[EXTERN] Re: Shibboleth Identity Provider Security Advisory [13 May 2026]

[Martin Hitschel]

Hi list,

FWIW, we've just done a 5.2.2 test upgrade and the DFN-AAI re-published 
eduGAIN SP metadata feed loads without issues. Apparently the IdP is 
able to use it, i.e. react upon a persistent NameID declaration in 
metadata using AACLI.

Mayby the issue is OS-dependent? This customer's IdP is on Ubuntu24 with 
a distribution's tomcat10 and OpenJDK21. We'd even enforced 
"idp.xml.elementAttributeLimit = 30" but it works still.

Regards

Martin

Am 14.05.26 um 18:23 schrieb Bernd Oberknapp:
>
> On 5/14/26 17:20, Peter Schober via users wrote:
>>
>>> That leads directly to the point that it's not meant for public
>>> consumption, it's a system artifact of a service designed to be used
>>> by the federations. If they're happy with it, fine. But by exposing
>>> it to clients, I think they kind of have an obligation to do things
>>> sensibly or tell people that they don't intend to cater to that use
>>> case.
>>
>> I think there probably were (are?) a few offenders among the eduGAIN
>> participant federations who did not understand that it's plain wrong
>> to point their members to the eduGAIN MDS ("trust is always local", as
>> leifj often said, here meaning: there's no reason any IDP or SP
>> deployer should trust the eduGAIN MDS metadata or signing key).
>> If this were up to me I'd long have restricted access to that resource
>> to only the participant federations who need to process it.
>> Doing that now doesn't of course address the issue.
>
> Just to clarify, our IdP uses the eduGAIN SP metadata file provided by 
> the DFN-AAI (not the one provided by eduGAIN), but that has the same 
> issue.
>
> Best regards,
> Bernd
>
>
-- 

*Dr. MARTIN HITSCHEL | System Engineer*

Phone: +49 7071 407109-0
Email: martin.hitschel at daasi.de

*DAASI International GmbH*
Europaplatz 3
D-72072 Tübingen, Germany
www.daasi.de

Registered Office: Tübingen
Registration Court: Amtsgericht Stuttgart, HRB 382175
CEO: Peter Gietz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260515/33e5cf63/attachment.htm>