Shibboleth Developer's Meeting, 2021-07-02

Brent

Daniel

Henri

Ian

• Java 17: now being tested in -multi jobs; all seems well.
  • Nashorn 15.3: "The most notable change is that Nashorn now works with JDK 17.", see see https://twitter.com/OpenJDK/status/1410603091490054166
  • This is something to do with Unsafe.defineAnonymousClass I think, not clear why we aren't seeing issues in -multi jobs.
• SKS (PGP/GPG) keyservers are defunct (RTBF/GDPR, apparently). Acronyms much?

...

• Jira Legacy
  server Shibboleth JIRA columnIds issuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JDUO-47

   added test, fixed, and deployed 1.1.1 of the Duo plugin
• Maven cleanup

  • Jira Legacy
    server Shibboleth JIRA columnIds issuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JPAR-178

     - we can get rid of our patched one from Nexus.

  • Jira Legacy
    server Shibboleth JIRA columnIds issuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 180d847f-bce4-36b2-9964-771bff586829 key JPAR-176

     - thanks to the work Scott put in, I think this is done, other than testing (and some possible adjustment of server-side scripts) during a release.
• OIDC-RP
  • Slow progress, hopefully have more time now the Maven stuff is done.
  • Spent a small amount of time on Webfinger for OP discovery - can not see much support for this. 
    • The plugin probably should provide some support? to support OP discovery on the flow (like SAML proxying does with IdP disco).
    • Strategy-based lookup for now.

Rod

• 'test' to check against our poms is complete and in place.  Scott Cantormade some changes to our parent pom.
• 'test' to check war contents signing is ongoing.
• We are going to have to have a conversation about jar signing & supply chain attacks.  

Scott

Tom

• Regrets - will miss call
• Green lights on browser tests
  • Run latest-browsers vs latest-Jetty vs IdP-latest and IdP-next nightly ?
    • don't need to re-run tests against static versions
    • Sauce Labs tests are slower than local headless Firefox

...