IdP / OpenSAML patches next week

[Vlad Mencl]

Hi Scott,

Thanks for the early heads-up.

I am preparing my upgrade path: we are running on Debian 12 with system 
OpenJDK 17 and Tomcat 10.

I understand that for IdP 5.2.x, I'll need Tomcat 11.  (It surprisingly 
works with Tomcat 10, but I want to stay within the official 
recommendations).

To get Tomcat 11, I'll be upgrading the hosts to Debian 13, which opens 
two compatibility questions:

(1) Does the IdP support Java 21?

There are some libraries that come with Debian 13 
(libeclipse-jdt-core-compiler-batch-java) that are involved in rendering 
JSP pages and are compiled for Java 21.  With Java 17, IdP works, but 
/idp/status and /idp/shibboleth fail to render.

I can see IdP 5.1.x works with Java 21, but I'm asking for confirmation.


(2) Does IdP 5.1.x work with Tomcat 11?  I'm trying to see if I can 
isolate the upgrade steps.
In IDP5 SystemRequirements, I see (for IdP 5.0.x-5.1.x):

 > Tomcat 10.1 (apparently NOT Tomcat 11)

It appears to work for me (with 5.1.6) - any recollection where this 
came from?


Many thanks in advance for your reply.

Best regards,
Vlad


On 06/05/2026 01:37, Scott Cantor via dev wrote:
> Just a courtesy notice, we will be releasing patches for OpenSAML and the IdP next week primarily to address a denial of service issue. The alert list has been given a draft of the advisory so members have some further information on that.
> 
> Because this issue is in OpenSAML, I'm sharing the advance notice with both the users and dev lists.
> 
> Probably will release Wed/Thu.
> 
> -- Scott
> 

-- 
Vladimir Mencl
Lead Software Engineer

Research & Education
Advanced Network NZ Ltd

E  vladimir.mencl at reannz.co.nz
www.reannz.co.nz