5.2.0 (Unreleased)

Changes to Defaults or Behaviors

CAS Service URL Handling

The code used to parse URLs and add the CAS ticket parameter to the end was based on a Spring class that has been implicated by 3 separate security issues in the last few years. We have remediated this code to use the same URL parsing and re-encoding class used in the SAML code, but it is very likely this change could impact badly-behaved applications and URLs that, shall we say, “push” the boundaries of what’s legal.

We don’t know exactly what edge cases Spring supported, so it’s difficult to say what the impact of this change will be. We would encourage testing of this release if you use CAS, to make sure any unusual application URLs aren’t mishandled.

Property Lookup

A bug was fixed such that the IdP’s support for locating additional property files (the idp.additionalProperties and idp.searchForProperties settings) now honors any externally applied values of those properties from the Spring environment, such as the OS environment or Java system properties. Prior to this release, only the values embedded in the idp.properties file were noticed. It is exceedingly unlikely to affect anyone, but in the event you have those properties defined externally, they were not being used and now will be.

New Features

The subject canonicalization feature used after authentication has been redesigned and made simpler to configure when combining multiple login methods in a deployment. New documentation is available in PostLoginCanonicalizationConfiguration. Those with complex c14n setups may wish to review for areas of simplification.

New Objects

shibboleth.authn.UsernameCookieManager

New Properties

idp.session.storageThreshold
idp.authn.<flow>.c14n.flows

Browser not supported