Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

[Henri Mikkonen]

Hi Martin,

Thank you very much for reporting this. It's indeed caused by the change 
that you pointed out.

At this point, that warning message just needs to be ignored. We'll find 
out the best way to fix it, as a part of this ticket:

https://shibboleth.atlassian.net/browse/JCOMOIDC-136

BR,
Henri.

On 24.6.2025 12.04, Martin Hitschel via users wrote:
> Hi list,
> 
> we've installed the new plugins for one client. There is a new 
> Deprecation in the IdP Log, setRetrieveUserInfoEndpointClaims should 
> besetRetrieveUserInfoEndpointClaimsPredicate now.
> 
> I guess this stems from https://shibboleth.atlassian.net/browse/ 
> JCOMOIDC-132 ... but how can I get rid of the deprecation warning? I 
> cannot find this predicate when grepping in the configuration.
> 
> Regards
> Martin
> 
> -------- Weitergeleitete Nachricht --------
> Betreff: 	OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now 
> Available
> Datum: 	Mon, 23 Jun 2025 14:56:36 +0000
> Von: 	Philip Smart via announce <announce at shibboleth.net>
> Antwort an: 	users at shibboleth.net
> An: 	announce at shibboleth.net <announce at shibboleth.net>
> Kopie (CC): 	Philip Smart <Philip.Smart at jisc.ac.uk>
> 
> 
> 
> The Shibboleth Project has released V4.3.0 of the OIDC OP plugin (see 
> release notes at [1]) and V2.3.0 of the OIDC RP authentication proxy 
> plugin (see release notes in [2]).
> 
> Both releases accompany, and require, a new version of the OIDC commons 
> library (see release notes at [3]) and OIDC config module.
> 
> Among the new features and bug fixes, both the OP and RP now include 
> safeguards against audience injection attacks that could result from 
> third-party software behavior, see the release notes. Importantly, our 
> software was not directly vulnerable to these attacks, but we’ve added 
> these configurable protections as a proactive measure.
> 
> -- Henri Mikkonen and Phil Smart, on behalf of the team
> 
> [1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/ 
> pages/2776760321/OPReleaseNotes
> 
> [2] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/ 
> pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes
> 
> [3] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/ 
> pages/3232137218/OIDCCommonReleaseNotes
> 
> Jisc is a registered charity (in England and Wales under charity number 
> 1149740; in Scotland under charity number SC053607) and a company 
> limited by guarantee registered in England under company number 
> 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 
> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
> 
> 
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
> limited by guarantee which is registered in England under company number 
> 02881024, VAT number GB 197 0632 86. The registered office is: 4 
> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
> 
> 
> For more details on how Jisc handles your data see our privacy notice 
> here: https://www.jisc.ac.uk/website/privacy-notice
> --
> To unsubscribe from this list send an email to announce- 
> unsubscribe at shibboleth.net
>