Shibboleth Identity Provider V4.2 now available

[Cantor, Scott]

The Shibboleth Project is pleased (and exhausted) to release V4.2 of the Identity Provider software. This minor update is now available for download [1].

Please review the release notes [2] as there are a couple of bug fixes that may impact upgrades, notably one that affects proxying to an IdP while relying on a scoped attribute such as eduPersonPrincipalName to identify the user.

This release of the IdP is NOT compatible with some older plugins (notably the OIDC OP and DuoOIDC plugins), and those need to upgraded at the same time (they are also available, a separate note will be going out about them). The upgrade process will warn about this issue but it doesn't prevent the upgrade, it just assumes the affected plugins will be upgraded before use.

This release of the IdP *does* contain the very latest Spring 5.3 release from this week.

We do plan to produce a 5.1.7 patch next week with that same Spring version for those who need it as a courtesy, but in terms of support, 4.1 is already end-of-life officially with the release of V4.2 in accordance with the usual policy.

Please note that the Spring update this week, while it does claim somewhat questionably to address a CVE does not contain any changes that would benefit the IdP. It shores up a feature we aren't using, so if we were for some obscure reason vulnerable to the original bug from a few weeks ago, updating Spring won't change that, and 4.2 would be just as affected. The only value to the 4.1.7 patch will be shutting up automated scanners while staying back on an unsupported release.

We continue to monitor the situation and research things the best we can but the key takeaway is that if we did find something in the future, the fix would be in a 4.2.x patch, not 4.1.

-- Scott

[1] https://shibboleth.net/downloads/identity-provider/latest4/
[2] https://wiki.shibboleth.net/confluence/display/IDP4/ReleaseNotes