Shibboleth Developer's Meeting, 2025-10-03

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2025-10-17. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

1. Codeberg feedback?

2. Any release process discussion?

3. Getting to SP 4 alpha.

   1. Sketch of upgrading needed but not full docs

   2. Packaging for Linux will start by branching linbuild repo and taking a crack at the specfile

   3. Windows packaging TBD but Scott prefers we still to /opt/shibboleth-sp as default and likely an eventual MSI

      1. Probably want SxS install for the DLL, so will need to be renamed and titled for IIS

      2. Logging category DLL needs to be carved back out of static build

Attendees:

Brent

• https://shibboleth.atlassian.net/browse/IDP-2405

  • No epiphany yet. It’s a synthetic test, so just wondering if what they are doing is atypical etc.

  • Could maybe get them to log the thread name, just for sanity checking.

Daniel

• No updates

Henri

• offline this week.

Ian

John

• No updates

Marvin

Phil

• Not great progress in the last two weeks

• WebAuthn

  • https://shibboleth.atlassian.net/browse/JWEBAUTHN-62 - oversight, forgot to wire up consent revocation to the main WebAuthn view

  • I have two additional features (one implemented, one not), and I might release them so that the above bug is fixed.

  • Perhaps the registration flows should have been a different plugin to the authentication flows.

• RP-Full

  • https://shibboleth.atlassian.net/browse/JCOMOIDC-139 New settings and bit constants are needed on the profile configuration. Some done.

  • Hooked up the disallowed features function and profile configuration fallbacks to the authentication request builders.

Rod

• Single stepping the IIS agent (and the testbed) and working through the doco to get my head around the agent configuration.

• Nothing else

Scott

• Working on SP attribute docs

  • https://shibboleth.atlassian.net/browse/JSATTR-45

  • https://shibboleth.atlassian.net/browse/IDP-2407

• Finished update support in SP session cache

• Working on POST recovery implementation migrating most/all of it to Java

  • Character encoding hell

Tom

• https://shibboleth.atlassian.net/browse/JPAR-236

  • There are a couple of plugins (deploy and install) that do not need new keys, will bump those early next week

• https://shibboleth.atlassian.net/browse/GEN-352

  • One issue with Reposilite is that it does not update maven-metadata.xml when a snapshot version is deleted

    • may need to script it during a release

    • turns out that Maven itself (during mvn deploy) updates maven-metadata.xml but it only adds a version and updates the timestamp

Other