Attendees:
Heather, Ivan, Roland, Scott, Peter, Christos, Giuseppe
Notes:
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
The authors of draft-ietf-regext-rdap-openid are considering the use of the OIDC Federation spec. Heather has put Roland/Giuseppe in touch with the authors.
All the libraries are being updated to make it through the OIDC test suite; oidcop is the last one to be updated and is in final review. When this is complete, we can continue to work such as development efforts around identity assurance (EKYC group). The interop work is coming out of fintech. The verification of claims is related to the FAPI work; it's one part. There is a client verifcation method called MTLS, but if you're an RP that wants to use it, you have to be able to look at the certs used during the TLS communication; that's not possible in the current libraries (see https://www.python-httpx.org/advanced/#ssl-certificates)
b. Satosa - https://github.com/IdentityPython/SATOSA
Will be creating a new release for Satosa; various bug fixes.
Ivan has created a new label, "Next Release", which will tag issues and PRs that will be merged into the next release so that people know what's coming next. Ivan needs to go through the various issues to see if they need to be closed, moved, or whether more work is needed.
Ivan is looking into GitHub actions; Travis is still having problems.
Satosa and the microservices interfaces being updated to support types; goal is to keep the interfaces stable. Will do this via the data classes in pydantic. Hopes to expand this into pySAML2. This is a low level change.
c. pySAML2 - https://github.com/IdentityPython/pysaml2
New release available: https://github.com/IdentityPython/pysaml2/releases/tag/v7.1.0
We now have proper support for verifying signatures for redirect bindings on incoming authn and logout requests. See change log for more details.
There is a new capability to allow for on-demand metadata refresh. the endpoint is implemented in Satosa, but not set up by default. Could a worker in Satosa's web server be reserved for this? Ivan to look into having a separate queue to handle this task.
d. Any other project (pyFF, djangosaml2, etc)
Giuseppe needs to update djangosaml2 with the latest pysaml2.
There is a scalability issue in the eduTEAMs space (OpenID front end and the oidc libraries); they are passing JSON blobs up to 50Mb, which causes time outs. But since the data structure must be what the library expects, it's hard to pull apart this blob. No immediate solutions available.
Thanks! Heather
Welcome to time-change-confusion time of year!
Attendees
Roland, Ivan, Heather
Agenda:
0 - Agenda bash
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
Third implementor's federation draft is out for vote in the OIDF.
Roland did the last certification step (logout certification for the RP libraries). Those have been submitted, but Roland hasn't heard back yet.
Considering a TNC22 session with Giuseppe on the intended move to an OIDC federation for Italian government entities.
Projects was using a crypto library at version 3 that suddenly jumped to version 35 (they are changing both the code and the versioning scheme) but that broke many things.
b. Satosa - https://github.com/IdentityPython/SATOSA
Preparing a new release that will include resolution to an issue (https://github.com/IdentityPython/SATOSA/pull/392) that the OIDC front end using the old pyop library that did not properly handle error redirect URIs. Will set the minimum version allowed for pyop to 3.3.1. The changes bring us closer to phasing out pyop.
Ivan will redo the Satosa docker image, adding additional documentation along with a few other changes. Will be working on updating "types" first. More info will be in the code; it will be a gradual change that starts in the microservices.
https://github.com/IdentityPython/SATOSA/issues/391 - Ivan pushed a fix for this, but wants to expand the fix more to allow for rotating state-encryption keys.
c. pySAML2 - https://github.com/IdentityPython/pysaml2
Preparing a new release that will tie the verification request with a redirect binding. Expect a big change log. See https://github.com/IdentityPython/pysaml2/pull/805.
d. Any other project (pyFF, djangosaml2, etc)
No updates.
2 - Discussion
Heather is doing another browser update as part of InCommon's webinar series. Registration not required: https://internet2.edu/i2-online/
Thanks! Heather
Attendees:
Roland, Giuseppe, Johan, Maximillian H, Scott, Ivan, Heather, Peter
Notes:
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
Latest version of oidcop released last week and another release is in the pipeline.
Roland has been working on OIDF certification for the idpy software. This has helped him find several bugs and issues with the OIDF test suite; both OIDF and idpy code will be improved when this is done. We should consider using the OIDF tests as well as the idpy tests for some releases.
There will be another vote to move the OIDC federation to an Implementor's Draft. There is hesitation to move it to a proposed standard until there are more implementations in production. Note that eduTEAMS has this as a goal (after a better consent flow has been developed in Satosa, device code flow, and proper support for token exchange).
Giuseppe released the Satosa OIDC front end as a third-party application: https://github.com/UniversitaDellaCalabria/SATOSA-oidcop. There is one issue reported re: offline scopes.
b. Satosa - https://github.com/IdentityPython/SATOSA
Some new fixes, but mostly minor things. There is a new option in the context object to allow the front end to pass info to the backend re: the services requesting authn context. Previously the backend did not know about that.
• https://github.com/IdentityPython/SATOSA/commit/e7f281c2418902f3a00bed88b31…
The discovery service is now a microservice that works across protocols. With the ability to have requests go to OPs, need to consider how to improve the UX because we don't have the same metadata (name, logo) for OIDC entries. Probably need a proper JSON format for the SAML metadata that can also work for OIDC OP metadata so that the services can be treated the same way. Need to bring in Leif to discuss possibilities.
Users keep pressing the back button which presents an error page. The logs show that something went through but "magically" you're back to a previous point trying to do something you've already done. There is no server-side state, only the cookie, but may want to set some checkpoints in the cookie. Then when the user hits 'back' we know because of what's in the cookie. Then we can do things like present better error messages. Ivan still researching.
c. pySAML2 - https://github.com/IdentityPython/pysaml2
d. Any other project (pyFF, djangosaml2, etc)
2 - Discussion
Latest in browser work
• WebID has changed its name to Federated Credential Management API (FedCM) - https://github.com/WICG/FedCM
• Note that the privacycg has a thread on OAuth being tracking (https://github.com/privacycg/nav-tracking-mitigations/issues/16)
3 - AOB
For those of you at all involved in the IETF or who point to tools.ietf.org:
---
Last May we announced that tools.ietf.org would be wound down. See https://mailarchive.ietf.org/arch/msg/ietf/0n-6EXEmkTp3Uv_vj-5Vnm3o0bo/.
In that announcement, we anticipated shutdown before IETF 111. That was over-ambitious, but we are getting close to ready to complete the transition, and expect to finalize it before IETF 113.
As expected, most functionality has moved to the datatracker. A few services have, or will be, moved elsewhere.
We are tracking the moved services at https://github.com/ietf-tools/tools-transition-plan. If there are features at tools.ietf.org that you find important that are not yet available elsewhere or captured on that page, please send a note to tools-discuss at ietf.org. If you are more comfortable doing so, send a note to me (lars at eggert.org) or to Robert Sparks (rjsparks at nostrum.com)
• Scott K is moving away from consulting, but has several clients interested in Satosa, pySAML2 support. Please contact him if interested in learning more.
Thanks! Heather
Attendees:
Johan, Nikos, Ivan, Heather, Giuseppe, JohnP
0 - Agenda bash
Ivan will reach out to Scott re: something Scott has reported
1 - GitHub review
a. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
Ivan needs to look at https://github.com/IdentityPython/SATOSA/pull/378
Roland is making final comments on https://github.com/IdentityPython/oidc-op/pull/125.
See also https://github.com/IdentityPython/oidc-op/pull/124.
b. Satosa - https://github.com/IdentityPython/SATOSA
New release; many things have changed, including OIDC front end using a different way of defining the dependencies. See release notes for 8.0 (https://github.com/IdentityPython/SATOSA/commit/003881baffcd26ae2e4e3d89ba7…) Make sure you reinstall all dependencies.
Next will look at Giuseppe's PRs to make the cookie parameters configurable and to handle some error states when cookies are not properly available (we need a common way to collect the error context). Giuseppe has some code that may be useful:
https://github.com/italia/Satosa-Saml2Spid/blob/0ccc57f3c99172c8e567cac9c3e…
c. pySAML2 - https://github.com/IdentityPython/pysaml2
Will focus on pySAML2 now that the big Satosa release is done.
Need to fix (again) the CI.
d. Any other project (pyFF, djangosaml2, etc)
Giuseppe reiterates a request to get some kind of reference architecture of docker images (or some kind of documentation) that show how Satosa, pySAML2, and pyFF work together. Heather to reach out to Hannah and Ivan to see if we can make this happen.
2 - AOB
Reminder: deprecation of python 3.6 (security support ends 23 Dec 2021). See notes from 23 February 2021.
Thanks! Heather
