5.2.0 (Unreleased)

Changes to Defaults or Behaviors

CAS Service URL Handling

The code used to parse URLs and add the CAS ticket parameter to the end was based on a Spring class that has been implicated by 3 separate security issues in the last few years. We have remediated this code to use the same URL parsing and re-encoding class used in the SAML code, but it is very likely this change could impact badly-behaved applications and URLs that, shall we say, “push” the boundaries of what’s legal.

We don’t know exactly what edge cases Spring supported, so it’s difficult to say what the impact of this change will be. We would encourage testing of this release if you use CAS, to make sure any unusual application URLs aren’t mishandled.

Duplicate IdPAttributes

In various cases such as the External and SAML login flows, when IdPAttributes are produced in a variety of ways, the IdP had been collapsing collections containing duplicate attribute IDs by dropping the duplicate identified objects. That was a mistake and we have adjusted the APIs and code paths to ensure that duplicate IdPAttributes (by ID) are “merged” by combining their values. This preserves more data but at the risk of creating duplicate values in some cases, which was the original intent as we do not in general guarantee de-duplication of values outside of the AttributeResolver itself.

In some cases, this change may result in additional and/or duplicated data being supplied to relying parties than had been true before, but only in cases where the produced IdPAttributes' identifiers happen to collide, whether by design or by mistake. Correctly implemented relying parties should never be seriously impacted by this change, and in such cases there are ample configuration options for resolving the situation by supplying non-overlappiing IdPAttributes where necessary.

Property Lookup

A bug was fixed such that the IdP’s support for locating additional property files (the idp.additionalProperties and idp.searchForProperties settings) now honors any externally applied values of those properties from the Spring environment, such as the OS environment or Java system properties. Prior to this release, only the values embedded in the idp.properties file were noticed. It is exceedingly unlikely to affect anyone, but in the event you have those properties defined externally, they were not being used and now will be.

Mitigating the impact of shibboleth.net servers being down

Subsequent to a DOS attack on the shibboleth,net servers, some users reported errors during restart and very slow responses to metrics enquiries. To mitigate this we have made two changes

In addition controlling the report of update status during restart, the idp.updateCheck.enable property now also controls whether the IdP return the net.shibboleth.idp.installation.idp.details and the net.shibboleth.idp.installation.plugin.details metrics. Reporting these metrics involves making queries to shibboleth.net (for the IdP and Shibboleth project plugins).
The default configuration of the update status check and the above mentioned metrics has been changed with shorter timeouts, allowing for faster (error) responses.

Note that the plugin command line and update command line have not been changed. Users can already control any timeout by injecting a customer httpCllient into the configuration with the -hc command line qualifier.

New Features

The subject canonicalization feature used after authentication has been redesigned and made simpler to configure when combining multiple login methods in a deployment. New documentation is available in PostLoginCanonicalizationConfiguration. Those with complex c14n setups may wish to review for areas of simplification.

In Attribute filtering Three new Policy Rules are available which filter based on the protocolSupportEnumerationinside the SAML metadata role. (ProtocolSupportConfiguration IssuerProtocolSupportConfiguration ProxiedRequesterProtocolSupportConfiguration )

New Objects

shibboleth.authn.UsernameCookieManager

New Properties

idp.session.storageThreshold
idp.cookie.sameSite.autoDisableFilter
idp.authn.<flow>.c14n.flows