Shibboleth Identity Provider Security Advisory [13 May 2026]

[Peter Schober]

Bernd Oberknapp <bo at ub.uni-freiburg.de> [2026-05-14 18:24 CEST]:
> Just to clarify, our IdP uses the eduGAIN SP metadata file provided
> by the DFN-AAI (not the one provided by eduGAIN), but that has the
> same issue.

I think that (at least) all federations using pyFF as aggregator and
consuming the current eduGAIN metadata will produce metadata that will
now trip up IDPs enforcing lower limits. I know my own does.

AFAIU Scott the Shibboleth MDA should have functionality to
canonicalise those prefixes? If that's correct I suppose either
DFN-AAI doesn't use the MDA or they're missing a processing step where
that canonicalisation would happen. (I wouldn't know, once leifj
created pyFF I used only that.)

-peter