Shibboleth Identity Provider Security Advisory [13 May 2026]

[Ian Young]

> On 14 May 2026, at 17:36, Peter Schober via users <users at shibboleth.net> wrote:
> 
> AFAIU Scott the Shibboleth MDA should have functionality to
> canonicalise those prefixes? If that's correct I suppose either
> DFN-AAI doesn't use the MDA or they're missing a processing step where
> that canonicalisation would happen. (I wouldn't know, once leifj
> created pyFF I used only that.)


The UKf MDA configuration, at least, does perform namespace prefix normalisation. It’s done using an XSL transform performed right before the creation of the (unsigned) aggregate output files. So if people are looking for a quick fix that doesn’t involve converting to MDA, you can probably do it with xsltproc.

These two files together are what are used for the main production aggregate, for example:

https://github.com/ukf/ukf-meta/blob/master/mdx/ns_norm.xsl

https://github.com/ukf/ukf-meta/blob/master/mdx/uk/ns_norm_uk.xsl

Other aggregates have slightly different needs and some use slightly different transforms, but the variations are probably under the noise floor here.

I will say that those transforms are based around a more restrictive set of namespaces than may appear in eduGAIN; some namespaces are filtered out on ingress because the federation doesn’t support their use, which probably reduces the scale of the problem a little.

Enjoy,

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260515/1becbac1/attachment.p7s>