Shibboleth Developer's Meeting, 2019-09-20

Brent

• IDP-1461 - Getting issue details... STATUS
  • Re-organized and fleshed out missing unit tests.
  • Sorting out changes to Tools 1.4 → 3.0 for changes to VelocityToolboxView  and friends.

Daniel

Henri

• Progress with the OIDC/SAML metadata work
  • Plugin's flows to support both ClientInformationResolverService and MetadataResolverService - clearly simplest for the current deployers

Ian

• Java 13 build 33 (the first RC build) has become the GA version. No compatibility issues for us, but one feature that deployers may want to take advantage of.
• Working on API consistency in the MDA beans:  MDA-222 - Getting issue details... STATUS

Marvin

Phil

• Tried to get some clarity on if and when browsers would support the SameSite=Lax by default and SameSite=None only with secure flag Google IETF draft ('Incrementally Better Cookies'). Added a table to IdP SameSite Testing, but needs a bit more digging as things progress. 
• Have gone back to CSRF synchroniser token support testing
  • Tested with MFA using Password and Duo flow. Works fine as token can be placed inside the 'duo_form' - and correctly breaks without it.
  • Thinking it through with the External Authn flow. Not as easy (but just started) as token needs to be available in the session for an external servlet to grab and use (in some appropriate way), then present in the final redirect back to webflow. OR, the ExternalTransfer could be ignored by the listener, and no CSRF protection available for external authn servlets.
    • Maybe it needs to be part of the ExternalAuthenticationAPI - not sure yet.
    • Possibly unlikely to work with the redirect back from the external servlet without a new mechanism to test the token.
• Said I would help Tom with SameSite selenium tests - but as of yet I have not got back to him.

Rod

• Fail fast (and on, and on, and on)
  • Going to ignore the IdPPropertiesApplicationContextInitializer this.  Its only for tests and only used in CAS.  
    • Do we need to document it?  Or mark it internal?
  • Rename failFast to failFastInitialize for data Connectors (new attribute except for StoredId).providers? That's
  • Deprecate the LDAPConnectorPool failFastInitialize with a default of true (let that be caught in LDAP
  • Review old cases for regressions (and inspiration).
• Installer: see  IDP-1499 - Getting issue details... STATUS  for details
  • Hating the whole "interact with the user thing".  
  • I18N ?
  • IDP-894 - Getting issue details... STATUS  - Do we think we need this?
  • Note we have a one off chance to change property names in V4, 
• IDP-1235 - Getting issue details... STATUS  Thanks to Scott I have a sensible approach.  

Scott

• Security issues
• SameSite filter
  • added to V3 as a placeholder in case its needed
  • configured, currently applying to all cookies, for V4 web.xml
• Early progress on proxy login flow, starting on SAML support

Tom

• Still working on browser tests

Other