Re: Need Guidance: Upgrading Shibboleth duo‑oidc Plugin to 2.2.1+ for DUO CA Update

[Steven Premeau]

Based on the plugin release notes
<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3114041345/DuoOIDCReleaseNotes>,
and what can be found in other
<https://shibboleth.atlassian.net/browse/JDUO-93> places, the DuoOIDC
plugin was updated with the SDK containing the required certificates in
version 2.2.1, released on 15 May 2025.

That 2.2.1 (or higher) would be required to avoid disruption due to Duo's
certificate change.

Steve.

On Thu, Jan 29, 2026 at 8:44 AM Lee, Dong via users <users at shibboleth.net>
wrote:

> Good morning,
>
>
>
> We are in the process of updating the Duo‑OIDC plugin due to the upcoming
> DUO CA update. We have been using the tool provided by DUO, the Unsupported
> Clients Log to assess our readiness for this change.
>
> Our environment is currently running IDP 5.1.3 with the plugin
> net.shibboleth.idp.plugin.authn.duo.nimbus, version 2.1.0. Although this
> version is below the level recommended in DUO’s documentation (version
> 2.2.1), it does not appear in the Unsupported Clients Log.
>
> We reached out to DUO Support, and they indicated that the log does not
> capture this plugin because it is a third‑party integration. They advised
> us to contact the Shibboleth community for guidance.
>
> Given this, should we proceed with upgrading the plugin to match DUO's
> documented requirements?
>
>
>
> Thank you,
>
> Dong Lee
>
>
>
> Identity Management & System Integration
>
> Center for Information Technology Services
>
> University of Maryland, Baltimore
>
> 410-706-3027
>
> dlee at umaryland.edu
>
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260129/7c0d938c/attachment.htm>