Shibboleth Developer's Meeting, 2020-12-04

Brent

Daniel

Henri

Ian

• xmlsectool v3: GA mid-month, 15th-ish
  • UKf confirms drop-in replacement (modulo Java 8/11, CLI tweaks) on their production HSM
• IdP V3.last:
  • IDP-1720 - Getting issue details... STATUS
  • build environment
  • schedule?
• Java 16 enters Rampdown Phase One next week
  • Confirmed: 396: Strongly Encapsulate JDK Internals by Default
  • Proposed: 390: Warnings for Value-Based Classes
    • new Integer(73) would move from Deprecated (since Java 9) to Deprecated for Removal
    • Warnings will get louder
    • Full details in https://openjdk.java.net/jeps/390
    • In theory could result in removal in Java 17, which we'd care about. I'd guess not, but who can say.
    • We don't use these a lot outside of tests, and they are easy to fix up except in cases where you're looking for an object with an identity rather than a wrapped primitive. I suspect we don't have any of those, though.

John

Marvin

Phil

• JDUO-22 - Getting issue details... STATUS  - Add a nonce to the authorization request and verify it in the id_token.
  • The Duo OP supports it - seems like best practice to help prevent id_token replay attacks.  
  • Only supported using the alternative Nimbus client.
  • Duo Web SDK does not support setting it - even though they consider it in their validation step.
• JDUO-23 - Getting issue details... STATUS  - the JWT claims verify can now be injected (hence a custom one can be used). 
  • A default version and base class have been created to satisfy Duo requirements and (for the limited things possible) OIDC requirements.
• JDUO-24 - Getting issue details... STATUS  - bit weird that, the latest Duo Web SDK requests the auth code as a `duo_code` parameter rather than the OAuth2.0 standard `code`. Broke my stuff.

Rod

• IdP catch up
• SP windows build maintenance

Scott

• JOIDC-15 - Getting issue details... STATUS
  • Continued this work last week fixing problems and adding metadata configuration wiring
• JOIDC-20 - Getting issue details... STATUS
• OpenSSL patch coming next week rated "high" so rushing to finish SP 3.2 work in time for next week

Tom

• Thanks Rod for taking on IDP-1660 (consent sorting), will work on tests
• Keeping tests green
  • Java 8 'hostname' test continues to fail on CentOS7 and RHEL8 but at least is consistent
• Plan on patching server next week
• Would like to use the installer for V4 integ tests
• Long shot, but any chance we could get access to a Microsoft 365 instance ?

Other