08:30 Central US / 09:30 Eastern US / 14:30 UK / 16:30 FI

Calls are normally the 1st and 3rd Wednesdays of each month. Next call would be Wednesday 2026-09-16. Any reason to deviate from this?

90 to 120 minute call window.

This week's call will use the Zoom system at GU, see ZoomGU for access info.

1. An FYI → https://shibboleth.atlassian.net/browse/GEN-364

2. Maven plugin updates

3. Spring 7.1 M1 is out. Major note: they are claiming end of OSS support 12/27 and NOT 6/28. No mention of a 7.2 or an 8.0 yet.

4. (PS) odic-common 3.3.1 patch release?

   1. Yup, release either this week or next.

• Pushed a PR to Ian’s Docker project on GitHub illustrating the container changes

• Prepping push of java-release-support, including a branch with a copy of the amazoncoretto-17 container ala the PR.

• OIDC OP

  • https://shibboleth.atlassian.net/browse/JOIDC-288

• OpenID Federation

  • Cleaning and harmonizing configurable properties, abstract beans, etc

  • Populating content to OIDFEDCommon and OIDFEDEntityConfiguration

• Debian 11 LTS is now EOL

• Continuing to make painfully slow progress toward testing SP4 agent session cache. Next steps (in no particular order):

  • Stand up my own Hub

  • Figure out how to navigate the Unsolicited SSO login form programmatically (curl? webisoget? JMeter?)

• Starting to look at the new credential resolver service.

  • Using the MapBased resolver as a first stab.

  • Need to get back to that.

• https://shibboleth.atlassian.net/browse/JDUO-102

  • https://shibboleth.atlassian.net/browse/JDUO-103

  • Duo changes to support max_age and enforce the forceAuthn semantic

• WebAuthn metadata trust root changes.

• Window Remoting work

  • https://shibboleth.atlassian.net/browse/CPPSP-13

  • https://shibboleth.atlassian.net/browse/CPPSP-63

  • https://shibboleth.atlassian.net/browse/CPPSP-62

  • https://shibboleth.atlassian.net/browse/CPPSP-38

• Update parent pom for 5.3

  • Mission creep to include libraries as well as packages

  • Case is https://shibboleth.atlassian.net/browse/JPAR-236

  • Work is logged at Maven Dependencies

  • Expect multiple mails seeking clarification or agreement on process.

• https://shibboleth.atlassian.net/browse/JSHIBD-25

  • Still some iterating but largely happy with design.

  • Storage-backed variant is supplemented with a rudimentary new StorageService that reads from the file system treating contexts and keys as paths.

    • A subclass is neeeed for each general Credential variant based on how it would be stored in its “native” form. X.509 via PEM/DER is done. Looking at a PKCS12 version,

      • This is why I was asking about the Credential factories being Spring-specific factory beans, it seems weird and unnecessary.

    • Base class supports caching, but this only works on 5.3 due to ClassCriterion lacking suitable equals()

      • Guava is directing people to something called Caffeine as a Cache replacement, needs review.

    • Surprisingly easy to confgure some very flexible scenarios on disk or in a database.

    • Docs TBD and will be somewhat specific to each subclass as far as how you configure the lookup into storage.

  • Have not thought too deeply on what other resolvers we might need, but for MVP I think this is enough once we have the OIDC variants.

• https://shibboleth.atlassian.net/browse/JMVN-80

  • then bump maven-dist-enforcer-data.version in the parent POM

    • then bump maven-gpg-plugin.version in the parent POM

      • then upgrade the Jenkins Credentials Binding plugin

• Experimenting with running Reposilite in ECS