Shibboleth Developer's Meeting, 2018-08-03

Call Administrivia

10:00 Central US / 11:00 Eastern US / 16:00 UK

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2018-08-17. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

• Automatic module names (iay), see:

  • JPAR-113 - Getting issue details... STATUS

  • Java Modularity (proposal)

• More Jetty / Tomcat TLS config (Tom) 

  • Jetty 9.4 SSL context

  • Tomcat TLS

• Java pricing model (iay)

Attendees:

Brent

• OSJ-234 - Getting issue details... STATUS
  - what is good default for negative lookup cache duration?  Currently 30 minutes.  Too long?

Daniel

Ian

Marvin

Rod

• Backlog

• Scripting documentation

• IIS - Micrsoft engineers "march to a different drummer"

Scott

• IDP-1275 - Getting issue details... STATUS

• Santuario patch

• Second SP patch

  • Noteworthy: I should have changed the default attribute-policy/map filenames, next time I guess

• Follow up testing and patches focusing on empty elements in native Santuario APIs

• Confluence / JIRA upgrade time

Tom

• Worked on integration tests

  • Linux : all green / good

  • Windows : problems with Jetty 9.4 and Java > 8

Open

• TLS / SSL config (see agenda)

  • https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices

  • https://wiki.apache.org/tomcat/Security/Ciphers

  • https://wiki.mozilla.org/Security/Server_Side_TLS

• OpenID Connect Federation list

  • http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20180723/006876.html

Other