...
Name | Skills | Est. | Description | |||
|---|---|---|---|---|---|---|
SP V4 Redesign | 2025-2026 | 9PM | The SP is on an unsustainable path and needs to be replaced with a different software redesign that addresses sustainability challenges – see Service Provider V4 Redesign | |||
OIDC Federation | Java, OAuth/OIDC | 3PM | “Complete” support for the finished specs around OIDC Federation, primarily motivated by government projects at this point. | |||
Understanding Shib/SAML Documentation | Tech Writing, SME | 2PM | Developing a good set of documentation that explains SAML, Shibboleth, and Federations at a conceptual level. The intended audience for the documentation is those new to the subject matter. | |||
Enhanced Product Documentation | Tech Writing, SME | 3PM | Developing a good set of product documentation that explains features more thoroughly and contextually, with examples, and better how-to material that is task focused instead of reference oriented. | |||
Developer Documentation | SME | 3PM per product | Developing a good set of developer documentation for extension work on Shibboleth products. Documenting the SP and IdP would be separate items. | |||
Packaging / Installation / Deployment | Packaging, Containerization, Installer Tools | 2PM | This would span general installer improvements all the way to possible use of container technologies like Docker. Unclear if there's value in a general solution to that, but various groups have asked or have worked on things like this. Internet2 has stepped in to do this work with the TAP container. | TestShib-NG | 2.5PM | An effort to create a new TestShib software package and platform. Of late, samltest.id seems to have filled this niche well enough. |
Expansion of IdP Integration Testing | Java, Installer Tools | 2PM | We need more extensive coverage of the installation processes and integration tests across different supported containers and platforms, to improve QA. | |||
IdP User Interface | Java, Javascript | There are various things that the IdP might expose a UI in order to manage, such as:
A GEANT project has been ongoing in 2023 to produce a form of this that we might eventually take over. This has potential for supplying at least a part of the missing UI needed to make Passwordless support more viable. | ||||
Java Service Provider | Java, SAML | 1PM | An analogue of the native, C++, SP written in Java. This has been requested for a long time due to the deficiencies so many other SAML implementations have had. It's been parked for a long time, and we had hoped to see good implementations emerge, but that hasn't happened. The work to redesign the SP would be expected to migrate much of the core function into Java, and the agent architecture under discussion is hoped to provide a path to producing new agents at much less cost to the project. The estimate of time is based on having a delivered SP redesign to work from. | |||
Office 365 Integration | Java, WS-Trust, OAuth | 3PM | Microsoft has made documents publically available describing fat-client integration with Office 365 via WS-Trust. They are offering technical contacts to faciitate this work. We have to determine viability and our willingness to adopt non-standard profiles without public change control procedures. This work seems of questionable value now given the SAML support across most of the applications and would probably take the form of OAuth support if we did anything. Realistically, Microsoft’s unwillingness to really support third party options make this a questionable proposition. | |||
IdP Configuration Tooling | Java, Javascript, UI design | From time to time people have requested some form of configuration tooling for the IdP. The suggestions range from command line tools, desktop UIs, and web-based UIs. In general it seems like the most often wish revolve around configuring:
The Unicon GUI is convering a lot of this space at the moment though in a highly abstracted/insulated way through the metadata boundary and the MetadataDrivenConfiguration work. | ||||
Security Audit/Review | C++, Java | Various open source projects have undertaken formal code audits or reviews for security issues, and this sometimes is raised as a pseudo-requirement for governmental usage. We have a lack of resources/expertise, and no explicit demand/requirement for this. It would also be costly in time. With the need to rewrite the SP, it doesn't make a lot of sense to audit that right now. |
...
Name | Description |
|---|---|
Centralized Discovery Service, version 2 | Developing the next major version of the Centralized Discovery Service product. This includes significant internal code refactoring, changes in configuration files to align with the IdP, and production of JSON metadata feed used by the embedded discovery service. After consultation with members, the decision was made to park any work on this codebase and allow the original version to sunset with the V2 Java code base. |
IdP Support for WS-Federation | Version 1.3 of the IdP had support for Microsoft's proprietary ADFS v1 protocol. This was not brought forward because it didn't seem to be used by very many deployers. It comes up from time to time but supporting this would conflict with our desire to drop the SAML 1.1 code from the project to reduce technical debt. |
IdP OTP SMS Authentication | SMS seems to have rightly lost a lot of supporters given its security flaws and cost. Work on other tech makes more sense now. |
Token Binding | Support for the emergent TLS Token Binding extension in our SAML implementations. This is dead in light of Google having pulled Chrome support for Token Binding. |
SAML-ECP GSS-API Mechanism | Specification of a browser-less GSS-API mechanism for SAML based on ECP is largely complete with stable drafts available. Completion of the drafts depends on implementation feedback. A mechanism would need to be developed in C++ with C linkage to the mechglue layers of at least MIT and Heimdal GSS libraries. Some prototype work on this was done by NCSA staff with ISOC funding. At this point the work seems to be largely overtaken by other simpler approaches and in any event the project lacks the C++ development resources long term to seriously consider something like this. |
SP Availability in Fedora | Effort to produce SP packages compatible with Fedora standards and to get them accepted into the Fedora project. This has unknown implications on Red Hat packaging. This was a request from the Moonshot team. GIven the state of the SP and the state of Red Hat vis a vis the Linux community, this is parked regardless of the effort involved. |
Resource Registry, version 1 | Various federations have software that devolves management of IdP/SP information to people closer to those entities. SWITCH's Resource Registry is the canonical example of this. People have made requests that such a tool be available from the Shibboleth project. Currently each federation has something that might be considered a resource registry and each is very different so it's unclear that a single code base could ever cover all, or even the majority, of these uses. |
Conformance Testing | Kantara (formerly Liberty) does (or did) some conformance testing of SAML implementations against various conformance testing suites, particularly eGovernment profiles that the project has participated in the development of. Vendors have expressed interest in Shibboleth participating at times, though not recently. There is a lack of demand from our community, and unwillingness to devote core team resources to the effort. We also support many things we think are more important but aren't part of the testing, and thus do not believe as a technical matter that the result is meaningful to customers, other than to rubber stamp poorly designed SAML implementations by competitors. |
SAML 2.1 Standard | Effort to update and revise the SAML 2.0 standard within the OASIS SSTC. The work at the SSTC has essentially been put on hold due to lack of volunteers to work on it. Politically it would be quite difficult to make a lot of the sorts of changes that would benefit the project, particularly substantive changes to the conformance criteria since it would be impossible for most vendors to meet and none of them would ever want to do the work necessary to change that. Notably, the SSTC has also ceased to be, so this would require re-chartering a new TC and rejoining OASIS. |
TestShib NG | An effort to create a new TestShib software package and platform. Of late, http://samltest.id seems to have filled this niche well enough, and there’s also https://github.com/OpenConext/Mujina so it’s not really conceivable we would duplicate all that. |