/
2026-07-17

2026-07-17

Shibboleth Developer's Meeting, 2026-07-17

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2026-08-07. Any reason to deviate from this?

90 to 120 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

  1. Infrastructure

    1. Gitweb shutdown

    2. Git external shutdown

    3. Downaloads and Nexus → S3

    4. Future of mailing lists

  2. IdP 5.3 branch topics

    1. Destructable replacement / timeline

    2. Caching HTTP client deprecation/removal?

  3. SP status

  4. Board update

Attendees:

Brent

  • Will prioritize getting the automated release stuff to a place (literally and figuratively) so that others can use it if need be.

Daniel

 

Henri

 

Ian

 

John

  • Having difficulty replaying SAML response to test file-based session cache in SP4. Probably missing something dumb.

Marvin

 

Phil

  • Added OIDC support to the testbed (and configured for my agent).

  • RP-Inititated logout

    • Done, only basic testing against Henri’s public OP

      • storing off the full b64 serialised id_token into session data.

    • Not looked at consuming an OP-Initiated front-channel logout, yet.

  • Duo WebSDK updates for AMR claims

    • And utility class for simplifying amr to pricnipal mappings

    • Needs new signing key for Duo’s WebSDK

  • Just started a branch for the JWKS document endpoint for the OIDC-SP

  • Features still missing (major ones, existing things need review):

    • OP-Initiate logout handling

    • JWKS Endpoint (working on it)

    • Pushed Authorisation Requests

    • Refresh token claim refresh

    • Auditing (will follow the work Scott did on the SAML SP)

    • Dynamic client registration

    • Fed Support.

 

Rod

  • Finalized Windows Agent “installer”.

    • Short on testing (but as a bat file it is scrutable if we get problems)

  • Destructability, object lifecycles.

    • Very mind bending but it an agenda item

Scott

  • DDOS mitigation

  • SP alpha2 release

  • Completing logout framework and SAML impl

  • Implementing SP Hub auditing

  • Another (sigh) refactor of Agent/Application/RelyingParty config layer to plumb additional inheritance and “unsetting” features after tester feedback.

  • Xerces bug triage work

Tom

  • Nexus > S3

Other