/
2026-06-05

2026-06-05

Shibboleth Developer's Meeting, 2026-06-05

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2026-06-19. Any reason to deviate from this?

90-120 minute call window

Call Details

This week's call will use a CSC Zoom room

  • Meeting ID: 692 9380 0450

  • https://cscfi.zoom.us/j/69293800450

AGENDA

  1. Destroying destruction (Rod)

  2. Member webinar planning

  3. Future of repository hosting

  4. IdP 5.3 vs. 6.0…

Attendees:

Brent

 

Daniel

 

Henri

  • OpenID Federation

    • oidfed-common

      • New abstract oidfed/resolve-trust-chains flow

        • Other flows may inherit it and call ChooseResolutionMethod state to start the resolution

        • Supports remote (resolve entity API) or local trust chain resolution

        • Provides poilcy-compliant trust chains (federation policies, constraints, not restricted to any specific entity type)

      • New admin flow test-trust-chain-resolution

        • CLI via bin/test-trust-chain-resolution.(sh/bat)

        • Exploits the abstract resolution flow, locally or via remote API

        • Displays all the policy compliant trust chains, optionally also raw entity statements and trust mark details

          • Perhaps should also display uncompliant trust chains, TBD

    • OP oidfed

      • Exploits the new abstract resolution flow

  • OIDC-common

Ian

  • Debian 11 and RHEL 8

  • Will be out for 2026-06-19 meeting.

John

  • No updates (still trying to find a way out of this time warp )

Marvin

 

Phil

  • Not so much; vacation and then my body fell apart for a few days

  • WebAuthn 1.4.2 release, Yubico bugs

  • Drafted some SAML and OIDC videos

    • Needs work

  • Back to logout on the OIDC-SP

    • Thanks to Scott for walking me through how he has that working. Seems like it should fit for OIDC.

 

Rod

  • https://shibboleth.atlassian.net/browse/JSSH-71

    • A deep dive into component lifecycle.

    • With a side swipe into metrics (https://shibboleth.atlassian.net/browse/OSJ-445)

    • Iterating towards a three part solution

      • GC-driven task teardown

      • Name Driven teardown (for metrics)

      • (project private) Annotation driven teardown for heavyweight Servicable Components like metadata refresh). The Spring Disposable would be a more natural fit, but we have burnt that bridge with DestructableComponent

    • I think this will be safe but we will be left with a great deal of Spring cleanup (p:default-destroy='destroy')

Scott

  • Implementing SAML logout in the SP

    • Successful testing this week

    • Relatively easy except that the SP has a notification feature allowing redirection through application resources during logout. All the options for that were extremely complex , so I settled on a two-stage API design to handle all the cases.

    • The Agent will have an option to control whether to log somebody out regardless of how “correct” the logout request is.

    • I believe OpenID repeated all of the fundamental mistakes SAML logout made, so the same design should accomodate it.

    • I’ll cut alpha 2 Agent release shortly, next week probably

  • Agent code cleanup around URL handling

  • Prepping for member webinar on the 24th

  • Sent a note about the old Git links…should we redirect or close down? Does redirecting even work?

Tom

  • browser tests

Other