Shibboleth Identity Provider Security Advisory [13 May 2026]

[Alan Buxey]

hi,

off-topic for the security advisory really but:

One thing I noticed in the past (and this may in fact be a pyff issue,
> too) is that XML namespace declarations are not normalised (not using
> one consistent prefix for one formal namespace URI) but instead any
> prefix used by any of the source metadata documents is preserved and
> added to the final document, leading to something like this on the
> root element:
> <md:EntitiesDescriptor
>   xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
>   xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>   xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata"
>   xmlns:q1="urn:oasis:names:tc:SAML:2.0:metadata"
>   etc.pp.
>

that might be one to bring to the eduGAIN futures working group


> (FWIW, I don't have specific numbers but with the current size of the
> eduGAIN MDS aggregate being 88MB I doubt this has been growing at a
> significant rate in recent times or that it will grow significantly in
> the near future.)
>

Again, a graph at edugain.org would be nice. However, Ian Young kindly
provided a graph for the UK aggregate (*), which is pretty close to the
eduGAIN ones because the UK aggregate includes almost all of the eduGAIN
entities (and eduGAIN aggregate contains almost all of the UK entities).

[image: image.png]

Given its 88MB now, growth appears to have slowed since the more rapid
expansion of eduGAIN in 2020-2021. (China, Malaysia etc coming on board).
I'm not aware of any large current non-members joining and current
federation growth is stagnant. We're really waiting for the next growth
surprise such as a drive for eg all post-secondary educations to be
federated or a whole load of K-12's/secondary schools joining.

regards

alan

(*)
https://trustandidentity.jiscinvolve.org/wp/2022/02/10/idp-operators-consider-using-mdq-metadata-query/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260514/a72ae735/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 169984 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260514/a72ae735/attachment.png>