4:03 p.m.
Attendees:
Alex Perez, Giuseppe, Heather, Ivan, Matthew
Regrets:
Roland, Scott
Notes
0 - Agenda bash
Introductions: Alexandro Perez-Mendez (JISC), working with Alex Stuart and Phil Smith
1 - Project review
a. General
Big things Ivan is looking at: making a plan to convert Satosa to use a framework (flask,
fastAPI, etc); figuring out better logging and introducing parts of OpenTelemetry
(https://opentelemetry.io/) into the code to help add traces and possibly switching to
structured logging.
Hannah has a draft PR about logout support on Satosa. For that, we need to keep some
state, and this PR offers an opportunity to consider that again.
• Do we have documentation on the schema for session storage? Session storage is a python
dictionary that is not validated. A basic schema would help organize this and our
migration to a new framework. Different pieces (microservices) need to have access to the
same part of the state, which makes the keys and cleaning up the state more complicated.
This would have to be resolved on the plugins.
• Can we rename "microservice" to "plugin"?
Any move towards supporting the wallet framework as per eIDAS 2 and the European Digital
Identity Wallet Architecture and Reference Framework
(https://digital-strategy.ec.europa.eu/en/library/european-digital-identity-…
The ARF specifies two flows - the remote flow using OIDC and the proximate flow where
RFIDs will be used. Can Satosa work with those things? The plan is to support the OIDC
flows and look later at the other flows. The relevant OIDC specifications are still in
draft. The Verifiable Credentials are part of what make this complicated; we need to pick
a credential profile and make sure we can support that, then consider how they are signed,
whether they can support selective disclosure, etc. There will be dedicated calls for
this, organized by Ivan.
b. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP,
JWTConnect-Python-CryptoJWT, etc)
No updates
c. Satosa - https://github.com/IdentityPython/SATOSA
Looking at the following:
• https://github.com/IdentityPython/SATOSA/pull/429
• https://github.com/IdentityPython/SATOSA/pull/433
• https://github.com/IdentityPython/SATOSA/pull/427
• https://github.com/IdentityPython/SATOSA/pull/405
Expect a new release in the next week or so.
d. pySAML2 - https://github.com/IdentityPython/pysaml2
Ivan working on a fix for a Windows issue
(see https://github.com/IdentityPython/pysaml2/pull/665 for a description; that PR
isn't going in, but it does describe the problem). When this is ready, he will cut a
new release.
Also working on https://github.com/IdentityPython/pysaml2/pull/898 ; this will also go
into the new release.
e. Any other project (pyFF, djangosaml2, etc)
pyFF - Leif is preparing a new release. There have been fixes and merges, so a new release
is due. Matthew is working on a docker image (as well as a thiss.js container that would
use a simple HTML template to implement a centralized discovery service). Alex and JISC is
interested in this work. They have a small docker compose script available that is close
to working.
• https://github.com/IdentityPython/pyFF/issues/243
Note there is a thiss.io slack channel. Can continue discussion there. Can also create a
pyFF channel if that would be more helpful.
2 - AOB
Note: Admin task - Pavel, one of the contributors to the independent OIDC front end to
Satosa, and his team have been invited to join the OIDC channel in Slack. Need to approve
their participation.
Thanks! Heather