Shibboleth Developer's Meeting, 2020-12-04

Brent

• Jira Legacy
  server Shibboleth JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key OSJ-82

  
  
  • Did some low-hanging fruit, like XMLObject providers.  Working on modeling KDF-related components.

...

• Jira Legacy
  server Shibboleth JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JDUO-22

   - Add a nonce to the authorization request and verify it in the id_token.
  • The Duo OP supports it - seems like best practice to help prevent id_token replay attacks.  
  • Only supported using the alternative Nimbus client.
  • Duo Web SDK does not support setting it - even though they consider it in their validation step.

• Jira Legacy
  server Shibboleth JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JDUO-23

   - the JWT claims verify can now be injected (hence a custom one can be used). 
  • A default version and base class have been created to satisfy Duo requirements and (for the limited things possible) OIDC requirements.

• Jira Legacy
  server Shibboleth JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JDUO-24

   - bit weird that, the latest Duo Web SDK requests the auth code as a `duo_code` parameter rather than the OAuth2.0 standard `code`. Broke my stuff.
  • No they only updated the documentation recently, it is a change from the preview version they gave us.

Rod

• IdP catch up
• SP windows build maintenance

...