Shibboleth Developer's Meeting, 2023-01-20

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2023-02-03. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

1. Release post-mortem

2. Removal of Nexus endpoints from public network interface

3. Null remediation - appetite for wrappers?

Attendees:

Brent

Daniel

• Cannot attend today, meeting conflict.

Henri

• Apologies, offline today

• Will continue finishing and testing the new security configuration next week together with Phil

Ian

John

Marvin

Phil

• Tracking down a bug. Which I believe is in the Nimbus code. Issue raised. https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/issues/412/truncation-issue-in-secretkeyderivation

• Bugs in the certification suite:

  • https://gitlab.com/openid/conformance-suite/-/issues/1157#note_1233913190

  • https://gitlab.com/openid/conformance-suite/-/issues/1156#note_1232834925

Rod

• JMVN-47 - Getting issue details... STATUS

  • Litmus test for the failure that provoked this is now the java-versions-set-nightly (currently failing)

• JMVN-45 - Getting issue details... STATUS

  • This is hideous and requires us to track the parent pom for ever. But its still less hideous than the alternative

  • Can we do more pruning?

• Other release in support of 4.3.0

Scott

• SP (xmltooling) patch to block CipherReference, and close a few small issues

• Back to IdP cleanup

  • Made some revisions to the Action API and some deferred changes to BaseContext in OpenSAML

  • Started adding some methods to address null issues

Tom

Other