Shibboleth Developer's Meeting, 2023-06-16

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2023-07-07. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at OSU, see announcement for access info.

AGENDA

1. Jenkins behavior (ongoing in Slack)

2. Trim or not to trim?

Attendees:

Brent

Daniel

Henri

• Patch for oidc-common (2.2.1)

  • JCOMOIDC-72: Update ForceAuthnAuditExtractor to tackle Nimbus AuthenticationRequestsClosed

• Refactoring oidc-common into the V5 codebase

  • Mostly import-statements, POM-dependencies

  • All done, except metadata-impl to be finalized

    • Unit tests for classes using HttpClient and ServiceableComponent (ReloadServiceConfigurationTest doesn’t seem to exist anymore in IdP)

  • main-branch into 3.0.0-SNAPSHOT once ready for commit?

• Next up: OP to the V5 codebase

Ian

• Java 21 (23.9 LTS) is now in “Rampdown Phase One”, i.e., feature complete.

• Debian -- News -- Debian 12 "bookworm" released

  • Java 17 explicitly mentioned in release notes this time. No other Java versions provided.

  • java-17-openjdk currently provides 17.0.6 (2023-01-17) where current is 17.0.7 (2023-04-18).

  • Smoke testing our IdP stacks (Java 11 and 17) and an IdP install, everything normal.

  • Time to add this to the “partially supported” list for both platforms.

• 6.1.0-M1 Milestone · spring-projects/spring-framework now a thing. May be the thing to target for v5.

• SWF 3.0.0 GA “Soon (TM)”.

John

• Preening some SPEC linting commits before pushing SSPCPP-969: cpp-linbuild manifests do not match actual RPM/SRPM productsResolved

Marvin

Phil

• oidc-common and 2.2.1 release

  • JCOMOIDC-71: Complete decode function of OIDCScopedStringAttributeTranscoderClosed

• RP patch cleanups

  • JOIDCRP-33: Typo in add default principals propertyClosed

  • JOIDCRP-34: Remove nonBrowser authentication flow supportClosed

• RP enhancements

  • JOIDCRP-35: Add support for passive inbound requestsClosed

  • JOIDCRP-29: Support client_secret_jwt and private_key_jwt client authenticationClosed

    • Almost there

  • Once that is complete, I will look to release a 1.1.0 (hopefully next week)

  • After 1.1.0 I will upgrade the plugin to a V5 plugin.

Rod

• Continued installer work

  • Update command now in place and the IdP checks for updates at startup

  • Other tidy ongoing

• Recast the plugin & module classes & inheritance (IDP-2121: Future Proofing the Module Plugin infrastructure for Future SP useClosed)

  • V4 plugins & modules will works in V5

  • … but will not compile and should be (at least) rebased against 5.0

• Quick diversion into SSPCPP-976: Drop Win32/x86 out of process buildsPending

• JJDBC-19: Re-introduction of https://shibboleth.atlassian.net/browse/IDP-1020 ?Closed

Scott

• SP patch

• IDP-2083: Treat NonnullElements as the default for collectionsClosed

  • All reviewed except IdP, started on that. Goal is removal of annotation from all Java source.

• IDP-2082: Metric EnhancementsClosed

  • Included a change to existing dynamic metadata metrics to default in a better name for them

  • About done here except the plugin/module state reporting, possibly worth adding a gauge for “available” IdP version too?

• https://shibboleth.atlassian.net/browse/IDP-1806

  • → https://shibboleth.atlassian.net/browse/JSSH-33

  • → https://shibboleth.atlassian.net/browse/IDP-2130

  • TL;DR, we had a lot of redundant bean definitions and a lot of missing ones in the tests, causing inconsistent observed behavior around property replacement.

  • Trying to consolidate around two context building mechanisms, SWF’s now-hooked context creation code and our builder for “everything else possible”.

• https://shibboleth.atlassian.net/browse/IDP-2068

  • Final removal of code and dependencies pending DuoOIDC incorporation of necessary classes

Tom

Other