July 2026 Update

Since last month’s update, we have been working primarily on the two main development fronts, the new SP and the OID Federation plugins. With summer vacations I don’t have a lot to report on the latter, but we made substantial progress on the former, with the second alpha SP Agent release completed last month. That release added more complete logout support and the SAML logout work in the Hub is largely done. OIDC logout work has begun. We have some small Agent improvements to make as part of that, but largely it’s working how we expected with alpha2. The second alpha also included, as expected, the switch to a batch-based installer on Windows, so that’s largely done modulo testing.

In late June, we held a members-only webinar that was reasonably well attended to present a development update on that work, some demos of interoperability with commercial IdPs using both SAML and OpenID, and some discussion of the manageability changes this design will introduce. We do not expect that story to be fully baked in the first release of this version, but over time we are committed to responding to feedback on what we need to do to support adoption. A recording of the webinar has been made available to members that could not attend. I appreciated all the good questions and discussion. I suspect we’ll look at doing more of those once the OID federation work is advanced enough.

Since the alpha release, the Hub has been extended with Auditing support. I did a thorough review of the IdP auditing, and found a number of areas for improvement around how the fields were being populated by the IdP’s SAML proxying support. There are some bugs there, or at least questionable decisions, and I wanted to be more thorough with the SP and make sure things made “sense” and that I defined the audit extraction points more clearly than we did in the IdP. The original auditing for SSO worked ok, but things kind of got weird with logout and the proxy support added and it isn’t laid out all that well there. Debatable if it’s worth a lot of review later to fix all that, but at least in the SP I wanted to start fresh, so that took some time and a bit of new code.

With that addition, there’s really only one major feature left to achieve what I would call a minimum viable product, which is SAML ECP support. Once that’s done, I think we are in a position to plausibly ship this much more quickly than I had been expecting, possibly as soon as the fall if we can get some load testing done. I think there’s a deadlock lurking in the session layer, but apart from that, not a lot I’m concerned with right now.

OIDC support is definitely not an MVP requirement since that is a new feature, but it would be available in released form very quickly regardless, so that isn’t really holding up the schedule.

The reasons for trying to accelerate the timeline aren’t really a secret: Apache is beginning to expand cooperation with AI-based security reviewing tools and I believe there is a serious possibility of significant bugs being found in code we rely on and would potentially have a hard time fixing. I’m just being defensive. I’d rather the new SP be ready by the time that happens and not be forced to rush anything artificially.

Once we do ship this, the clock will start on the retirement of V3, so it’s possible we could be looking at early- or mid-2028 for that if we meet a fall shipping date. So I am very motivated to get it shipped.

With most of the core work done for the new version, I will be getting a V3.6 ready to refresh libraries and add deprecation warnings, and I’d like that done by mid-summer or shortly after.

Minor work on the IdP continues, primarily technical debt issues, and we will hopefully plan to ship V5.3 as soon as Spring 7.1 is available in November, so I would expect that come before end of year this time rather than bleed into 2027. There should be a lot less added than we added to V5.2.