Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

Shibboleth Developer's Meeting, 2020-10-02

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2020-10-16. Any reason to deviate from this?

60 to 90 minute call window.


Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.


AGENDA

Add items for discussion here

Attendees:


Brent


Daniel


Henri

  • Drafted the java-oidc-common project with Phil last week
  • Participated to an OIDCfed interoperability event this week
    • Some successful smoke-testing via PoC exploiting a fed-library from NIK-HEF
  • Musing ways to enable (OIDC/OAuth2) feature extensions fluently
    • Some have new endpoints (e.g. Device-flow, PAR), some extend the existing endpoints (e.g. PKCE), ...
    • Keep these in mind while refactoring/repackaging into the new plugin/module


Ian

  • XSTJ-82 - Getting issue details... STATUS
    • In test with selected deployers
    • Wiki space for V3 reorganized, PKCS#11 section rewritten
    • Quick question about parent POM evolution


John


Marvin


Phil

  • JDUO-15 - Getting issue details... STATUS
    • Switched from using custom token verification actions to using the Nimbus claims and signature verification.
      • Perhaps should be made more extensible - although it does meet the 'Duo Spec' on what claims to verify. 
  • JDUO-17 - Getting issue details... STATUS
    • Added a new Nimbus based Duo Client - so you could now run without the native Duo SDK. 
      • Although it temporarily uses the Auth0 library to sign certain JWTs due to the size limitations of the Duo secret key - which Nimbus enforces.
  • Will try out plugin/module usage.


Rod

  • Plugins:
    • Further development on hold pending other playing with it.
    • Still an open question around logging vs System.ot vs i18N - but this need not be fixed for 4.1
    • Talked to Ian about nashorn and licensing
      • Made minor changes to the license documents we ship but we are happy that we can ship this under Apache
      • There is an open question about distributing the GraalVM bits
        • We can just bundle them The GraalVM license appears to say this is OK
        • We can prompt and download during install (which we once thought was a good idea)
        • We can make downloading them into edit-webapp a pre requisitite and blame Oracke's Lawyers
      • I have given up caring. Lets pick one and close this sorry chapter
  • Hitting low and slightly less low hanging JIRA cases
    • Notable I18N and the IdP


Scott

  • SP
    • Fixed (I hope) a 15+ year old SP bug
    • Fixed another open redirector bug, I'm done treating any of this as a security issue, not rushing out a patch
    • Waiting on a possible segfault issue report (not the config related one that came in 10/1) and then probably will be thinking about a release
  • Finished? modularizing core, most conf subfolders emptied out
  • Would like to move e.g. all the attribute related service files to streamline root folder but we'd have to special case the upgrader, not sure if worth it
  • Additional conversion of "dumb" XML configuration usage into properties
  • Started reviewing and suggesting adjustments to plugin design
    • Finishing up initial workk on a property-driven plugin class
    • Set up wiki space for docs, will shortly propose a standard layout for hosting plugins and update info files


Tom


Other




  • No labels