Shibboleth Identity Provider Security Advisory [13 May 2026]

[Scott Cantor]

> Given its 88MB now, growth appears to have slowed since the more rapid expansion of eduGAIN in 2020-2021. (China, Malaysia etc coming on board).  I'm not aware of any large current non-members joining and current federation growth is stagnant. We're really waiting for the next growth surprise such as a drive for eg all post-secondary educations to be federated or a whole load of K-12's/secondary schools joining. 

The problem is that anybody using aggregates is basically betting it won't happen now. Because if it does, the exponential nature of the performance problems will probably tip everybody over much sooner than expected.

But we fixed this a decade ago in code, and it's really past time people accepted the fix. It is simply not going to be fixed by making the design tolerate aggregates of a bigger size, at least not by us. We heard the screaming and we responded, but now the answer seems to be that nobody but a few players can deploy the infrastructure needed.

But I know of campuses individually that have deployed MDQ hacks with Apache without a lot of work. It really is not that hard to do at the local level. At the federation level, yes, the reliability requirements are much higher.

I guess I would add that if you don't have a solution, it's probably time to point people at the federations that do, and their MDQ solutions.

-- Scott