FYI
--
jocar
> Begin forwarded message:
>
> From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
> Subject: Shibboleth Identity Provider V5.1.2 and V4.3.3 now available
> Date: 15 April 2024 at 19:36:20 CEST
> To: "announce(a)shibboleth.net" <announce(a)shibboleth.net>
> Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
> Reply-To: users(a)shibboleth.net
>
> The Shibboleth Project has released patch updates to the V5 and V4 IdP software [1] to address a re-issued Spring advisory..
>
> The original March advisory from us has been updated [2] and will be resent to the announce list shortly, and clarifies the IdP versions that address the issue (to our knowledge at least).
>
> We will be taking steps in the future to address the specific dependency on Spring in this scenario in case they continue to discover more problems with it.
>
> -- Scott
>
> [1] http://shibboleth.net/downloads/identity-provider/
> [2] https://shibboleth.net/community/advisories/secadv_20240320.txt
>
> --
> To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net
Hej igen,
Shibboleth har också släppt en ny version av autentiseringsmodulen till
Shibboleth IdP som gör att det går att använda en OIDC Provider som
inloggningstjänst istället för de inbyggda möjligheterna i Shibboleth IdP.
Det gör att du t.ex. kan använda Entra ID för inloggning i er Shibboleth
IdP.
Pål
*From:* announce <announce-bounces(a)shibboleth.net> *On Behalf Of *Philip
Smart via announce
*Sent:* Thursday, April 11, 2024 3:04 PM
*To:* announce(a)shibboleth.net
*Cc:* Philip Smart <Philip.Smart(a)jisc.ac.uk>
*Subject:* OIDC Relying Party Authentication Proxy Plugin v2.1.0 Now
Available
The Shibboleth Project has released V2.1.0 of the OIDC Relying Party (RP)
authentication plugin (see the documentation at [1] and the release notes
at [2]).
In addition to internal plugin cleanup, this release adds PKCE support,
support for the ‘display’ authentication request parameter, and allows the
injection of a custom strategy for adding arbitrary claims to the request
object.
-- Phil Smart, on behalf of the team
[1]
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OI…
[2]
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3239968769/OI…
Jisc is a registered charity (number 1149740) and a company limited by
guarantee which is registered in England under company number. 05747339,
VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company
limited by guarantee which is registered in England under company number
02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall
Lane, Bristol, BS1 6NB. T 0203 697 5800.
Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company
limited by shares which is registered in England under company number
09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall
Lane, Bristol, BS1 6NB. T 0203 697 5800.
For more details on how Jisc handles your data see our privacy notice here:
https://www.jisc.ac.uk/website/privacy-notice
Hej,
För er som använder eller är intresserade av använda OIDC plugin i
Shibboleth IdP...
Pål
> -----Original Message-----
> From: announce <announce-bounces(a)shibboleth.net> On Behalf Of Henri
> Mikkonen
> Sent: Thursday, April 11, 2024 2:45 PM
> To: announce(a)shibboleth.net
> Subject: OIDC OP v4.1.0 now available
>
> The Shibboleth Project has released V4.1.0 of the OIDC OP plugin (see
> release notes at [1])
>
> This is a feature release that adds support for OIDC logout along with
> some general improvements and minor bug fixes.
>
> Acknowledgement to DAASI: their back-channel logout propagation plugin
> was used as a basis for the logout feature implementation.
>
> -- Henri Mikkonen, on behalf of the team
>
> [1]
>
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2776760321/O
> PReleaseNotes
> --
Hej,
På vårens Sunetdagar finns ett antal inplanerade pass runt
identitetshantering. Det fulla programmet finns på Sunetdagarwebben
<https://registration.invajo.com/2d97d036-e9cf-49be-bf6a-ba2aca5b99a5?page=8…>
men här finns identitetspassen i en lista, även publicerad på
Identitetshantering
på Sunetdagarna våren 2024 - Sunet Wiki
<https://wiki.sunet.se/pages/viewpage.action?pageId=190283916>.
- Forskningstjänsternas behov av identiteter för forskare, Tisdag, 23
april, 15:00 - 15:30
- IdP:er för digitala nationella prov (huvudmanna-IdP:er, eduID
Connect), Tisdag, 23 april, 15:40 - 16:10
- eduGAIN – SWAMID utanför Sverige, Onsdag, 24 april, 11:25 - 12:00
- Vad är på gång i SWAMID?, Onsdag, 24 april, 15:15 - 15:45
- EU Digital Identity wallet (EUDIW), Onsdag, 24 april, 15:55 - 16:25
- Sunet Drive – Multifaktorsautentisering på djupet, Torsdag, 25 april,
09:55 - 10:25
Anmälan till Sunetdagarna är stängd men listan är till för er som anmält er.
Pål
Hej,
Idag den 22 mars hade vi årets första SWAMID Board of Trustees. Protokollet
är nu publicerat på
https://wiki.sunet.se/display/SWAMID/SWAMID+BoT+2024-03-22. Denna gång blev
fyra organisationers uppdaterade Identity Management Practice Statement
godkända. SWAMID Operations rapporterade om aktuell status för årets
tillitsprofilöversyn och tre övriga frågor lyftes. Korta sammanfattningar
finns i protokollet.
Pål
FYI
--
jocar
SWAMID Operations
> Begin forwarded message:
>
> From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
> Subject: Shibboleth Identity Provider V4.3.2 now available
> Date: 21 March 2024 at 15:13:51 CET
> To: "announce(a)shibboleth.net" <announce(a)shibboleth.net>
> Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
> Reply-To: users(a)shibboleth.net
>
> The Shibboleth Project has released a patch release of the V4 Identity Provider branch, to address the security advisory issued yesterday [1] and a few other bug fixes and library updates.
>
> The software is now available from the usual place [2] and the release notes are updated [3].
>
> It is hoped that this will be the final V4 IdP release, pending any other security issues identified. Security maintenance and support will end Sept 1, 2024 as planned.
>
> -- Scott
>
> [1] https://shibboleth.net/community/advisories/secadv_20240320.txt
> [2] https://shibboleth.net/downloads/identity-provider/latest4/
> [3] https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499/
>
>
> --
> To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net
Hej,
Här kommer en säkerhetsbulletin från Shibboleth. Björn skickade ut förra veckan.
Pål
________________________________
Från: announce <announce-bounces(a)shibboleth.net> för Cantor, Scott via announce <announce(a)shibboleth.net>
Skickat: den 20 mars 2024 13:47
Till: announce(a)shibboleth.net <announce(a)shibboleth.net>
Ämne: Shibboleth Identity Provider Security Advisory [2024-03-20]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Shibboleth Identity Provider Security Advisory [20 March 2024]
CAS service URL handling vulnerable to Server-Side Request Forgery
==================================================================
The Identity Provider's CAS support relies on a function in the
Spring Framework to parse CAS service URLs and append the ticket
parameter. Spring published an advisory regarding this function
and re-opened the advisory again after their latest release. [1]
Updates for both supported branches of the IdP are being provided
to update the Spring Framework version to address the issue.
Those not using the IdP's CAS protocol support are not impacted
by this issue, though all are encouraged to upgrade at their next
opportunity.
Affected Versions
=================
The Spring Framework bug is found in the versions outlined by
their advisory [1].
This implicates Identity Provider versions < 5.1.1 and < 4.3.2
when CAS is in use.
Recommendations
===============
Upgrade to Identity Provider V5.1.1 or later.
Upgrade to Identity Provider V4.3.2 or later (once available).
References
==========
URL for this Security Advisory
http://shibboleth.net/community/advisories/secadv_20240320.txt
[1] https://spring.io/security/cve-2024-22259
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmX61gAACgkQN4uEVAIn
eWLhCw/+JnhlEOBaiY+kah3LvDRa19lcAP07KEieQSvAJF5MQ9UsQlbNKdU6UgP8
EvxoSdUb0XEKe3/NSgqtkCdyPDAY3HU+9cmNYOQaw2EemFynKFACeRQctkLTUdTl
C1gdOH9dORH4HCqMMYyXoXfeX+AK4vTh2SUb53K0N/cOg4SWvNB52G7HPzhu0RIU
bOgxTX19DAwbQlcKmO9SguBjw8Ud8r/zmaS3YG4yWRs0cxwd3n4H3vKBPe2dJJk7
eJyeuiY0t3Ogaj4aII1ireaJTTubFRXGbVTejwgKGFpL4YvOaUswjxHqtnNJTuBC
l3d3gaev/kEbg0WJvUD9N2uNQ7WffCY6pJXKQeCR0mHDHG8YiZVj06Jgo+FDJRye
wJnmGP71GoC72BfQawL5tHqZf0r7DmrEY1Xs6Tq5cNlKsyIqb0Md1fcYgQJejsbX
HUbAWUHvetGoDoQk47j1OfkX7LhEU364j/7cnYjjqmmptuoXXQaPAHBDirNFjHM+
DNQ2WDGVUfiUd1aLY1U7UF/9RbB0v/VaOjPg9ExzWN6EooQsaTJfRWyMWMx+dpsF
A/wE6G/up/taaDvVuMvVlKNs/Ue0U2Ew6NfZqHWk00MrUeNSnukvMGqY0/YAWFu+
aB+elhr4prT24Q4c8m0WzVldFhavkSNrt3UVRnRk1KRQy7WfbAE=
=gO7B
-----END PGP SIGNATURE-----
--
To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net
Hej,
På Sunetdagarna nu i höst informerade vi om att SWAMIDs gamla
testfederation kommer att avvecklas och ersättas av SWAMIDs QA-federation.
QA-federationen finns på plats redan idag med samma uppsättnings verktyg
som i SWAMIDs produktionsfederation.
SWAMIDs testfederation kommer att stängas av vid halvårsskiftet 2024.
Nyregistreringar i SWAMIDs testfederation är inte längre tillåtna!
Adresser till verktyg i SWAMIDs QA-miljö:
- Metadataverktyget: https://metadata.qa.swamid.se/
- Metadata via MDQ (nya modellen): https://mds.swamid.se/qa/
- Metadata via aggregat (gamla modellen): https://mds.swamid.se/qa/md/
- Hänvisningstjänst: https://ds.qa.swamid.se/ds
- Release-check: https://release-check.qa.swamid.se/.
SWAMIDs alla instruktioner för både identitetsutfärdare och tjänster går
att använda men ni behöver byta aktuella URLar enligt ovan i
konfigurationsfilerna.
Pål Axelsson
Hej,
Jag tycker det är lite lång svarstid från operation@ på det senaste. Har jag hamnat i nåt spamfilter (igen) eller är jag bara bortskämd? :)
/Björn
Hej,
För er som använder Shibboleth IdP OIDC RP Plugin...
Pål
________________________________
Från: announce <announce-bounces(a)shibboleth.net> för Philip Smart via announce <announce(a)shibboleth.net>
Skickat: den 19 mars 2024 17:09
Till: announce(a)shibboleth.net <announce(a)shibboleth.net>
Kopia: Philip Smart <Philip.Smart(a)jisc.ac.uk>
Ämne: OIDC Relying Party Authentication Proxy v2.0.1 now available
The Shibboleth Project is pleased to announce V2.0.1 of the OIDC Relying Party (RP) authentication plugin (see the documentation at [1] and the release notes at [2]).
This latest release addresses a problem in V2.0.0 where an internal IdP jar file was inadvertently included in the plugin's distribution. This caused potential conflicts with the IdP's classpath, making it difficult for users (who use this plugin) to upgrade to newer versions of the IdP from version 5.0.0.
Version 1.x of the RP, compatible with version 4.x of the IdP, is not affected by this issue.
-- Phil Smart, on behalf of the team
[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OI…
[2] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3239968769/OI…
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
