Updating the Duo 2FA Plugin

[Xander Desai]

Thanks for the reply Scott.
I'll go ahead and file an issue in Jira. I just tagged/made a release in
the duo_java github repo called DuoWeb-2.6
This change is not to fix a security vulnerability. It is just providing
additional functionality to use with our service. So getting in with the
release of 3.4 sounds great. The current javascript file won't stop
functioning properly at any point, so again, no need to patch.

Just to provide some clarity on what the change is. We are updating the
javascript file that lives
in java-identity-provider/idp-war/src/main/webapp/js/Duo-Web-v2.min.js
Currently this file in the shibboleth repo is what we refer to as version
2.3. We are going to update it to version2.6 by replacing it with the
javascript file from the latest tagged release of duo_java DuoWeb-2.6
I noticed you've done it once before when updating from 2.0 to 2.3
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d6406ba42b64ff7efdcd6f2fef5849fc4fd363c9
So I'm hoping it will be a very similar process this time.


On Mon, Jun 12, 2017 at 12:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/12/17, 11:00 AM, "dev on behalf of Xander Desai" <
> dev-bounces at shibboleth.net on behalf of xdesai at duo.com> wrote:
>
> > I'm an engineer at Duo Security and we have a new update to the Duo
> WebSDK that we'd like to roll out to the Duo plugin for
> > Shibboleth. Currently Shibboleth is on WebSDK v2.3 and we'd like to get
> on the latest v2.6.
>
> I'm still not seeing the projects in github with clearly marked and tagged
> releases, can you maybe give me a pointer to were there's a piece of code
> labeled with that version?
>
> Or are you saying that your back-end API has that version, and the
> untagged/unversioned code in github is now altered to reflect that?
>
> In which case, we really need to see that code versioned and tagged.
>
> > What is the best way for me to assist with this change? Is a pull
> request the appropriate way to handle this update?
>
> You can file an issue in our Jira, but our normal course of work includes
> reviewing dependencies for updates when we do new releases, and because
> it's a core feature people rely on it would get updated as a normal matter
> of business when 3.4 is released. If there were a security issue, then we
> would do it as a patch release because it was necessary.
>
> The notion of a cloud dependency is not one we have a lot of past
> experience with, but a compatibility issue where the code would stop
> working at some point in between normal upgrades would require us to do a
> patch as well, which I'm hoping isn't the case here but if I've missed some
> announcement, I'll take a look. I'll make sure I'm on the right lists,
> which I'm probably not.
>
> It's definitely a problem for us to be asked to update to unreleased code.
> That means a signed tag in github, if that's where the code lives.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>



-- 
*Xander Desai*
/ Software Engineer II


xdesai at duo.com


(734) 660-5055 Cell Phone


Duo.com <https://duo.com/>

----------
The Most Loved Company in Security
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170612/4163604e/attachment-0001.html>