DuoOIDC plugin testing with updated root CA bundle

[Steven Premeau]

Phil -

  I just installed the snapshot build on my sandbox environment without
issues.

  FWIW, that deployment is on DUO63.

Steve.

On Thu, May 8, 2025 at 1:16 PM Philip Smart via users <users at shibboleth.net>
wrote:

> Hi everyone,
>
> Duo has recently updated the root CA bundle included with their Web SDK
> v4. These "pinned” root certificates are used to evaluate the chain of
> trust associated with the end-entity certificate presented by the Duo API.
> Note that the plugin does not (has never) use the default set of
> certificates provided by the JDK. We plan to include the same set of
> updated certificates in both variants of the DuoOIDC plugin starting from
> version 2.2.0.
>
> Testing the updated CA bundle can be challenging because it depends on the
> API host configured for your client or integration. Since we don't have
> access to all the hosts for testing, we would like to ask if anyone would
> be willing to install the current snapshot of either DuoOIDC plugin variant
> (as they use the same set of certificates) in a development environment and
> test their integration. If you could do that and share the results, we
> would greatly appreciate it.
>
> You can find the instructions for installing a snapshot on the Plugin
> Testing Wiki page [1]. Specifically, you’d need to install version
> 2.2.0-SNAPSHOT of either the 'Duo Plugin (Nimbus)' or the 'Duo Plugin (Duo
> SDK)', as indicated on the project status site linked in the plugin testing
> page.
>
> This is also a heads-up that these certificates are being updated.
>
> Phil
>
> [1]
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3256057857/Plugin+Testing
>
> Jisc is a registered charity (in England and Wales under charity number
> 1149740; in Scotland under charity number SC053607) and a company limited
> by guarantee registered in England under company number 05747339, VAT
> number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane,
> Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company
> limited by guarantee which is registered in England under company number
> 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall
> Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> For more details on how Jisc handles your data see our privacy notice
> here: https://www.jisc.ac.uk/website/privacy-notice
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250509/c775993d/attachment.htm>