...
Since there's a lot rolling out with this release, the Upgrading topic now includes an "Upgrading to V4.1 and Beyond" section that highlights some of the mechanics of this, and future, upgrades. Notably, we don't know of any reasons why an upgrade directly from a remediated V3.4 installation (i.e., one free of warnings) won't work, but this has been tested much less than upgrading from V4.0 has.
As a point of clarification, we have virtually never in our history supported more than one minor release at a time, and definitely not since V3 was released and there are no plans to do so here. With the exception of the OIDC extension (more below), which we have been very up front about, this is a minor release expected to be fully compatible with V4.0 and the process of upgrading to it versus a patch to V4.0 would be exactly the same, which is why there isn't any point in maintaining both.
This is highlighted everywhere I can think of, but to re-emphasize:
- V1/V2 of the OIDC extension is NOT compatible with this release and ideally should be removed from the system and configuration before upgrading to V4.1.
- V3.0 of the OIDC OP extension will be available at the time of release as a plugin for V4.1 and will be officially supported and the configuration maintained going forward.
- There is a page that discusses the "upgrade" process and the differences between the older extension and the new plugin at OIDC OP Upgrading. It isn't difficult to switch to the new version but there are XML changes needed.
All of the new OIDC documentation is drafted at least in initial form and has been betadry-run tested a couple of times producing a working OP.
One of the other plugins of course is a replacement for the original Duo flow that supports their new full-frame strategy and eventually their replacement UI expected later this year. Both the Shibboleth and WebSDK4 integration "types" support this new extension. The existing Duo support is deprecated with this release but will not be formally removed until Duo's timeline for sunsetting the old integration support is clearer, and certainly not particularly soon.
On the SP front, work has progressed on a new build and packaging toolset for Linux that will be used with any future releases to produce packages for supported platforms. This will likely lead to the elimination of SUSE as a supported platform (there are official packages available on modern SUSE releases anyway), and we are considering dropping official macOS support as well due to lack of interest. We will however probably be adding Amazon Linux as an officially supported platform and package set, and will be more easily able to add other RPM platforms in the future.