{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"},"outline":{"value":"false"},"style":{"value":"none"},"type":{"value":"list"},"printable":{"value":"false"}},"macroMetadata":{"macroId":{"value":"93a5140f-2d9d-45f6-a76f-314f3a2b2d2d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"0d4d3dd7-718a-4f57-9fde-556133088628"}},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Upgrades MUST be done in place!","type":"text"}]},{"type":"paragraph","content":[{"text":"If you are upgrading, PLEASE follow the directions on the ","type":"text"},{"text":"Upgrading","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500925"}}]},{"text":" page and do NOT install the new version separately and then attempt to apply your old configuration files. You MUST upgrade \"in place\" by using an installation directory that contains a copy of a previously working configuration of V4.3.1.","type":"text"}]},{"type":"paragraph","content":[{"text":"Failure to do so will result in a non-working system in the majority of cases because there are absolutely essential differences between the output of the installer in the two cases to prevent your configuration from being altered in unexpected ways.","type":"text"}]},{"type":"paragraph","content":[{"text":"It is urgent that people heed this warning and attempt to modernize settings (if at all) only after upgrading and verifying the behavior of the system.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Upgrade Plugins First (and Last)","type":"text"}]},{"type":"paragraph","content":[{"text":"Less critically than the above warning, it’s advisable to upgrade any plugins you may have installed (meaning official plugins using the machinery introduced with V4.1 of the IdP) before upgrading the IdP itself, as this may prevent some extra warning noise in the log (or outright incompatibility issues noted by the installer). Upgrade and test those plugin features, and once those are validated, you can proceed to upgrade the IdP itself.","type":"text"}]},{"type":"paragraph","content":[{"text":"Usually a major upgrade (this one included) will also require a second step of updating most or all of your plugins afterward, which needs to be done before attempting to start the upgraded IdP, as the old ones will in many cases not be compatible with it. The installer will warn about this and report which plugins are in need of an update.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Please review these release notes before upgrading your system. You should review the notes for all the versions subsequent to the one you're running prior to upgrade, including referring back to older ","type":"text"},{"text":"V4","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499"}}]},{"text":" notes.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Known Issues","type":"text"}]},{"type":"paragraph","content":[{"text":"These are bugs that have an active potential impact on use of the latest released version of the software.","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/OSJ-429"}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The V5.1.4 patch release contains a couple of spurious warnings that emit on every redirect request that doesn’t contain a signature, they shouldn’t be logging that high. For the moment, raising the log config for the category to ERROR is the only workaround:","type":"text"}]},{"type":"codeBlock","content":[{"text":"","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/IDP-2223"}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When plugins are upgraded, their modules will add “idpnew” files per usual but the version label added to the filenames will be the current IdP version and not the plugin’s version. The API changes to fix this are done but the plugins in general will remain compatible with IdP V5.0 and so the bug will persist until they break compatibility with that version.","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/IDP-2288"}},{"text":" ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When logging for Spring is active at at least WARN, the IdP will warn at startup because of a usage pattern that has been revised for a future version. The warnings are more numerous when the OIDC plugins are installed. They are not harmful, but unfortunately can’t be avoided until the release of the fix (other than log suppression). The warnings take the form:","type":"text"}]},{"type":"codeBlock","content":[{"text":"WARN [org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker:437] - Bean 'org.opensaml.saml.metadata.resolver.filter.impl.EntitiesDescriptorNameProcessor#0' of type [org.opensaml.saml.metadata.resolver.filter.impl.EntitiesDescriptorNameProcessor] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying). Is this bean getting eagerly injected into a currently created BeanPostProcessor [net.shibboleth.spring.metadata.NodeProcessingAttachingBeanPostProcessor#0]? Check the corresponding BeanPostProcessor declaration and its dependencies.","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/IDP-2377"}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In some instances, Java servlet filters defined locally and installed via ","type":"text"},{"text":"web.xml","type":"text","marks":[{"type":"em"}]},{"text":" will not be applied to requests and responses. We believe, but have not verified, that this broke in V5 due to the migration of the IdP’s own filters into an internal, dynamically registered set, and is related to filter order, something Java only provides mechanisms for with static filter definition. It’s likely that the only practical solution will be to attach filters using Spring beans in a manner that may require changes to filter implementations.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Note to Developers","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have extension code, plugins, etc., there are numerous changes to the API (principally at the lowest levels) that require in most cases a reimport of the missing classes. Deleting any missing imports and re-importing them via your IDE will resolve a large number of issues, provided that you have updated your POM appropriately. See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3251470353"}},{"text":" for an explanation of the layout of the V5 library stack and POM import templates.","type":"text"}]},{"type":"rule"},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"hide-if","parameters":{"macroParams":{"groupIds":{"value":"3044ecc0-ab9b-4643-8f12-33334e34fd8b"},"users":{"value":""},"specialUsername":{"value":"anonymous"},"matchUsing":{"value":"any"}},"macroMetadata":{"macroId":{"value":"455e5198-55da-4114-95b2-16d8849090af"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://visibility.bolo.appfire.app/assets/hide-if80x80.svg"}}],"title":"Visibility - Hide if"}},"localId":"4b6ce2e9-d0fd-489b-a2d9-27cf6da60780"},"content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"5.2.0 (Unreleased)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Changes to Defaults or Behaviors","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"CAS Service URL Handling","type":"text"}]},{"type":"paragraph","content":[{"text":"The code used to parse URLs and add the CAS ticket parameter to the end was based on a Spring class that has been implicated by 3 separate security issues in the last few years. We have remediated this code to use the same URL parsing and re-encoding class used in the SAML code, but it is very likely this change could impact badly-behaved applications and URLs that, shall we say, “push” the boundaries of what’s legal.","type":"text"}]},{"type":"paragraph","content":[{"text":"We don’t know exactly what edge cases Spring supported, so it’s difficult to say what the impact of this change will be. We would encourage testing of this release if you use CAS, to make sure any unusual application URLs aren’t mishandled.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Duplicate IdPAttributes","type":"text"}]},{"type":"paragraph","content":[{"text":"In various cases such as the ","type":"text"},{"text":"External","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369"}}]},{"text":" and ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":" login flows, when IdPAttributes are produced in a variety of ways, the IdP had been collapsing collections containing duplicate attribute IDs by dropping the duplicate identified objects. That was a mistake and we have adjusted the APIs and code paths to ensure that duplicate IdPAttributes (by ID) are “merged” by combining their values. This preserves more data but at the risk of creating duplicate values in some cases, which was the original intent as we do not in general guarantee de-duplication of values outside of the ","type":"text"},{"text":"AttributeResolver","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":" itself.","type":"text"}]},{"type":"paragraph","content":[{"text":"In some cases, this change may result in additional and/or duplicated data being supplied to relying parties than had been true before, but only in cases where the produced IdPAttributes' identifiers happen to collide, whether by design or by mistake. Correctly implemented relying parties should never be seriously impacted by this change, and in such cases there are ample configuration options for resolving the situation by supplying non-overlappiing IdPAttributes where necessary.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Property Lookup","type":"text"}]},{"type":"paragraph","content":[{"text":"A bug was fixed such that the IdP’s support for locating additional property files (the ","type":"text"},{"text":"idp.additionalProperties","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"idp.searchForProperties","type":"text","marks":[{"type":"strong"}]},{"text":" settings) now honors any externally applied values of those properties from the Spring environment, such as the OS environment or Java system properties. Prior to this release, only the values embedded in the ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" file were noticed. It is exceedingly unlikely to affect anyone, but in the event you have those properties defined externally, they were not being used and now will be.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Features","type":"text"}]},{"type":"paragraph","content":[{"text":"The subject canonicalization feature used after authentication has been redesigned and made simpler to configure when combining multiple login methods in a deployment. New documentation is available in ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4253450242"}},{"text":". Those with complex c14n setups may wish to review for areas of simplification.","type":"text"}]},{"type":"paragraph","content":[{"text":"In Attribute filtering Three new Policy Rules are available which filter based on the ","type":"text"},{"text":"protocolSupportEnumeration","type":"text","marks":[{"type":"code"}]},{"text":"inside the SAML metadata role. (","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4341563393"}},{"text":" ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4341989378"}},{"text":" ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4342185985"}},{"text":" )","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Objects","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.UsernameCookieManager","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.session.storageThreshold","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506072"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.cookie.sameSite.autoDisableFilter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn..c14n.flows","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.1.4 (March 27, 2025)","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System Jira"},"jqlQuery":{"value":"filter=10201 "},"count":{"value":"true"},"serverId":{"value":"f52c7d31-6eab-3f0e-93c3-231b5754d506"}},"macroMetadata":{"macroId":{"value":"66a949cd-9d8e-4578-8d3b-72a823e9a435"},"schemaVersion":{"value":"1"},"title":"Jira Legacy"}},"localId":"66782400-71f4-4fc1-a7f3-74d2e413f827"}}]},{"type":"paragraph","content":[{"text":"This is a patch release addressing an OpenSAML security advisory (TBD) and a number of other outstanding bugs.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that the fixes for the advisory included a couple of spurious warnings in the log, as noted above under Known Issues. They appear when processing unsigned requests, and are safely ignorable, they don’t have anything to do with the advisory issues.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Relevant Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"Those using the ","type":"text"},{"text":"CSRF","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501137"}}]},{"text":" feature and experiencing errors on some browsers (or who did, and then turned the feature off) should note a new option to limit token generation to once per flow conversation, which should be safer to use on more browsers.","type":"text"}]},{"type":"paragraph","content":[{"text":"Anybody bitten by the problem at startup described in ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/IDP-2212"}},{"text":" should try this release and let us know if the problem persists, as it contains the only plausible fix we can come up with for what appears to be a complex Java and Spring race condition.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.csrf.token.perFlow","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501137"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.http.saml.enforceAllowedParameters","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.1.3 (July 31, 2024)","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System Jira"},"jqlQuery":{"value":"filter=10068 "},"count":{"value":"true"},"serverId":{"value":"f52c7d31-6eab-3f0e-93c3-231b5754d506"}},"macroMetadata":{"macroId":{"value":"1cf6575d-7f5f-4b3d-8ef4-6e3ea0f0ce69"},"schemaVersion":{"value":"1"},"title":"Jira Legacy"}},"localId":"02ad83fb-e159-4c67-8d7d-a90c7b2ee629"}}]},{"type":"paragraph","content":[{"text":"This is a patch release containing a number of bug fixes and some library updates. The most significant fix corrects an issue preventing the IdP from applying any defined SameSite policies to the session cookie under certain conditions, which would result in more frequent logins and degrade the SSO experience as compared to V4.","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.1.2 (April 15, 2024)","type":"text"}]},{"type":"paragraph","content":[{"text":"This is a patch release to address a Spring Framework ","type":"text"},{"text":"advisory","type":"text","marks":[{"type":"link","attrs":{"href":"https://spring.io/security/cve-2024-22262"}}]},{"text":", a repeat (actually third time) of the same URL parsing bug that resulted in the previous update and impacts the CAS protocol support feature. It also includes an update to the ldaptive LDAP implementation to address a character encoding issue and a fix for an earlier issue around decryption while proxying that was not fully addressed originally.","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.1.1 (March 20, 2024)","type":"text"}]},{"type":"paragraph","content":[{"text":"This is a patch release that updates Spring Framework to address a security issue that impacts the IdP’s CAS protocol support that was identified the day after the original V5.1.0 release.","type":"text"}]},{"type":"paragraph","content":[{"text":"This release also fixes a logout regression introduced in V5.1.0 and rolls back the planned warning on the use of hyphens in IdPAttribute names, as this warning occurs under some conditions outside the deployer’s control. It may be re-introduced in the future under more controlled conditions, so use of hyphens remains discouraged.","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.1.0 (March 13, 2024)","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System JIRA"},"jqlQuery":{"value":"filter=10063 "},"count":{"value":"true"},"serverId":{"value":"f52c7d31-6eab-3f0e-93c3-231b5754d506"}},"macroMetadata":{"macroId":{"value":"0e9d431d-a6d0-45a2-b039-4edd35a5ba25"},"schemaVersion":{"value":"1"},"title":"Jira Legacy"}},"localId":"b96168b5-3912-46bc-83f9-36a2da16a00a"}}]},{"type":"paragraph","content":[{"text":"This is a minor upgrade containing some new features and some changed defaults (more than are sometimes typical with our minor updates). Please review this information carefully when upgrading.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Changes to Defaults or Behaviors","type":"text"}]},{"type":"paragraph","content":[{"text":"The following defaults have changed for both new installs and upgrades and should be reviewed for possible incompatibilities:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In keeping with best practices, we have changed the default behavior of our HTTP clients to limit TLS versions to 1.2 and 1.3. While Java’s own defaults automatically limit this, those don’t apply to the outbound connections made with the Apache HttpClient library. In the unlikely case that you run into a scenario requiring TLS < 1.2, you can supply a different set of allowed protocols via an ","type":"text"},{"text":"HttpClientSecurityParameters","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.httpclient.HttpClientSecurityParameters"}}]},{"text":" bean and inject it wherever required (limiting it to that specific case). To allow for this, we have changed the internal handling of many settings such that they no longer prevent the use of such a parameters object but will merge its settings into the final set of parameters used.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.csp","type":"text","marks":[{"type":"strong"}]},{"text":" property default has been changed to include additional Content Security Policy (CSP) rules that are not expected to impact deployers but provide some additional protection against injected content. You can examine the default ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" file (created alongside when upgrading) and review the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}},{"text":" topic for more details.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When not overridden, the internal templates used for the views rendered for the SAML POST (and related) binding include new CSP additions by default. These can be disabled by setting the new ","type":"text"},{"text":"idp.encoders.cspEnabled","type":"text","marks":[{"type":"strong"}]},{"text":" property to false. This is discussed in the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}},{"text":" topic.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"While not a breaking change, the IdP now warns when hyphens appear in an attribute ID. This is discouraged due to the difficulty in using the attribute ID in contexts like scripting. This is most likely to be noticed by those with existing deployments of the OIDC OP plugin, which used them in the examples for the subject ID claim, but this is easily corrected (and will be adjusted in the next plugin release’s defaults).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Some internally necessary changes have resulted in a breaking change to a configuration syntax that was never intended to work, but accidentally did, namely using a String-based collection or value to set the ","type":"text"},{"text":"defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" profile configuration option in ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":". That is, this worked by accident in previous releases, including V5.0.0:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"To see specific examples of this setting and the related issues around using it, see the profile configuration documentation (in the Authentication) sections, such as ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508680"}},{"text":". Note that the exact type of Principal object needed will usually vary in other profiles.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Other Relevant Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"views/logout-complete.vm","type":"text","marks":[{"type":"em"}]},{"text":" template was altered (for new installs only) to generalize a “completion” indicator so that the OIDC OP plugin’s upcoming logout support will be automatically compatible with it. In the absence of the change, the plugin’s logout flow will not complete fully in certain cases, though much of the important work will still happen. The change is as follows:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Old logout-complete.vm:","type":"text"}]},{"type":"codeBlock","content":[{"text":" \n #if ( $profileRequestContext.getProfileId().contains(\"saml2/logout\") )","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"New logout-complete.vm:","type":"text"}]},{"type":"codeBlock","content":[{"text":" \n #if (!$logoutContext.flowComplete)","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this change will ","type":"text"},{"text":"not","type":"text","marks":[{"type":"em"}]},{"text":" work on older IdP versions < 5.1 as it relies on an API addition to support the change.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Features","type":"text"}]},{"type":"paragraph","content":[{"text":"The limited Content Security Policy (CSP) support in previous versions has been significantly extended to allow more control over the use of Javascript in views. See the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}},{"text":" topic.","type":"text"}]},{"type":"paragraph","content":[{"text":"The error handling view, when used by the MVC layer outside of Spring Web Flow (e.g., using the back button) has been extended to populate more of the “standard” variables available to the view under other conditions.","type":"text"}]},{"type":"paragraph","content":[{"text":"Some new variables have been added to the ","type":"text"},{"text":"Password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]},{"text":" login view, see ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510821"}},{"text":" and a new approach to error message handling in that view is now provided.","type":"text"}]},{"type":"paragraph","content":[{"text":"Internal support for adding new view rendering technologies at runtime via plugins was introduced, with the first example being ","type":"text"},{"text":"Thymeleaf","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3417178113"}}]},{"text":". (We do not have an estimated release date for that plugin as we are so far unable to verify the keys needed to verify the artifacts.)","type":"text"}]},{"type":"paragraph","content":[{"text":"A feature to add arbitrary request headers to the logging MDC was added. See the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509659"}},{"text":" topic.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511404"}},{"text":" tool has a new “unfiltered” option to include unfiltered attributes in the dump.","type":"text"}]},{"type":"paragraph","content":[{"text":"Transcoding registry service","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510553"}}]},{"text":" rules now support the use of SAML metadata “tags” to specify overridden names to use when encoding SAML (or other protocol) Attributes into responses. This is an alternative to the use of a ","type":"text"},{"text":"relyingParties","type":"text","marks":[{"type":"code"}]},{"text":" attribute to limit encoding rules to specific SPs.","type":"text"}]},{"type":"paragraph","content":[{"text":"Some login flows now provide support for saving a username into a sealed cookie, and recovering the cookie value to pre-populate the username in some cases. Currently this support is limited to the ","type":"text"},{"text":"Password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]},{"text":" flow but may be leveraged by custom flows with additional effort.","type":"text"}]},{"type":"paragraph","content":[{"text":"A new ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element is supported for defining regular expression-based conditions in several ","type":"text"},{"text":"metadata filters","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507005"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"A new variable, ","type":"text"},{"text":"shibboleth.AttributeHelper","type":"text","marks":[{"type":"code"}]},{"text":" , is available in some intercept flows and the ","type":"text"},{"text":"Hello World","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510241"}}]},{"text":" flow. It is also available in many error views (where it may be less useful). This provides a simpler means of accessing any resolved attribute values. See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510821"}},{"text":"for more details.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Objects","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.CSPDigester","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.CSPNonce","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.warning.CookieCondition","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510081"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.StorageAwarePersistentCookieManager","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.MDCHeaders","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509659"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.entityIDForDiscoveryStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.BiConditions.TRUE","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3355508737"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.BiConditions.FALSE","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3355508737"}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.encoders.cspEnabled","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.admin.entityID","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510151"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.cookie.storageService","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510081"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.usernameCookieName","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.usernamePrecedence","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.errorMessageFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.genericMessageID","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.SAML.convertUnknownPrincipals","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.views.velocity.activationCondition","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.views.velocity.order","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.views.jsp.order","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790"}}]}]}]}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"5.0.0 (Sep 13th, 2023)","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"jira","parameters":{"macroParams":{"server":{"value":"System Jira"},"jqlQuery":{"value":"filter=10036 "},"count":{"value":"true"},"serverId":{"value":"f52c7d31-6eab-3f0e-93c3-231b5754d506"}},"macroMetadata":{"macroId":{"value":"fdf425f1-2c83-4371-8b2a-652619e026f2"},"schemaVersion":{"value":"1"},"title":"Jira Legacy"}},"localId":"a0c5b761-7082-4e8b-afb9-b8913499b782"}}]},{"type":"paragraph","content":[{"text":"This is the first release of the fifth-generation Identity Provider software. The key documentation links are located on the IDP5 space ","type":"text"},{"text":"Home","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5"}}]},{"text":" page, such as ","type":"text"},{"text":"SystemRequirements","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511079"}}]},{"text":", ","type":"text"},{"text":"Installation","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500577"}}]},{"text":", and ","type":"text"},{"text":"Upgrading","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500925"}}]},{"text":" material. Note the new ","type":"text"},{"text":"SystemRequirements","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511079"}}]},{"text":" as they have substantially changed with regard to Java and servlet container versions.","type":"text"}]},{"type":"paragraph","content":[{"text":"This release should interoperate with all previous releases of Shibboleth and other software that supports the same ","type":"text"},{"text":"standards","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1118699530"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"As a major upgrade, the list of issues fixed and features added is numerous. Many significant changes are highlighted below, with particularly noteworthy issues highlighted in note or warning boxes.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"There are API additions, changes, and removals, and any third-party extensions will need to be checked for code compatibility and recompiled for use with this version, and any custom scripts created by deployers should be carefully tested and reviewed.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"General Notes","type":"text"}]},{"type":"paragraph","content":[{"text":"Upgrades to V5 and subsequent releases rely on an expanded use of the Module feature to track the configuration files and changes to them. Where previous releases included a copy of the “default” configuration in the ","type":"text"},{"text":"dist","type":"text","marks":[{"type":"strong"}]},{"text":" folder, V5 tracks every user-modifiable file as part of a Module such that new versions of modified files will be created during upgrades. Also a change, the file suffix used will be of the form “.idpnew-majorminorpatch”, including a version suffix allowing identification of the version that created it. As before, if a file is replaced outright for exigent reasons, the old version will have an “.idpsave” extension.","type":"text"}]},{"type":"paragraph","content":[{"text":"The V5 release includes a significant amount of code refactoring that will impact deployers in largely mechanical ways. That is, where necessary to relocate classes we have provided as much compatibility as we can to support and warn on historical usage, but where post-upgrade changes are mandatory they should largely be “grep, replace” operations changing various class names from A to B.","type":"text"}]},{"type":"paragraph","content":[{"text":"In most cases, these names may be located in scripts that can be easily adjusted. Those with Java-based customizations will of course need to revise the version(s) of any dependencies to reference to V5 “stack” of libraries and that should flag any incompatibilities. Generally deleting all imports and reimporting the various classes used will be the quickest way to update things.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Notable Class Changes","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1244.0,"localId":"fb76d618-f49a-4432-ae2c-f1332d055fad"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Old Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"New Name","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"net.shibboleth.idp.profile.context.RelyingPartyContext ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"net.shibboleth.profile.context.RelyingPartyContext","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"net.shibboleth.idp.profile.context.AuditContext","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"net.shibboleth.profile.context.AuditContext","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"net.shibboleth.idp.profile.config.SecurityConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"org.opensaml.security.config.SecurityConfiguration","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Changes to Defaults","type":"text"}]},{"type":"paragraph","content":[{"text":"The following defaults have changed for both new installs and upgrades and should be reviewed for possible incompatibilities:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.hsts","type":"text","marks":[{"type":"strong"}]},{"text":" property default has been changed from “off” to 1 year, as we assume all IdPs have long since moved to TLS endpoints.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Several default cookie names and paths have been adjusted to leverage Google’s non-standard trick of prefixing them with “__Host-” to prevent domain injection of important cookies. The path also had to be adjusted to the server root, as a requirement of that trick. There are related changes to ","type":"text"},{"text":"web.xml","type":"text","marks":[{"type":"em"}]},{"text":" described separately below. This change is generally not impactful except for one unusual case: an upgrade, using the “client-side” storage option (the default) without enabling HTML Local Storage causes a separate cookie to be used, and that cookie’s name was left alone, but is affected by the path change. In such a deployment, an older cookie with a non-root path may override the new cookie, and prevent the IdP from “seeing” the newer storage data, preventing the SSO experience. The workaround at present is to change the cookie name used for the storage data using the ","type":"text"},{"text":"idp.storage.clientSessionStorageName","type":"text","marks":[{"type":"strong"}]},{"text":" property. (In new installs, this has already been done.)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.xml.strictEntityResolution","type":"text","marks":[{"type":"strong"}]},{"text":" property, used to prevent any attempts while parsing XML to locate remotely hosted schemas, has been changed to “true” by default. This may impact deployers who are relying on ","type":"text"},{"text":"schemaLocation","type":"text","marks":[{"type":"code"}]},{"text":" hints in files that reference unknown schema locations. By design we support particular HTTP URLs that reference all our schemas to allow for editor validation, while routing all access to the schemas by the software through local copies. Using other URLs will be blocked and trigger a warning.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The XML processing code in OpenSAML has been enhanced to support a more strict form of processing that rejects unexpected/unknown XML Attributes, Elements, and even stray characters inside elements. Older versions tended to ignore them. In the vast majority of cases, rejecting such content is desirable but it is possible to turn off this processing mode by setting the property ","type":"text"},{"text":"opensaml.config.xml.unmarshall.strictMode","type":"text","marks":[{"type":"strong"}]},{"text":" to “false”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The deprecated ","type":"text"},{"text":"joda-time","type":"text","marks":[{"type":"code"}]},{"text":" library has been removed from the distribution. Any customizations that rely on this library either must be removed or the library re-added for local inclusion. The most likely historical use of it would be in the configuration of the ","type":"text"},{"text":"expiring-password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509968"}}]},{"text":" interceptor or other features reliant on date-based predicates.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Spring 6 has implemented a 10,000 character limit on the size of SpEL expressions to counter various denial of service vectors. This primarily impacts the use of some of our properties, as they are injected into Spring expressions to process them and/or allow dynamic behavior. We would, of course, not advise any approach that would lead to the use of such large properties and will review any areas of configuration that need additional flexibility as they’re reported to us.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The path/name of the low-level ","type":"text"},{"text":"metrics","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510278"}}]},{"text":" providing timing data regarding dynamic metadata resolution have changed to avoid exposing internal class names and better align to the expanded metrics available in this release. If scripts depend on these JSON structure paths and can’t be updated easily, the base name of the various metrics can be adjusted via the ","type":"text"},{"text":"metricsBaseName","type":"text","marks":[{"type":"code"}]},{"text":" setting added to the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506698"}},{"text":" schema.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A new feature of the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" login flow is the ability to better control the value of the timestamp that is associated with the results and eventually communicated to SPs. Prior to V5, the timestamp defaulted to the latest timestamp found on one of the “embedded” results being combined by the flow (e.g., when combining the results of the Password and Duo features). V5 defaults to using the earliest timestamp instead, and a property (","type":"text"},{"text":"idp.authn.MFA.useLatestTimestamp","type":"text","marks":[{"type":"strong"}]},{"text":") has been added to control this.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Various APIs have been converted from reliance on Spring’s Resource interface to our “equivalent” non-Spring Resource interface due to inconsistencies in the way resources were “derived” from strings in the configuration. In most cases, the locations of files tend to be handled with properties or Strings and this is compatible; in unusual cases where actual Spring Resource class types were defined and injected into some beans, this may break and require adjustments to the configuration.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The internal default CAS ticket service has been switched from the original server-side storage version to the encrypted/encoded service that embeds the required state into the ticket. Deployers whose configurations include the ","type":"text"},{"text":"shibboleth.CASTicketService","type":"text","marks":[{"type":"strong"}]},{"text":" bean will see no change as this bean overrides the internal default. The main impact of this change is that ticket size increases (affecting some broken clients) and that multi-hop proxying is unsupported. If the latter is needed, reverting to the in-memory version is required.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When validating a CAS proxy ticket via the proxyValidate endpoint, V4 identified the proxying service in the resultant ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" block by its CAS service URL, which did not match the protocol specification requirement of identifying a proxied service by its proxy callback URL. This issue has been fixed in V5, but this is obviously a change in behavior. Any services accepting a CAS proxy ticket and restricting access based on the identity of the proxying service should evaluate whether any changes need to be made to their configuration. See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/IDP-2028"}}]}]}]},{"type":"paragraph","content":[{"text":"The following defaults have changed for new installs but will not change for properly upgraded systems (generally these are set through explicitly uncommented properties or beans that have to be present to enable a behavior):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"None at present","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Installation and Installation Commands","type":"text"}]},{"type":"paragraph","content":[{"text":"The following should be noted:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"install","type":"text","marks":[{"type":"code"}]},{"text":" command is only available inside the distribution, and all installation (including property based installation) should be done using this script.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Many options can now be given to the installer as command line options. Nonetheless, ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500711"}},{"text":" is still possible although some properties are no longer available. Properties cannot be injected on the command line.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"All user visible or modifiable files are controlled by one of three new modules (idp.Core, idp.CommandLine, and idp.EditWebApp). This means that while local changes will almost always be retained, you will be able to see a side by side version of each file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Only batch files appropriate to the operating system (.sh for Unix and .bat for Windows) are now populated on first installation. The “wrong” type of file will generally be left behind from older installs and can be removed by hand.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A new command ","type":"text"},{"text":"update","type":"text","marks":[{"type":"code"}]},{"text":" is ","type":"text"},{"text":"available ","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3227189249"}}]},{"text":"in bin. By default this will check to see whether the IdP can be upgraded. In addition it can download and check the signature on the upgraded distribution. Additionally the IdP itself checks for available updates when it starts, and logs the result. This can be disabled with the ","type":"text"},{"text":"idp.updateCheck.enable","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Windows msi installer has been substantially rewritten and is now split between a relatively standard ","type":"text"},{"text":"IdP Installer","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500769"}}]},{"text":" and an installer for Jetty and our ","type":"text"},{"text":"jettty-base","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3255435265"}}]},{"text":" deployment files.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When enumerating all installed plugins and during various other operations, the plugin installer will now warn if a required module is unavailable.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the plugin installer changes the plugin state (by installing, removing or updating a plugin) it will output the resulting plugin state when it completes.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Changes to web.xml","type":"text"}]},{"type":"paragraph","content":[{"text":"We have heavily revised the content of the deployment descriptor file with an eye on reducing the need for deployers to override it, and reducing future conflicts if it is overridden. Much of the original boilerplate in the file is now gone and the content is now more configurable via Spring (via properties, etc.) and is auto-registering itself at runtime using newer servlet API features.","type":"text"}]},{"type":"paragraph","content":[{"text":"We have attempted to preserve as much compatibility as possible with V4-compatible versions of the file, but if you have overridden this file via ","type":"text"},{"text":"edit-webapp","type":"text","marks":[{"type":"strong"}]},{"text":", examining the new version in ","type":"text"},{"text":"dist/webapp/WEB-INF/web.xml","type":"text","marks":[{"type":"em"}]},{"text":" and modernizing the overridden version (or even better, eliminating it) is strongly encouraged.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that it is possible in most servlet containers to override context parameters using special container-specific hooks, usually in the context deployment fragment that specifies the location of the ","type":"text"},{"text":"idp.war","type":"text","marks":[{"type":"em"}]},{"text":" file. The new version of web.xml contains a few context parameters that can be used to disable the RemoteUser and X509 servlets if they are not in use, and it is advisable to override those parameters using the container rather than by overriding ","type":"text"},{"text":"web.xml","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Profile Configuration API Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"A few properties on the various profile configuration beans used in ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":" have been moved out of some shared interfaces and classes and on to specific instances of these beans where specifically appropriate. We do not expect this to impact deployers. For example, this change makes it impossible to set ","type":"text"},{"text":"signAssertions","type":"text","marks":[{"type":"code"}]},{"text":" as part of the SAML Logout profile configuration (because there are no assertions to sign). A number of such incongruities were fixed in cases where a property should never have been set due to it being non-functional.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the system fails to run correctly and indicates the relevant service’s configuration isn’t valid and/or the log is full of issues around the various profile configuration beans in that file, reviewing any unusual settings against the documentation is a good idea.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"General Configuration Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"Prior releases warned, but did not fail, on the presence of dependency or failover elements inside a ","type":"text"},{"text":"Static","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504412"}}]},{"text":" DataConnector. The schema has been updated to actually preclude them since they are unsupported.","type":"text"}]},{"type":"paragraph","content":[{"text":"Some features in older versions tended to assume the presence of relatively short XML files specific to those features, such as the various ","type":"text"},{"text":"-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" files. These files are often now optional and superfluous. In such cases, when a feature no longer relies on any required files, no Module is necessary to create or remove them, and so a number of Modules present in V4 no longer exist in V5, in particular a number of the simpler login flows such as External, RemoteUser, etc. This does not mean the features have been removed or changed, or that existing files won’t continue to work. Generally the specific documentation on a given feature will note that a particular older file may be evaluated for removal.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"HttpClient Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"The Apache HttpClient library has been updated to V5. Most of the changes to this library have been accomodated by our internal Spring declarations and we do not expect most deployers to run into compatibility issues, but testing any custom client definitions is advised. Notably, the deprecated legacy beans that used to be provided for custom client definitions have been removed, per the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510442"}},{"text":" documentation.","type":"text"}]},{"type":"paragraph","content":[{"text":"One breaking change involves HTTP Basic Authentication. While it was possible to make that work in earlier releases, the APIs used do not allow for pre-emptive authentication to avoid extra round trips, which is a fairly major issue with IdP use cases. We have added new APIs and parent beans to facilitate this in a supported and hopefully forwardly-compatible way, per the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510442"}},{"text":" documentation.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"LDAP Changes","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"5ad2200b-fa88-4d07-8028-32370fbb08b8"}},{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"7199d8be-a351-4d49-8075-69800a9c4f8d"}},{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"132d5883-df36-4d87-a6dc-c898b2cb5591"}}]}]},{"type":"paragraph","content":[{"text":"The ldaptive library has been upgraded from V1.3 to V2.x, which relies on an internal LDAP protocol implementation rather than UnboundID (or JNDI) as in older versions.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that over the course of the last several releases and particularly during the transition to V4.1, the ","type":"text"},{"text":"ldap-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" file has become incompatible with the updated implementation and will probably not function properly in an upgraded V5 system. In most cases, simpler uses of LDAP are automatically handled with the modernized ","type":"text"},{"text":"ldap.properties","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" files, and advanced cases can usually be handled in simpler ways, but you are best off starting from scratch in a sense after upgrading and modernizing the relevant files and removing the now-removed one. Members are welcome to ask for help if they have more unusual requirements that can’t be met easily.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Connection Strategy","type":"text"}]},{"type":"paragraph","content":[{"text":"General improvements have been made to quarantine unresponsive URLs so they are considered inactive for a period before being tried again. Improvements have been made to the ","type":"text"},{"text":"ROUND_ROBIN","type":"text","marks":[{"type":"code"}]},{"text":" connection strategy to make it stateful and bring it’s behavior inline with user expectations.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Lost Connections","type":"text"}]},{"type":"paragraph","content":[{"text":"The behavior in V1.3 for lost connections was lazy reinitialization, a connection wasn’t known to be lost until it was used. In V2.x when connections are lost they immediately attempt to reconnect. This feature may produce unwanted noise in logs but is generally beneficial. Note that it can be disabled.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"New Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added ","type":"text"},{"text":"startTLSTimeout","type":"text","marks":[{"type":"code"}]},{"text":" bean property to authentication and resolver configs. Allows separation of ","type":"text"},{"text":"responseTimeout","type":"text","marks":[{"type":"code"}]},{"text":", which may need to accommodate long searches, from startTLS which should occur quickly.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Added ","type":"text"},{"text":"autoReconnect","type":"text","marks":[{"type":"code"}]},{"text":" bean property to control whether lost connections automatically reconnect.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Logout Changes","type":"text"}]},{"type":"paragraph","content":[{"text":"An explicit workaround for Internet Explorer in the reporting of logout status (which itself is not a suggested approach anymore) was removed due to its reliance on an unsupported Java library to detect the browser. Given that IE is no longer supported by Microsoft, we removed the unsupported detection logic.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Removed Features","type":"text"}]},{"type":"paragraph","content":[{"text":"A number of previously deprecated features, settings, APIs, etc. have been removed. The use of these deprecated bits should have produced a standard warning either at startup or during use in the most recent releases of the software, and most of them are now non-functional or outright breaking. Eliminating warnings before upgrading is strongly advised.","type":"text"}]},{"type":"paragraph","content":[{"text":"The following non-exhaustive list of previously deprecated features have been removed:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for SAML assertion delegation (virtually undocumented for several releases)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The JPA StorageService, which has been replaced by the ","type":"text"},{"text":"JDBC","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2989096970"}}]},{"text":" StorageService plugin (not provided within the IdP itself).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Password login flow’s Extended Flow feature (supplanted as far back as V3.3 with the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" feature)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The “legacy” authn/Duo login flow reliant on the Duo “iframe” integration style, which Duo has replaced and is retiring in 2024. See the ","type":"text"},{"text":"DuoOIDC plugin","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3114041345"}}]},{"text":" for the replacement feature.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The bean facades for HttpServletRequest/Response (replaced with new “Supplier” beans in V4.3, per ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500962"}},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Legacy V2 compatibility scripting support in the Attribute Resolver (any references to edu.internet2… package names will break)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for the ","type":"text"},{"text":"exportAllAttributes","type":"text","marks":[{"type":"code"}]},{"text":" setting in DataConnectors","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"EntityRoleWhiteList","type":"text","marks":[{"type":"code"}]},{"text":" MetadataFilter type name has been removed, supplanted with the ","type":"text"},{"text":"EntityRole","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507218"}}]},{"text":" type name","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"MappedAttributeInMetadata","type":"text","marks":[{"type":"code"}]},{"text":" filter policy type name has been removed, supplanted with the ","type":"text"},{"text":"AttributeInMetadata","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501959"}}]},{"text":" type name","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Removed Objects","type":"text"}]},{"type":"paragraph","content":[{"text":"The following beans are no longer defined, so any references to them will break. Checking your files for them is a good sanity check.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.HttpServletRequest","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.HttpServletResponse","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Per ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500962"}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.NonCachingHttpClient","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.MemoryCachingHttpClient","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.FileCachingHttpClient","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Removal of old, deprecated ","type":"text"},{"text":"HttpClient","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510442"}}]},{"text":" beans","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.NonFailFastValidator","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replaced by the ","type":"text"},{"text":"failFastInitialize","type":"text","marks":[{"type":"code"}]},{"text":" setting on various DataConnectors","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.OutgoingIDWSFSSOSBindings","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Encoders.IDWSFSOAPEncoder","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Binding.LibertySOAP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.IssuingDelegatedAssertion","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.AllowedSAMLPresenters","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Part of the removed support for SAML delegation","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.PrincipalOverride","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.ExtendedFlows","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.ExtendedFlowParameters","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Part of the removed “Extended Flow” feature of the Password login flow","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.RelyingPartyConfigurationResolver","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Old facade for RelyingPartyConfiguration service, not generally used","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Removed XML Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The following settings have been removed from various schemas:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From all ","type":"text"},{"text":"DataConnectors","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3200516116"}}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"springResources","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"springResourcesRef","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"factoryPostProcessorsRef","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"postProcessorsRef","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"exportAllAttributes","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From all ","type":"text"},{"text":"AttributeDefinitions","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502907"}}]},{"text":", ","type":"text"},{"text":"DataConnectors","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3200516116"}}]},{"text":", and ","type":"text"},{"text":"AttributeFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501794"}}]},{"text":" rules:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"profileContextStrategyRef","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"contextStrategyRef","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"profileContextRef","type":"text","marks":[{"type":"code"}]},{"text":", etc.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From all ","type":"text"},{"text":"AttributeFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501794"}}]},{"text":" rules and the ","type":"text"},{"text":"Mapped","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199503134"}}]},{"text":" AttributeDefinition:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ignoreCase","type":"text","marks":[{"type":"code"}]},{"text":" (long replaced by the inverse, ","type":"text"},{"text":"caseSensitive","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From ","type":"text"},{"text":"StoredI","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504563"}}]},{"text":"d DataConnector:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"failFast","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From ","type":"text"},{"text":"RelationalDatabase","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504140"}}]},{"text":" DataConnector:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"readOnly","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From ","type":"text"},{"text":"LDAP","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199503855"}}]},{"text":" DataConnector:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"searchExecutorRef","type":"text","marks":[{"type":"code"}]},{"text":" (replaced by ","type":"text"},{"text":"searchOperationRef","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Removed Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.service.attribute.resolver.suppressDisplayInfo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.httpclient.memorycaching.maxCacheEntries","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.httpclient.memorycaching.maxCacheEntrySize","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.httpclient.filecaching.maxCacheEntries","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.httpclient.filecaching.maxCacheEntrySize","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.httpclient.filecaching.cacheDirectory","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.duo.*","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.duo.*","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Newly Deprecated Objects","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Liberty.SSOS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Liberty.SSOS.MDDriven","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.SameSiteCookieFilter (referenced in older ","type":"text"},{"text":"web.xml","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.ResponseHeaderFilter (referenced in older ","type":"text"},{"text":"web.xml","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Objects","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.EntityAttributes","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3214770177"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.MappedEntityAttributes","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3214770177"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagCandidate","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3214770177"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupString","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupBoolean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupInteger","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupLong","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupDouble","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupDuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupList","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupSet","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.TagLookupBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3203694593"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.HttpHost","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510442"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicAuthCredentials","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510442"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.UserFacingPrefixPredicate","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.discoveryRequestFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"New Properties","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"opensaml.config.xml.unmarshall.strictMode","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.updateCheck.enable","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3227189249"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.cookie.bufferingCondition","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.responseHeaderCondition","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.encoding.forceUTF8","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.logging.MDC.enabled","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509659"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.logging.MDC.createSession","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509659"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.SAML.NameIDLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.MFA.useLatestTimestamp","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.session.persistent","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506072"}}]}]}]}]},{"type":"paragraph"}],"version":1}