Shibboleth Developer's Meeting, 2022-11-18

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2022-12-02. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the OSU Zoom system, per message sent to dev list (https://marc.info/?l=shibboleth-dev&m=166869233232713&w=2)

AGENDA

1. Plan for migration off HttpServletXXX proxies (largely mapped out, just summing up cause, solution)

   1. I believe the Supplier hook was added post-4.2? We may want to switch to a custom non-null interface…

2. JSSH-5 - Getting issue details... STATUS

   1. See net.shibboleth.idp.attribute.filter.impl.AttributeFilterImplTest for test weirdness around this

3. (PS) Pin release plugin versions?

4. (RDW) Whither SAML1NameIdentifierAttributeDefinition and SAML2NameIDAttributeDefinition?

Attendees:

Brent

• Absent, updated via Slack that HttpClient 5.2 refactor is moving along

Daniel

Henri

• Absent today

• Relying party bean-wiring problem described in a mail

  • Fixed, see JSE-51 - Getting issue details... STATUS

Ian

John

Marvin

Phil

• DuoOIDC plugin improvements and testing

  • DuoOIDC plugin 1.3.0 release

• Back to RP next week

  • Hopefully a new release before TechEx.

    • Improve code

    • Add key set document endpoint (hopefully before TechEx)

Rod

• SSPCPP-961 - Getting issue details... STATUS

• IDP-1793 - Getting issue details... STATUS I need to document the new beans (but things are still moving in this space)

• IDP-2037 - Getting issue details... STATUS , IDP-2036 - Getting issue details... STATUS

• Somebody from Red Hat Product Security claims they didn't put any hibernate jars into Maven Central. Doesn’t that make you feel comfortable.

Scott

• Walking the libraries with the Null analyzer enabled, finding a few bugs here and there

  • We probably want to take the V5 opportunity to revisit our method contracts and reduce use of nulls, especially around collections

  • Using asserts to some extent, per Slack to convince analyzer, these are on in the tests automatically

• https://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0687ed7d180fb4e697351135a96a331c721208ba

  • Removed what seemed to be an unused method, but Rod Widdowson may want to review

Tom

• testbed

Other