Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

Wed Jun 25 08:25:14 UTC 2025

Hi Keith,

Thanks a lot for the report!

I filed an issue here on your behalf: 
https://shibboleth.atlassian.net/browse/JCOMOIDC-137

The warning is confusing, but can be ignored at this point. We'll find 
out the best way to fix it.

BR,
Henri.

On 24.6.2025 22.03, Wessel, Keith via users wrote:
> Henri,
> 
> Possibly another bug, though we're not sure. After deploying the new versions of the OIDC plugins, we're seeing a log message we haven't seen before:
> 
> 2025-06-24 13:52:01,886 - WARN [net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder:232] - Could not convert values of type com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest$Entry for the claim 'com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest$Entry at 72ef15b0' to a string attribute using transcoding rule 'uiucedu_uin -> uiucEduUIN'
> 
> We're seeing this for other claims, as well.
> 
> At this point, the claims still seem to be going through as far as we can tell. So we aren't rolling back. But is something actually broken, or is this just a warning in the log that we can ignore?
> 
> Happy to file a bug on Jira if you want me to.
> 
> Keith
> 
> 
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
> Sent: Tuesday, June 24, 2025 5:13 AM
> To: users at shibboleth.net
> Subject: Re: Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available
> 
> Hi Martin,
> 
> Thank you very much for reporting this. It's indeed caused by the change
> that you pointed out.
> 
> At this point, that warning message just needs to be ignored. We'll find
> out the best way to fix it, as a part of this ticket:
> 
> https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/JCOMOIDC-136__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeKCu0MFXg$
> 
> BR,
> Henri.
> 
> On 24.6.2025 12.04, Martin Hitschel via users wrote:
>> Hi list,
>>
>> we've installed the new plugins for one client. There is a new
>> Deprecation in the IdP Log, setRetrieveUserInfoEndpointClaims should
>> besetRetrieveUserInfoEndpointClaimsPredicate now.
>>
>> I guess this stems from https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIo8WetPg$
>> JCOMOIDC-132 ... but how can I get rid of the deprecation warning? I
>> cannot find this predicate when grepping in the configuration.
>>
>> Regards
>> Martin
>>
>> -------- Weitergeleitete Nachricht --------
>> Betreff: 	OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now
>> Available
>> Datum: 	Mon, 23 Jun 2025 14:56:36 +0000
>> Von: 	Philip Smart via announce <announce at shibboleth.net>
>> Antwort an: 	users at shibboleth.net
>> An: 	announce at shibboleth.net <announce at shibboleth.net>
>> Kopie (CC): 	Philip Smart <Philip.Smart at jisc.ac.uk>
>>
>>
>>
>> The Shibboleth Project has released V4.3.0 of the OIDC OP plugin (see
>> release notes at [1]) and V2.3.0 of the OIDC RP authentication proxy
>> plugin (see release notes in [2]).
>>
>> Both releases accompany, and require, a new version of the OIDC commons
>> library (see release notes at [3]) and OIDC config module.
>>
>> Among the new features and bug fixes, both the OP and RP now include
>> safeguards against audience injection attacks that could result from
>> third-party software behavior, see the release notes. Importantly, our
>> software was not directly vulnerable to these attacks, but we’ve added
>> these configurable protections as a proactive measure.
>>
>> -- Henri Mikkonen and Phil Smart, on behalf of the team
>>
>> [1] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/2776760321/OPReleaseNotes
>>
>> [2] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes
>>
>> [3] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/3232137218/OIDCCommonReleaseNotes
>>
>> Jisc is a registered charity (in England and Wales under charity number
>> 1149740; in Scotland under charity number SC053607) and a company
>> limited by guarantee registered in England under company number
>> 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4
>> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>>
>> Jisc Services Limited is a wholly owned Jisc subsidiary and a company
>> limited by guarantee which is registered in England under company number
>> 02881024, VAT number GB 197 0632 86. The registered office is: 4
>> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>>
>> For more details on how Jisc handles your data see our privacy notice
>> here: https://urldefense.com/v3/__https://www.jisc.ac.uk/website/privacy-notice__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeLfuC0yQw$
>> --
>> To unsubscribe from this list send an email to announce-
>> unsubscribe at shibboleth.net
>>
> 