Hej,
För kännedom.
/Paul.
SWAMID operations.
-------- Forwarded Message --------
From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
Reply-To: users(a)shibboleth.net
To: announce(a)shibboleth.net <announce(a)shibboleth.net>
Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
Subject: Shibboleth Identity Provider Security Advisory [26 August
2025]
Date: 26/08/25 14:19:55
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Shibboleth Identity Provider Security Advisory [26 August 2025]
An updated version of the Shibboleth Identity Provider is available
to address a cross-site scripting vulnerability in the CAS protocol
support when using certain request options that result in a particular
response format.
XSS vulnerability in one CAS response format
=================================================================
An XSS issue was identified in the IdP's handling of CAS responses
in certain situations. If exploited, exfiltration of cookies is
unlikely due to the default mitigations for that, but cross-site
request forgery attacks are very possible against CAS clients that
are not themselves hardened against certain kinds of malicious URLs.
Recommendations
===============
Update to V5.1.6 (or later) of the Identity Provider software. [1]
If unable to upgrade, another mitigation requires use of the CAS
Service Registry to control use of CAS (rather than the SAML metadata
extension specific to our software that many rely on) and the
expressions used to validate CAS service URLs would need to be fairly
strict and in particular avoid the use of tail-matching regular
expression wildcards that would permit essentially any decoration
of a URL to be accepted.
The SAML metadata alternative exclusively does this sort of open-
ended prefix matching and is not designed to prevent further URL
content from appearing at the end of a service URL, so its use
cannot mitigate against this issue.
Credits
=======
Discloze, Inc. <https://www.discloze.com/>
Dan Malone, California Polytechnic State University
[1] https://shibboleth.net/downloads/identity-provider/
URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20250826.txt
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmito/4ACgkQN4uEVAIn
eWIhixAAmxXv20ZKeEnYJea1A+hhIZ0eLWFUAt+7INi7RdzD8DpoAgmeMC4XjFvA
F0rKpszHa+OachTAeCYu1khaw7y46TzsnziyUS6jbO76fJuJ4tveTdW6QO4tTVFA
mEFm9MfEzpYql9pBgd0d2sCNjCB/d84smZydg+cYB8OuwCLqA0XUYg5G2rMQAwdF
hIrMd5OChPvAuRcUUs7jLYB8c+Fqftw9EgTC0TKDIBVf9izFXugnZwooSyHXYnAO
BiePaSvcnYk2jcRtc8YfldcIUuoHbrjTBJGmMRk9XTnNjkCsVF8uJLV3/2QVk7c3
IMFfac4uYX/hRV44JsHD7cYH3GWDhtTSf6b6+yUal4hhpm8ROzCJvBX2TwptzzGE
HaTV6+AgVNTmcaN5QvFPtmwUr+Ve2InpVhznp3mQa6tcuA5QAQnBh5MdQwN2HzDl
I0USekeSh3slyZCZYAeuf8D28qz6rzwlkhm0nr3uaIUwGoTaGhIIxzXL4mLC3ohN
uqeOUS64vF2xCQ6XaOfJa3ha/GnDESpx7TorJBsxYzu9HS+9+0psX842KBNIJ4Ps
s+OjXnu7Rc1z82Zf7lNlSj7PNHJEqRmQuWw0OijDMwo01x7vLg36Y9qC52gybHNa
LN2kipxdax2wxx6C0jMfCuFJ5SDQovLCInfTAKCcd5CysqPMHbA=
=3Tgc
-----END PGP SIGNATURE-----
--
To unsubscribe from this list send an email to
announce-unsubscribe(a)shibboleth.net
När du skickar e-post till Karlstads universitet behandlar vi dina personuppgifter<https://www.kau.se/gdpr>.
When you send an e-mail to Karlstad University, we will process your personal data<https://www.kau.se/en/gdpr>.
En ny version av Shibboleth identity provider finns tillgänglig.
/Paul.
SWAMID operations.
-------- Forwarded Message --------
From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
Reply-To: users(a)shibboleth.net
To: announce(a)shibboleth.net <announce(a)shibboleth.net>
Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
Subject: Shibboleth Identity Provider V5.1.6 now available
Date: 26/08/25 14:18:32
A new patch release of the IdP software is now available [1] to
address a couple of security issues, one internal (advisory forthcoming
momentarily), and one in Spring Framework.
The Release Notes mention both issues. [2]
-- Scott
[1] https://shibboleth.net/downloads/identity-provider/
[2] https://shibboleth.atlassian.net/wiki/x/T4C0vg
--
To unsubscribe from this list send an email to
announce-unsubscribe(a)shibboleth.net
När du skickar e-post till Karlstads universitet behandlar vi dina personuppgifter<https://www.kau.se/gdpr>.
When you send an e-mail to Karlstad University, we will process your personal data<https://www.kau.se/en/gdpr>.
Ny version av Shibboleth Identity Provider.
Tillägg: "MSI installer will be available by next week at the latest,
possibly sooner."
/Paul
SWAMID operations
-------- Forwarded Message --------
From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
Reply-To: users(a)shibboleth.net
To: announce(a)shibboleth.net <announce(a)shibboleth.net>
Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
Subject: Shibboleth Identity Provider V5.1.5 now available
Date: 13/08/25 16:40:46
The Shibboleth Project has released V5.1.4 of the IdP software to
migrate to Spring Framework V6.2 on an interim basis per the schedule
we published earlier this week [1].
It is now available from our download site [2]. The Release Notes are
updated accordingly. [3]
Our other artifacts such as OpenSAML are available in our Maven
repository.
-- Scott
[1] https://shibboleth.atlassian.net/wiki/x/AwBqEAE
[2] http://shibboleth.net/downloads/identity-provider/latest5/
[3] https://shibboleth.atlassian.net/wiki/x/T4C0vg
--
To unsubscribe from this list send an email to
announce-unsubscribe(a)shibboleth.net
När du skickar e-post till Karlstads universitet behandlar vi dina personuppgifter<https://www.kau.se/gdpr>.
When you send an e-mail to Karlstad University, we will process your personal data<https://www.kau.se/en/gdpr>.
Tjo!
Efter många turer med det fantastiska företaget Elsevier så föredrar dom
ju nu (helt otroligt nog!) att man använder pairwise-id. Men efter våra
turer med dom tidigare och deras försök att bistå med information om att
spåra användare så har jag valt att köra på eduPersonTargetedID ändå för
att det är enklare att göra ett uppslag i en databas än att förlita sig
på att dom ger oss rätt information med korrekta tidpunkter.
Men frågan kvarstår; om du bara har ett pairwise-id, som rekommenderas
att använda en BASE32:ad saltad SHA-{1,256} av användarnamnet, men inte
har något korrekt datum: Hur hittar du vem användaren som loggat in är?
Även om att bruteforcea alla ens aktiva konton är 100% görbart så känns
det lite som fel väg att gå för att "spåra" vilken användare som loggat
in i en tjänst.
Hur har ni gjort?
MVH
- Simon
Hej!
Enligt SWAMID SAML WebSSO Technology Profile (3.2 och 3.3) ska en entitet årligen bekräfta att den uppfyller teknologi-profilen.
Följande entitet har trots påtryckning inte bekräftats och kommer därför raderas på datum nedan.
Vet ni med er att entiteten används vid ert lärosäte behöver ni skyndsamt eskalera detta till rätt instans inom er organisation.
Raderas 2025-06-04:
https://uuu.mira.se/Saml2/
Det går att följa status på dessa entiteter via vår felsida:
https://metadata.swamid.se/admin/?action=ErrorList
Finns entiteten kvar är den ännu inte hanterad (uppdateras varje onsdag morgon). Last
Confirmed/Validated uppdateras dock löpande.
--
jocar
SWAMID Operations
Hej.
För kännedom till er som kör Shibboleth IdP på Windows.
Inget akut att uppdatera mer om ni vill ha en lite fräshare jetty :-)
// Björn M.
> Begin forwarded message:
>
> From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
> Subject: Jetty for Windows installer updated to 12.0.20
> Date: 12 May 2025 at 16:35:23 CEST
> To: "announce(a)shibboleth.net" <announce(a)shibboleth.net>
> Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
> Reply-To: users(a)shibboleth.net
>
> There was a DoS vulnerability [1] in Jetty when HTTP/2 is enabled, which isn't really something we support in our packaging for Windows, but out of caution we have refreshed it to 12.0.20 as it was fairly stale anyway. [2]
>
> Monitoring that download point is the main way to keep track but as always, running (and patching) your own container is strongly advised.
>
> -- Scott
>
> [1] https://www.eclipse.org/lists/jetty-announce/msg00198.html
> [2] https://shibboleth.net/downloads/identity-provider/jetty-windows/
>
>
> --
> To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net
Hej!
Enligt dokumentation här
https://wiki.geant.org/pages/viewpage.action?spaceKey=TCSNT&title=TCS+2025+…
så kräver Harica följande attribut:
givenName (oid:2.5.4.42)
surname (oid:2.5.4.4)
mail (oid:0.9.2342.19200300.100.1.3)
edupersonTargetedID (oid:1.3.6.1.4.1.5923.1.1.1.10)
Men jag har problem att få iväg attributet edupersonTargetedID till Harica.
I attribute-filter har jag följande:
<AttributeFilterPolicy id="Harica">
<PolicyRequirementRule xsi:type="Requester"
value="https://www.harica.gr/simplesamlphp/module.php/saml/sp/metadata.php/pki-grn…"
/>
<AttributeRule attributeID="givenName">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="surname">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="mail">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="edupersonTargetedID">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="tcsPersonalEntitlement">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="schacHomeOrganization">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="eduPersonPrimaryAffiliation">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
</AttributeFilterPolicy>
I attribute-resolver:
<AttributeDefinition xsi:type="SAML2NameID"
xmlns="urn:mace:shibboleth:2.0:resolver" id="edupersonTargetedID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
<InputDataConnector ref="StoredId" attributeNames="persistentId"/>
<AttributeEncoder xsi:type="SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<AttributeEncoder xsi:type="SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="edupersonTargetedID" />
</AttributeDefinition>
När jag loggar in så skickas attributet edupersonTargetedID enligt
bilaga, men det ser ut som Harica vägrar att ta emot detta då jag får
felmeddelande:
Cannot create your account
Your Identity Provider (IdP) does not provide HARICA with the
appropriate info (attributes) for your account.
Please contact your IdP, to fix this issue.
Testade även med https://cm.harica.gr/loginsaml/test.php och då får jag
att dessa attibut kommer fram (trots att attributen skickas enligt
bilaga alltså):
eduPersonPrincipalName: matsl(a)irf.se
schacHomeOrganization: irf.se
sn: Luspa
eduPersonEntitlement: urn:mace:terena.org:tcs:personal-user
eduPersonPrimaryAffiliation: The Swedish Institute of Space Physics
givenName: Mats
mail: mats.luspa(a)irf.se
groups: realm-irf.se, users, members
Är det någon i denna lista som fått SSO login till Harica att fungera
med idp shibboleth (ver. 5.1.4)?
/MVH Mats
--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik Fax: +46 (0)980 79 050
Swedish Institute of Space Physics email: matsl(a)irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: https://www.irf.se/pgp/matsl
Digital vcard: https://www.irf.se/vcard/mats.luspa
Shibboleth projekt vill gärna få feedback och förslag till förbättringar av IDP dokumentationen.
Se mail nedan.
-------- Forwarded Message --------
From: Steven Premeau via users <users(a)shibboleth.net<mailto:users@shibboleth.net>>
Reply-To: Shib Users <users(a)shibboleth.net<mailto:users@shibboleth.net>>
To: users(a)shibboleth.net<mailto:users@shibboleth.net>
Cc: Steven Premeau <shibboleth(a)premeauenterprises.com<mailto:shibboleth@premeauenterprises.com>>
Subject: IDP Documentation Survey
Date: 11/04/25 17:04:34
Some of you may recognize me from my former roles in the University of Maine and University of Wisconsin systems.
I am working with the Shibboleth Consortium to identify and prioritize options for improving the IDP (and IDP related) documentation -- one of the items on the
Shibboleth Project Roadmap 2025-2026<https://shibboleth.atlassian.net/wiki/x/AQDS0#Enhanced-Product-Documentatio…>.
If you are running the Shibboleth Identity Provider in production OR have utilized the existing documentation site(s), you are invited to participate in this effort by completing a survey sharing your experiences.
The survey can be found at: https://forms.gle/1BD4uLkvWDrkEuEV9
The survey can be completed anonymously. Optionally, an email address can be provided -- it will only be used if there are any follow-up questions.
The survey will close on Wednesday, April 30th.
Thank you in advance,
Steve.
När du skickar e-post till Karlstads universitet behandlar vi dina personuppgifter<https://www.kau.se/gdpr>.
When you send an e-mail to Karlstad University, we will process your personal data<https://www.kau.se/en/gdpr>.
Hej!
Omstart av release-check.swamid.se <http://release-check.swamid.se/> kommer se under förmiddagen vilket kommer skapa ett kort avbrott i tjänsten.
--
jocar
SWAMID Operations
