The following information applies to any third party developers working with Shibboleth Project artifacts, including OpenSAML. For project team members, see the https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1123450991 topic for more complete documentation allowing deployment of artifacts.

You should NOT use our repository URLs for any artifact requests other than the ones we host, and we publish the necessary prefix list for properly updated Maven clients to use in filtering their requests.

You should also use a caching Maven repository of your own in front of these to ensure that you are not dependent on our repositories being online. We are far too small a project to provide any sort of guaranteed service like that, and if and when our own needs as a project come into conflict with providing open access to these artifacts, the project’s needs will take precedence.

We also reserve the absolute right to block any IP addresses that are abusing our service with an excessive number of requests.

Shibboleth Maven Repository URLs

Shibboleth artifacts :
https://build.shibboleth.net/maven/releases

Shibboleth snapshot artifacts :
https://build.shibboleth.net/maven/snapshots

Third-party artifacts not in Central :
https://build.shibboleth.net/maven/thirdparty

Third-party snapshot artifacts not in Central :
https://build.shibboleth.net/maven/thirdparty-snapshots

Maven User Settings File (~/.m2/settings.xml)

Here is an example Maven user settings file (~/.m2/settings.xml) :

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">

    <activeProfiles>
        <activeProfile>shibboleth-repositories</activeProfile>
    </activeProfiles>

    <profiles>
        <profile>
            <id>shibboleth-repositories</id>
            <repositories>
                <repository>
                    <id>shibboleth-releases</id>
                    <name>Shibboleth Releases Repository</name>
                    <url>https://build.shibboleth.net/maven/releases/</url>
                    <releases>
                        <enabled>true</enabled>
                        <checksumPolicy>warn</checksumPolicy>
                    </releases>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                </repository>
                <repository>
                    <id>shibboleth-snapshots</id>
                    <name>Shibboleth Snapshots Repository</name>
                    <url>https://build.shibboleth.net/maven/snapshots/</url>
                    <releases>
                        <enabled>false</enabled>
                    </releases>
                    <snapshots>
                        <enabled>true</enabled>
                        <checksumPolicy>fail</checksumPolicy>
                    </snapshots>
                </repository>
                <repository>
                    <id>shibboleth-thirdparty</id>
                    <name>Shibboleth Thirdparty Repository</name>
                    <url>https://build.shibboleth.net/maven/thirdparty/</url>
                    <releases>
                        <enabled>true</enabled>
                        <checksumPolicy>fail</checksumPolicy>
                    </releases>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                </repository>
                <repository>
                    <id>shibboleth-thirdparty-snapshots</id>
                    <name>Shibboleth Thirdparty Snapshots Repository</name>
                    <url>https://build.shibboleth.net/maven/thirdparty-snapshots/</url>
                    <releases>
                        <enabled>false</enabled>
                    </releases>
                    <snapshots>
                        <enabled>true</enabled>
                        <checksumPolicy>warn</checksumPolicy>
                    </snapshots>
                </repository>
            </repositories>
            <pluginRepositories>
                <pluginRepository>
                    <id>shibboleth-releases</id>
                    <name>Shibboleth Releases Repository</name>
                    <url>https://build.shibboleth.net/maven/releases/</url>
                    <releases>
                        <enabled>true</enabled>
                        <checksumPolicy>fail</checksumPolicy>
                    </releases>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                </pluginRepository>
                <pluginRepository>
                    <id>shibboleth-snapshots</id>
                    <name>Shibboleth Snapshots Repository</name>
                    <url>https://build.shibboleth.net/maven/snapshots/</url>
                    <releases>
                        <enabled>false</enabled>
                    </releases>
                    <snapshots>
                        <enabled>true</enabled>
                        <checksumPolicy>fail</checksumPolicy>
                    </snapshots>
                </pluginRepository>
            </pluginRepositories>
        </profile>
    </profiles>
    <!-- This HTTPS mirror of Central may be required when building projects based on the V7 parent project.
	     For example, net.shibboleth.utilities.jetty9:jetty94-dta-ssl:1.0.0 which depends on net.shibboleth:parent:7.11.0
	     This is because the V7 parent project defines the Central repository URL using HTTP instead of HTTPS.
	     See https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked
	-->
	<!--
	<mirrors>
		<mirror>
			<id>central-https</id>
			<name>HTTPS mirror of HTTP Central</name>
			<url>https://repo.maven.apache.org/maven2</url>
			<mirrorOf>central</mirrorOf>
		</mirror>
	</mirrors>
    -->

</settings>

Maven Remote Repository Filtering

Maven claims to “automatically” enable and support filtering of remote repository access by “prefix”. This does not appear to be true. It is however, possible, and greatly advisable to manually enable this using the prefix files hosted on the server as follows:

Assuming your repository is in ~/.m2/repository, you can manually maintain the prefix files corresponding to the above repository IDs as follows:

cd ~/.m2/repository
mkdir .remoteRepositoryFilters
cd .remoteRepositoryFilters
wget -O prefixes-shib-releases.txt https://build.shibboleth.net/maven/releases/.meta/prefixes.txt
wget -O prefixes-shib-snapshots.txt https://build.shibboleth.net/maven/snapshots/.meta/prefixes.txt
wget -O prefixes-shib-thirdparty.txt https://build.shibboleth.net/maven/thirdparty/.meta/prefixes.txt
wget -O prefixes-shib-thirdparty-snapshots.txt https://build.shibboleth.net/maven/thirdparty-snapshots/.meta/prefixes.txt

These prefixes don’t change often, but it is good idea to insert this into a script to keep them maintained and of course if you run into failures due to missing Shibboleth artifacts, check that first.

Lastly, you MUST enable a property that Maven claims is enabled by default, but certainly does not appear to be, by adding

-Daether.remoteRepositoryFilter.prefixes=true

to your command lines.

Shibboleth Thirdparty Maven Repository

The Shibboleth thirdparty Maven repository contains thirdparty artifacts that are not available from the Maven Central Repository.

As of 2024, this repository is no longer required for any of our current software, but remains needed to build older IdP versions that depend on the old DuoWeb integration artifact.

Old Shibboleth Maven Repository URLs

As of 20 January 2022, the following Maven repository URLs are being redirected :
https://build.shibboleth.net/nexus/content/groups/public
to
https://build.shibboleth.net/maven/releases

https://build.shibboleth.net/nexus/content/repositories/releases
to
https://build.shibboleth.net/maven/releases

https://build.shibboleth.net/nexus/content/repositories/snapshots
to
https://build.shibboleth.net/maven/snapshots

https://build.shibboleth.net/nexus/content/repositories/thirdparty-snapshots
to
https://build.shibboleth.net/maven/thirdparty-snapshots

MavenRepositories

Shibboleth Maven Repository URLs

Maven User Settings File (~/.m2/settings.xml)

Maven Remote Repository Filtering

Shibboleth Thirdparty Maven Repository

Old Shibboleth Maven Repository URLs