Shibboleth Developer's Meeting, 2021-08-20

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2021-09-03. Any reason to deviate from this?

60 to 90 minute call window.

This week's call will use the Zoom system at GU, see ZoomGU for access info.

https://shibboleth.atlassian.net/browse/IDP-1853 (notes under “Rod”)
Flip the default “Nashorn” plugin to be JDK based and leave graal an option. (Notes under “Rod”)
https://shibboleth.atlassian.net/browse/JPAR-182 (Notes under “Rod”)
Deploy to Maven Central (Tom)
- proposal : go ahead and deploy to Maven Central as-is, and schedule moving our <repo> to a profile

Add items for discussion here

https://shibboleth.atlassian.net/browse/JOIDC-52
- The bug was related to token and userinfo endpoints
- The flow tests now improved for all backend OAuth2/OIDC flows dealing with tokens
- Some incompatibilities with legacy tokens remain due to consent refactoring before V3, see table (currently restricted, to be added under release notes for 3.0.2)
https://shibboleth.atlassian.net/browse/JOIDC-55
- The custom counters/timers seem to work after adding evaluation of PopulateMetricContext after prc has been initialized
https://shibboleth.atlassian.net/browse/JOIDC-21
- Once this is done, could also help OIDC RP for the same topic?

Java 17 RC is out, final RC imminent, GA on 2021-09-14
Proposed to target Java 18: https://openjdk.java.net/jeps/400
Debian 11 (Bullseye) released
- Includes an up-to-date Java 11.
- Includes an earlier EA of Java 17, to be upgraded.
- See https://shibboleth.atlassian.net/browse/GEN-281 for details of evaluation.
- I think we can add this to the “partially supported” list in https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1177321655/Java+Distributions#Java-Distributions-for-the-Java-11-Platform (but only for Java 11 for now, of course) and call it a day.

Nothing really (holidays)
Started back on https://shibboleth.atlassian.net/browse/JCOMOIDC-23 yesterday.
Realised I was not on the Users mailing list, and a few questions had gone by about the DuoOIDC plugin. Not sure I can respond retrospectively. I could add some input to two of them via a new mail to the list?

JavaScript
- https://shibboleth.atlassian.net/browse/IDP-1853
- https://shibboleth.atlassian.net/browse/JSCRIPTING-9
  - What to call it?
Supply Chain attack. Hibernate and JBOSS worry me
- Dependency on a 8 year old and 3 major versions out of date parser (ANTLR)
- Recent, required jars are unsigned.
- Do we shake their tree or suck it up? If the latter can someone sign these jars and pop the asc files into our repository)
  - NOTE that this trick only works for as long as build.shibboleth.net remains definitive for our builds. If we move to a site we don’t own we are back being open to attack at any time. (Modulo hard wired overrides for insecure jars)
Wiki Conversion as a background activity.

https://shibboleth.atlassian.net/browse/GEN-268
- /wiki/spaces/DEV/pages/2765979673
- Will shut off Jira and downsize the server after Sep 1.
- Will archive all the Apache configs and remove the old rules, may turn off the SP, EDS, etc.
- SP metadata is in InCommon, managed by OSU, will remove after that date.