[SourceID Announcement] SourceID-SSO Beta-7 with Interoperability Bugfixes
Bryan Field-Elliot <[email protected]> 25 Mar 2003 11:06:00 -0700
| Newsgroups | gmane.comp.sourceid.sso.announce |
|---|---|
| Message-ID | <1048615560.26330.14.camel__44021.6966941536$1048615966@bryan.netmeme.org> |
--=-PpQ279B25vJFglDp/qaP Content-Type: text/plain Content-Transfer-Encoding: 7bit SourceID is pleased to announce the immediate availability of Beta 7 of the SourceID-SSO toolkit. This release contains many bug and compliance fixes, as a result of extensive interoperability testing. During the week of March 17th (2003), the Liberty Alliance coordinated a massive interoperability testing event in Provo, Utah (hosted by Novell), where SourceID-SSO was tested against many other vendors' Liberty Protocol software implementations. The trip was sponsored by Ping Identity Corporation, and was a highly productive validation event. While the majority of the changes in this release are bug and compliance fixes, there are some new features as well, including: - Configurable variables (in sourceid-sso.xml) for generated assertion "NotBefore' and "NotOnOrAfter" tolerances. - Ability to remove a session-context attribute from your application upon logout (extending global logout deeper into your application). - Support for the brws-post profile initiated by an IDP, missing from prior betas (consuming brws-post, as well as all brws-art variants, were already supported). - Support for browser-based Federation Termination initiation, missing from prior betas (all other FedTerm variants were already supported). Following is the complete changelog, file by file, detailing all fixes and enhancements: Thank you, Bryan Field-Elliot Chief Architect, SourceID-SSO SourceID-SSO Beta 7 Changelog - In-memory Account Handler (AccountHandlerInMemoryImpl.java) - Added methods fixupNamePair, fixupNameIdentifier to treat empty name identifier elements as nulls. Some other Liberty implementations use the two interchangeably, we need to accomomodate them. - Added debug-only method, dumpDatabase, to dump the contents of this database to the log. - JDBC Account Handler (AccountHandlerJDBC.java) - Added methods fixupNamePair, fixupNameIdentifier to treat empty name identifier elements as nulls. Some other Liberty implementations use the two interchangeably, we need to accomomodate them. - IDP Authenticator (Authenticator.java) - IsPassive defaults to true if SP doesn't provide (Liberty 1.1 compliance) - ProtocolProfile defaults to brws-art if SP doesn't provide (Liberty 1.1 compliance) - Proper handling of "1" in addition to "true" (Liberty 1.1 compliance) - Extra debug checking for loss of session state (cookie) - If IsPassive is true, but not logged in, then return a graceful error condition rather than throw exception - If using brws-art profile, return a samlp:ResponseType, rather than lib:AuthnResponseType (Liberty 1.1 compliance) - If using brws-art profile, add SubjectConfirmation data to samlp:Response (Liberty 1.1 compliance) - Save Authentication Method in session scope for later reference (previously, was throwing it away) - NotBefore, NotOnOrAfter assertion tolerances now configurable in sourceid-sso.xml - Use RelayState rather than LRURL as parameter name in brws-art response (Liberty 1.1 compliance) - brws-post profile supported - SP Authentication Requestor (AuthnRequestor.java) - Use SignedSAMLRequest type when requesting assertion via artifact - When consuming response from an IDP, if the ProviderID is not supplied, try to infer it from session variable (Liberty 1.0) - When digital signature doesn't verify, return a graceful error condition to the calling JSP page, rather than throw exception - Terminate Federation (FederationTerminator.java) - Support for SOAP-based profile on requesting side (wasn't supported in prior betas) - Include RelayState in HTTP-based responses (wasn't being included in prior betas) - Logout (Logout.java) - Support for "remove-session-attribute-on-logout" option in sourceid-sso.xml. - Fixed bug in global logout with IDP-rendered image page. - Configuration - idp-post-assertion-render-page option added - remove-session-attribute-on-logout option added - assert-tolerance-not-before option added - assert-tolerance-not-on-or-after option added - SOAP Artifact Retriever - Handle samlp:Response correctly, with InResponseTo element coming from current SOAP request rather than original Authn request - Extra outgoing signature verification in debug mode - SOAP Global logout - More complete session cleanup - Support for remove-session-attribute-on-logout - ServletUtils - Extra check of outgoing querystring signature in debug mode - parseBoolean() for handling various forms of "true" permitted - XMLUtils - Better handling of carriage-returns in base64 encoding/decoding - Rewritten "id generator" engine, is compliant with XML RFC - Added "xmlns:xsi" namespace declaration to outgoing XML documents - XML document serializer now uses indenting for easier human viewing/debugging - "sign" method signature changed, and verifies outgoing signature before returning, in debug mode - sendSOAP method has better handler for empty or null document bodies upon return - Certificates - x509SerialNumber data type changed to "String" from "Integer" - Authentication Contexts - Changed Castor binding file to fix a problem in original generated source (should be sequence, not choice) - XML data bindings - Several namespace declaration fixes - Known Issues - May have problems with browsers without cookies - Under certain circumstances, timestamps are output with incorrect timezones. This may lead to assertions being rejected from other providers. A workaround in this release is to increase the assertion tolerances (by a factor of hours instead of minutes) in sourceid-sso.xml. --=-PpQ279B25vJFglDp/qaP Content-Type: text/html; charset=utf-8 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/1.0.4"> </HEAD> <BODY> SourceID is pleased to announce the immediate availability of Beta 7 of the SourceID-SSO toolkit. <BR> <BR> This release contains many bug and compliance fixes, as a result of extensive interoperability testing. During the week of March 17th (2003), the Liberty Alliance coordinated a massive interoperability testing event in Provo, Utah (hosted by Novell), where SourceID-SSO was tested against many other vendors' Liberty Protocol software implementations. The trip was sponsored by Ping Identity Corporation, and was a highly productive validation event. <BR> <BR> While the majority of the changes in this release are bug and compliance fixes, there are some new features as well, including: <BR> <BR> - Configurable variables (in sourceid-sso.xml) for generated assertion "NotBefore' and "NotOnOrAfter" tolerances. <BR> - Ability to remove a session-context attribute from your application upon logout (extending global logout deeper into your application). <BR> - Support for the brws-post profile initiated by an IDP, missing from prior betas (consuming brws-post, as well as all brws-art variants, were already supported). <BR> - Support for browser-based Federation Termination initiation, missing from prior betas (all other FedTerm variants were already supported). <BR> <BR> Following is the complete changelog, file by file, detailing all fixes and enhancements: <BR> <BR> Thank you, <BR> <BR> Bryan Field-Elliot <BR> Chief Architect, SourceID-SSO <BR> <BR> <BR> SourceID-SSO Beta 7 Changelog <BR> <BR> - In-memory Account Handler (AccountHandlerInMemoryImpl.java) <BR> - Added methods fixupNamePair, fixupNameIdentifier to treat empty name identifier elements as nulls. Some other Liberty implementations use the two interchangeably, we need to accomomodate them. <BR> - Added debug-only method, dumpDatabase, to dump the contents of this database to the log. <BR> <BR> - JDBC Account Handler (AccountHandlerJDBC.java) <BR> - Added methods fixupNamePair, fixupNameIdentifier to treat empty name identifier elements as nulls. Some other Liberty implementations use the two interchangeably, we need to accomomodate them. <BR> <BR> - IDP Authenticator (Authenticator.java) <BR> - IsPassive defaults to true if SP doesn't provide (Liberty 1.1 compliance) <BR> - ProtocolProfile defaults to brws-art if SP doesn't provide (Liberty 1.1 compliance) <BR> - Proper handling of "1" in addition to "true" (Liberty 1.1 compliance) <BR> - Extra debug checking for loss of session state (cookie) <BR> - If IsPassive is true, but not logged in, then return a graceful error condition rather than throw exception <BR> - If using brws-art profile, return a samlp:ResponseType, rather than lib:AuthnResponseType (Liberty 1.1 compliance) <BR> - If using brws-art profile, add SubjectConfirmation data to samlp:Response (Liberty 1.1 compliance) <BR> - Save Authentication Method in session scope for later reference (previously, was throwing it away) <BR> - NotBefore, NotOnOrAfter assertion tolerances now configurable in sourceid-sso.xml <BR> - Use RelayState rather than LRURL as parameter name in brws-art response (Liberty 1.1 compliance) <BR> - brws-post profile supported <BR> <BR> - SP Authentication Requestor (AuthnRequestor.java) <BR> - Use SignedSAMLRequest type when requesting assertion via artifact <BR> - When consuming response from an IDP, if the ProviderID is not supplied, try to infer it from session variable (Liberty 1.0) <BR> - When digital signature doesn't verify, return a graceful error condition to the calling JSP page, rather than throw exception <BR> <BR> - Terminate Federation (FederationTerminator.java) <BR> - Support for SOAP-based profile on requesting side (wasn't supported in prior betas) <BR> - Include RelayState in HTTP-based responses (wasn't being included in prior betas) <BR> <BR> - Logout (Logout.java) <BR> - Support for "remove-session-attribute-on-logout" option in sourceid-sso.xml. <BR> - Fixed bug in global logout with IDP-rendered image page. <BR> <BR> - Configuration <BR> - idp-post-assertion-render-page option added <BR> - remove-session-attribute-on-logout option added <BR> - assert-tolerance-not-before option added <BR> - assert-tolerance-not-on-or-after option added <BR> <BR> - SOAP Artifact Retriever <BR> - Handle samlp:Response correctly, with InResponseTo element coming from current SOAP request rather than original Authn request <BR> - Extra outgoing signature verification in debug mode <BR> <BR> - SOAP Global logout <BR> - More complete session cleanup <BR> - Support for remove-session-attribute-on-logout <BR> <BR> - ServletUtils <BR> - Extra check of outgoing querystring signature in debug mode <BR> - parseBoolean() for handling various forms of "true" permitted <BR> <BR> - XMLUtils <BR> - Better handling of carriage-returns in base64 encoding/decoding <BR> - Rewritten "id generator" engine, is compliant with XML RFC <BR> - Added "xmlns:xsi" namespace declaration to outgoing XML documents <BR> - XML document serializer now uses indenting for easier human viewing/debugging <BR> - "sign" method signature changed, and verifies outgoing signature before returning, in debug mode <BR> - sendSOAP method has better handler for empty or null document bodies upon return <BR> <BR> - Certificates <BR> - x509SerialNumber data type changed to "String" from "Integer" <BR> <BR> - Authentication Contexts <BR> - Changed Castor binding file to fix a problem in original generated source (should be sequence, not choice) <BR> <BR> - XML data bindings <BR> - Several namespace declaration fixes <BR> <BR> - Known Issues <BR> - May have problems with browsers without cookies <BR> - Under certain circumstances, timestamps are output with incorrect timezones. This may lead to assertions being rejected from other providers. A workaround in this release is to increase the assertion tolerances (by a factor of hours instead of minutes) in sourceid-sso.xml. <BR> <BR> <BR> </BODY> </HTML> --=-PpQ279B25vJFglDp/qaP--