Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

Wed Jun 25 14:22:21 UTC 2025

Thanks, Henri. Greatly appreciate the confirmation that this can be safely ignored.

Keith

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
Sent: Wednesday, June 25, 2025 3:25 AM
To: users at shibboleth.net
Subject: Re: Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

Hi Keith,

Thanks a lot for the report!

I filed an issue here on your behalf: 
https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/JCOMOIDC-137__;!!DZ3fjg!5DepMAK9QRsfrzo71DzACXYzb2vjBjpB7iAaubbJWFIq2ofphCmjuJz0Flby-fbyBpZD5NVeTX1pMxgGSWe9u2KFt-buCA$ 

The warning is confusing, but can be ignored at this point. We'll find 
out the best way to fix it.

BR,
Henri.

On 24.6.2025 22.03, Wessel, Keith via users wrote:
> Henri,
> 
> Possibly another bug, though we're not sure. After deploying the new versions of the OIDC plugins, we're seeing a log message we haven't seen before:
> 
> 2025-06-24 13:52:01,886 - WARN [net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder:232] - Could not convert values of type com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest$Entry for the claim 'com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest$Entry at 72ef15b0' to a string attribute using transcoding rule 'uiucedu_uin -> uiucEduUIN'
> 
> We're seeing this for other claims, as well.
> 
> At this point, the claims still seem to be going through as far as we can tell. So we aren't rolling back. But is something actually broken, or is this just a warning in the log that we can ignore?
> 
> Happy to file a bug on Jira if you want me to.
> 
> Keith
> 
> 
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
> Sent: Tuesday, June 24, 2025 5:13 AM
> To: users at shibboleth.net
> Subject: Re: Fwd: OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available
> 
> Hi Martin,
> 
> Thank you very much for reporting this. It's indeed caused by the change
> that you pointed out.
> 
> At this point, that warning message just needs to be ignored. We'll find
> out the best way to fix it, as a part of this ticket:
> 
> https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/JCOMOIDC-136__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeKCu0MFXg$
> 
> BR,
> Henri.
> 
> On 24.6.2025 12.04, Martin Hitschel via users wrote:
>> Hi list,
>>
>> we've installed the new plugins for one client. There is a new
>> Deprecation in the IdP Log, setRetrieveUserInfoEndpointClaims should
>> besetRetrieveUserInfoEndpointClaimsPredicate now.
>>
>> I guess this stems from https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIo8WetPg$
>> JCOMOIDC-132 ... but how can I get rid of the deprecation warning? I
>> cannot find this predicate when grepping in the configuration.
>>
>> Regards
>> Martin
>>
>> -------- Weitergeleitete Nachricht --------
>> Betreff: 	OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now
>> Available
>> Datum: 	Mon, 23 Jun 2025 14:56:36 +0000
>> Von: 	Philip Smart via announce <announce at shibboleth.net>
>> Antwort an: 	users at shibboleth.net
>> An: 	announce at shibboleth.net <announce at shibboleth.net>
>> Kopie (CC): 	Philip Smart <Philip.Smart at jisc.ac.uk>
>>
>>
>>
>> The Shibboleth Project has released V4.3.0 of the OIDC OP plugin (see
>> release notes at [1]) and V2.3.0 of the OIDC RP authentication proxy
>> plugin (see release notes in [2]).
>>
>> Both releases accompany, and require, a new version of the OIDC commons
>> library (see release notes at [3]) and OIDC config module.
>>
>> Among the new features and bug fixes, both the OP and RP now include
>> safeguards against audience injection attacks that could result from
>> third-party software behavior, see the release notes. Importantly, our
>> software was not directly vulnerable to these attacks, but we’ve added
>> these configurable protections as a proactive measure.
>>
>> -- Henri Mikkonen and Phil Smart, on behalf of the team
>>
>> [1] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/2776760321/OPReleaseNotes
>>
>> [2] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes
>>
>> [3] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeIZtpLLgw$
>> pages/3232137218/OIDCCommonReleaseNotes
>>
>> Jisc is a registered charity (in England and Wales under charity number
>> 1149740; in Scotland under charity number SC053607) and a company
>> limited by guarantee registered in England under company number
>> 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4
>> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>>
>> Jisc Services Limited is a wholly owned Jisc subsidiary and a company
>> limited by guarantee which is registered in England under company number
>> 02881024, VAT number GB 197 0632 86. The registered office is: 4
>> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>>
>> For more details on how Jisc handles your data see our privacy notice
>> here: https://urldefense.com/v3/__https://www.jisc.ac.uk/website/privacy-notice__;!!DZ3fjg!4hhqjETk0TfWf3TJHMS0vI5eE43uW_bkajEnyuytVWeONdcMK39F5iVUoK3DLXiR28obnQ_uIiUxc1hrq67NIeLfuC0yQw$
>> --
>> To unsubscribe from this list send an email to announce-
>> unsubscribe at shibboleth.net
>>
> 

-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!5DepMAK9QRsfrzo71DzACXYzb2vjBjpB7iAaubbJWFIq2ofphCmjuJz0Flby-fbyBpZD5NVeTX1pMxgGSWe9u2JuA0dlKw$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net