2024-08-16

Owned by Ian Young
Last updated: Aug 16, 2024 by Brent Putman
3 min read

Shibboleth Developer's Meeting, 2024-08-16

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2024-09-05. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

Add items for discussion here

  • (PS) WebAuthn RC announce to ‘dev’ or ‘announce’?

Attendees:

Brent

Daniel

Henri

Ian

  • Fixed the long-standing MDA signature bug, as described last time.

  • Thanks to Phil and Alex, MDA 0.10.0 is now in production in the UKf.

John

  • Nothing new to report

  • Next up in no particular order:

    • Remove SPEC support for SUSE, and maybe old RHEL versions too

    • Copy/sign build targets

    • Keep builder images in ECR

Marvin

 

Phil

  • WebAuthn version 1 release.

    • Did not release v1, moved to a release candidate instead, version 1 expect end of august or early september

    • Issues caught while testing the beta:

      • Random number generation using SecureRandom.getInstanceStrong() used the NativePRNGBlocking type. Which can hang on use.

      • Client-side storage was not being read from or written too properly for the admin flows. Affecting deployments which wanted to store credentials in the browser, which is not the default.

      • Some additional logging and property cleanups.

  • Possible WebAuthn next steps after v1:

 

Rod

  • Jetty plugin now installs jet and a bat/sh file to run it from a command line: Volunteers for unix testing

  • Developing some ideas on using it to replace the windows installer

    • It hinges on making the windows installer a shell around plugin -I net.shibbleth.idp.plugin.jetty

    • The amount of work will depend on how lenient the customers will be (so we will need to engage with them)

    • But first I want to get all the post install configuration script driven (if possible)

Scott

  • IdP patch

    • Metadata gen still broken, but not planning to rush that out. Suggesting we fully deprecate that for 6.0 and build a new online flow to generate IdP metadata after install if desired.

  • SP development

    • Most of SAML 2 initiator working, supporting options from profile config combined with agent input, subject to policy

    • Working on “state token” management implementations for RelayState, have untested versions using StorageService and cookies as in current SP

      • Don’t see a practical way to avoid exposing resource URLs to the hub, though I’d rather that weren’t a requirement, though in principle an agent could build more code inside itself to mask them, I just don’t intend to.

Tom

Other