<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Corbel;
panose-1:2 11 5 3 2 2 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word;overflow-wrap: break-word;-webkit-nbsp-mode: space;line-break:after-white-space">
<div class="WordSection1">
<p class="MsoNormal">Phil,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tested and confirmed working against Duo9.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Philip Smart via users<br>
<b>Sent:</b> Thursday, May 8, 2025 12:16 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Cc:</b> Philip Smart <Philip.Smart@jisc.ac.uk><br>
<b>Subject:</b> DuoOIDC plugin testing with updated root CA bundle<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi everyone,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">Duo has recently updated the root CA bundle included with their Web SDK v4. These "pinned” root certificates are used to evaluate the chain of trust associated with the end-entity certificate presented by the Duo API. Note that the plugin
does not (has never) use the default set of certificates provided by the JDK. We plan to include the same set of updated certificates in both variants of the DuoOIDC plugin starting from version 2.2.0.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Testing the updated CA bundle can be challenging because it depends on the API host configured for your client or integration. Since we don't have access to all the hosts for testing, we would like to ask if anyone would be willing to install
the current snapshot of either DuoOIDC plugin variant (as they use the same set of certificates) in a development environment and test their integration. If you could do that and share the results, we would greatly appreciate it. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You can find the instructions for installing a snapshot on the Plugin Testing Wiki page [1]. Specifically, you’d need to install version 2.2.0-SNAPSHOT of either the 'Duo Plugin (Nimbus)' or the 'Duo Plugin (Duo SDK)', as indicated on the
project status site linked in the plugin testing page.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This is also a heads-up that these certificates are being updated. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Phil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">[1] <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3256057857/Plugin*Testing__;Kw!!DZ3fjg!4ABKeacukJt1vfRmDGJogL7KOzjQff6tMU1HhFSnBWjsfcusELx2Mxr993Y--NUjqUzkBId7A4gWh2GMxWzs$">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3256057857/Plugin+Testing</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif"><o:p> </o:p></span></p>
<p style="margin-bottom:12.0pt"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered
in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<o:p></o:p></span></p>
<p style="margin-bottom:12.0pt"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number
GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<o:p></o:p></span></p>
<p><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">For more details on how Jisc handles your data see our privacy notice here:
<a href="https://urldefense.com/v3/__https:/www.jisc.ac.uk/website/privacy-notice__;!!DZ3fjg!4ABKeacukJt1vfRmDGJogL7KOzjQff6tMU1HhFSnBWjsfcusELx2Mxr993Y--NUjqUzkBId7A4gWhxWycKmN$">
https://www.jisc.ac.uk/website/privacy-notice</a><o:p></o:p></span></p>
</div>
</body>
</html>