tag in some spots

LogoutMessage interface inherited from RequestAbstractType

Implement chunked cookie storage with client storage service

Failure in OpenSAML tests with Santuario xmlsec 3.0.4

FileBackedHTTPMetadataResolverTest.testNoBackupFileLoadWhenMetadataCached broken

Replace BOMs in opensaml-parent with inlined dependency mgmt.

Add CSP protection to OpenSAML messaging templates

OpenSAML's strict processing mode does not load ADFS metadata

Default supported TLS protocols appears too broad

Investigate possibility of HttpClient connection reuse with our custom TLS handling

Use try-with-resources for HttpEntity access for HttpClient

Extend metadata resolution with custom criteria

Update RSASSA-PSS AlgorithmDescriptors when Santuario updates their methodology

Always use try-with-resources withHttpClient requests not involving HttpClientResponseHandler

Update ConfigurationPropertiesSource to return a custom type

Investigate update to Santuario XML Security 3.x

HTTP client changes to allow for preemptive basic auth

Signature failures log WARN for Redirect binding but DEBUG for POST binding

Implement support for legacy class transitions in getSubcontext(String)

opensaml-core uses an old version of Metrics that depends on jdk.unsupported

Logging of assertion validation is overwriting specific error messages

"trustAnchors parameter must be non-empty" failure in httpClient

Logging on AlgorithmSupport "failures" should be DEBUG