Shibboleth Identity Provider Security Advisory [13 May 2026]

[Peter Schober]

Ian Young <ian at iay.org.uk> [2026-05-15 16:14 CEST]:
> The UKf MDA configuration, at least, does perform namespace prefix
> normalisation. It’s done using an XSL transform performed right
> before the creation of the (unsigned) aggregate output files. So if
> people are looking for a quick fix that doesn’t involve converting
> to MDA, you can probably do it with xsltproc.

Thanks, Ian! This seems to work fine (on a quick look) and pyff does
have a pipeline for calling out to xslt files, so I should be able to
add this w/o large reconstructions of my processing.

FTR, Maja W. already identified that pyff does normalise prefixes on
elements and attributes, it just doesn't remove unused prefixes from
the root element of the document, and that a call to Python's
etree.cleanup_namespaces() seems to be all that's missing to get rid
of those, too.
So hopefully that can be integrated in pyff, fixing this at the root
(element, pardon my pun) of the issue.

-peter