Shibboleth Developer's Meeting, 2026-01-16

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2026-02-06. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

1. Code freeze and release schedule for 5.2

2. Board update

Attendees:

Brent

• Reviewed and closed out several more minor issues

• https://shibboleth.atlassian.net/browse/JSATTR-6

  • Finished out unit tests in December

  • Started work on live testing this week after return. A few issues (more than expected) were uncovered.

  • As of yesterday night successfully executing queries against test AA now. Yay!

  • Need to continue more live testing and exercising options. Dotting T’s and crossing I’s.

Daniel

Henri

• Absent today, apologies

• Bumped oidc-common main branch into next minor

  • Still vanilla OIDC for time being (fed-features solely on OP-fed plugin)

Ian

John

Marvin

Phil

• Nearly all around https://shibboleth.atlassian.net/browse/JSHIBDOIDC-8

  • Added extra authentication state that is recovered from the OAuth ‘state’ on authentication response.

  • This allows the JWT validators to verify the response

  • Need to think about how that state is handled

    • currently issued as a cookie, but that is a hacked version of the ProcessCorrelationCookie should use the StateManager like the target URL, or similar.

Rod

• Building a gui-less WiX installer for the SP4 Windows Agent

  • We need to get out from under WiX. Agenda item for later this year

  • Now back at trying to get release DLLs running in IIS (SxS has broken so much stuff)

• Reviewed open cases for 5.2

Scott

• Moved IdP stack to EE 11, Servlet 6.1 officially to align to SWF.

  • web.xml now specifically calls out that version

  • Future POM change possible to enforce this if we want?

• Reviewing and addressing IdP 5.2 backlog items and testing snapshot

• https://shibboleth.atlassian.net/browse/OSJ-408

  • Don’t think we’re impacted by this to the extent we would have thought. My fault for completely missing how long this has been incubating.

• https://shibboleth.atlassian.net/browse/IDP-2275

  • Litigated on Slack but this was reverted for V5.2. Believe we have some ideas about how to address it if we still want to do it.

  • https://shibboleth.atlassian.net/browse/IDP-2422

• Light initial testing of Hub-backed session cache for SP

  • Proposing we consider shipping H2 as a simple drop in option in the JDBC plugin just as a quick start.

• https://shibboleth.atlassian.net/browse/JSHIBD-18

  • “Final” improvement to config before alpha to eliminate as much manual Hub set up as possble

  • Hopefully can incorporate auto-registration of additional manual bits before we ship it

Tom

• IdP 5.2 testing

Other