Page Comparison

...

This week's call will use the OSU Zoom system, per message sent to dev list (https://marc.

AGENDA

• Add items for discussion here

Attendees:

Brent

Daniel

Henri

info/?l=shibboleth-dev&m=166869233232713&w=2)

AGENDA

1. Plan for migration off HttpServletXXX proxies (largely mapped out, just summing up cause, solution)

   1. I believe the Supplier hook was added post-4.2? We may want to switch to a custom non-null interface…

2. Jira Legacy
   server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key JSSH-5

   1. See net.shibboleth.idp.attribute.filter.impl.AttributeFilterImplTest for test weirdness around this

   2. Rod is reworking this change

3. (PS) Pin release plugin versions?

   1. Phil will look at pinning the initial cases.

4. (RDW) Whither SAML1NameIdentifierAttributeDefinition and SAML2NameIDAttributeDefinition?

   1. Still TBD, would like to know what the use cases are at this point. Willing to change warning message if we need to.

Attendees:

Brent

• Absent, updated via Slack that HttpClient 5.2 refactor is moving along

Daniel

Henri

• Absent today

• Relying party bean-wiring problem described in a mail

  • Fixed, see

    Jira Legacy
    server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key JSE-51

Ian

John

Marvin

Phil

• DuoOIDC plugin improvements and testing

  • DuoOIDC plugin 1.3.0 release

• Back to RP next week

  • Hopefully a new release before TechEx.

    • Improve code

    • Add key set document endpoint (hopefully before TechEx)

Rod

• Jira Legacy
  server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key SSPCPP-961

• Jira Legacy
  server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key IDP-1793

  I need to document the new beans (but things are still moving in this space)

• Jira Legacy
  server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key IDP-2037

  ,

  Jira Legacy
  server System JIRA serverId f52c7d31-6eab-3f0e-93c3-231b5754d506 key IDP-2036

• Somebody from Red Hat Product Security claims they didn't put any hibernate jars into Maven Central. Doesn’t that make you feel comfortable.

Scott

• Walking the libraries with the Null analyzer enabled, finding a few bugs here and there

  • We probably want to take the V5 opportunity to revisit our method contracts and reduce use of nulls, especially around collections

  • Using asserts to some extent, per Slack to convince analyzer, these are on in the tests automatically

• https://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0687ed7d180fb4e697351135a96a331c721208ba

  • Removed what seemed to be an unused method, but Rod Widdowson may want to review

Tom

• testbed

Other