Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

[Martin Hitschel]

Hi list,

we've installed the new plugins for one client. There is a new 
Deprecation in the IdP Log, setRetrieveUserInfoEndpointClaims should 
besetRetrieveUserInfoEndpointClaimsPredicate now.

I guess this stems from 
https://shibboleth.atlassian.net/browse/JCOMOIDC-132 ... but how can I 
get rid of the deprecation warning? I cannot find this predicate when 
grepping in the configuration.

Regards
Martin

-------- Weitergeleitete Nachricht --------
Betreff: 	OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now 
Available
Datum: 	Mon, 23 Jun 2025 14:56:36 +0000
Von: 	Philip Smart via announce <announce at shibboleth.net>
Antwort an: 	users at shibboleth.net
An: 	announce at shibboleth.net <announce at shibboleth.net>
Kopie (CC): 	Philip Smart <Philip.Smart at jisc.ac.uk>



The Shibboleth Project has released V4.3.0 of the OIDC OP plugin (see 
release notes at [1]) and V2.3.0 of the OIDC RP authentication proxy 
plugin (see release notes in [2]).

Both releases accompany, and require, a new version of the OIDC commons 
library (see release notes at [3]) and OIDC config module.

Among the new features and bug fixes, both the OP and RP now include 
safeguards against audience injection attacks that could result from 
third-party software behavior, see the release notes. Importantly, our 
software was not directly vulnerable to these attacks, but we’ve added 
these configurable protections as a proactive measure.

-- Henri Mikkonen and Phil Smart, on behalf of the team

[1] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2776760321/OPReleaseNotes

[2] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes

[3] 
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3232137218/OIDCCommonReleaseNotes

Jisc is a registered charity (in England and Wales under charity number 
1149740; in Scotland under charity number SC053607) and a company 
limited by guarantee registered in England under company number 
05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 
Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
limited by guarantee which is registered in England under company number 
02881024, VAT number GB 197 0632 86. The registered office is: 4 
Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice 
here: https://www.jisc.ac.uk/website/privacy-notice
--
To unsubscribe from this list send an email to 
announce-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250624/2892450f/attachment.htm>