OIDC OP v4.3.0 and OIDC RP Authentication Proxy v2.3.0 Now Available

[Philip Smart]

The Shibboleth Project has released V4.3.0 of the OIDC OP plugin (see release notes at [1]) and V2.3.0 of the OIDC RP authentication proxy plugin (see release notes in [2]).

Both releases accompany, and require, a new version of the OIDC commons library (see release notes at [3]) and OIDC config module.

Among the new features and bug fixes, both the OP and RP now include safeguards against audience injection attacks that could result from third-party software behavior, see the release notes. Importantly, our software was not directly vulnerable to these attacks, but we’ve added these configurable protections as a proactive measure.

-- Henri Mikkonen and Phil Smart, on behalf of the team

[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2776760321/OPReleaseNotes

[2] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes

[3] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3232137218/OIDCCommonReleaseNotes

Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice