Shibboleth Developer's Meeting, 2025-04-18

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2025-05-02. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at Ohio State:

Join Zoom Meeting
https://osu.zoom.us/j/97253793258?pwd=PtPlQofvg4v2gf1SGMXabiJi5ZIbbU.1

Meeting ID: 972 5379 3258
Password: 174086

AGENDA

1. IdP documentation project update/discusson (Steven)

2. “Property Dictionary” thoughts?

Attendees:

Brent

Daniel

• https://shibboleth.atlassian.net/browse/OSJ-410

Henri

• https://shibboleth.atlassian.net/browse/JOIDC-222

  • Initial draft implementation for the Resolve Entity API

    • Far from complete, but can already resolve RP metadata and trust chains

    • Realized that claim names related to trust marks have changed in March

  • Interop event on April 28-30

    • Conformance suite’s tests still fairly minimal, especially from OP’s perspective

Ian

• https://shibboleth.atlassian.net/wiki/spaces/XSTJ4 released. Hit build issues because it has a project structure that’s not what the enforcer expects, so I’m going to branch this and rework that for v5.

• Spring Framework 7 (probably end of 2025 alongside Java 25 LTS) will use JSpecify for nullness: https://spring.io/blog/2025/03/10/null-safety-in-spring-apps-with-jspecify-and-null-away

• Deleted (or moved to their proper location in V17) all of the V11 Jenkins jobs; removed those views. Tidy!

John

• No updates

Marvin

Phil

• Absent today

• https://shibboleth.atlassian.net/browse/JWEBAUTHN-51

  • Key nicknames can now be updated from the registration view (I was too cautious)

• https://shibboleth.atlassian.net/browse/JCOMOIDC-127

  • I think patching the transcoder to allow any Map type as a value (still using the minidev JSONObject as the container of the claims) is OK for the next patch release. (which is what I did in the commit it references)

• https://shibboleth.atlassian.net/browse/JOIDCRP-71

  • I think this one is going to need a new oidc-config and RP and OP. The OP profile beans seem to override the config ones (so they need to be removed from the OP).

• Given the new keys in the enforcer for DuoOIDC, I think I can release the next version of that next week.

• Looks like Jisc are going to approve travel to the OID Fed Interop event, so I will likely may be attending that with Henri.

Rod

• Attribute Filter new features and bug fixes (see below)

• https://shibboleth.atlassian.net/browse/JMVN-64

  • Jenkins jobs are now JDK17

  • Working from the snapshot parent pom, but looking to release the parent shortly

Scott

• https://shibboleth.atlassian.net/browse/JSHIBDSAML-1

  • Implemented correlation cookie with improvements to fix current SP issues with cookie build-up.

• Returning to agent development to start reworking Attribute and Session/SessionCache APIs and implementations

• https://shibboleth.atlassian.net/browse/IDP-2375

  • Seems to be a bug in my use of the APIs in the proxy flow, probably also impacts the RP plugin.

  • SP is affected as well.

Tom

• https://shibboleth.atlassian.net/browse/IDP-2323

Other