guanxi sp and idp releases

Tue, Aug 16, 2011

I’ve made the latest Guanxi module releases for bug fixes, improvements and an update that addresses SAML wrap attacks against the SP::Engine.

Files are available on github:

and sourceforge: Release notes:

Beans

  • 1.4.7
  • Added maven-deploy-plugin
  • Updated xsd/saml/oasis-sstc-saml-schema-assertion-1.1.xsd. xmldsig-core-schema.xsd now local due to to timeout errors on www.w3.org
  • Updated xsd/saml/oasis-sstc-saml-schema-protocol-1.1.xsd. xmldsig-core-schema.xsd now local due to to timeout errors on www.w3.org
  • Updated xsd/saml/saml-schema-assertion-2.0.xsd. xmldsig-core-schema.xsd and xenc-schema.xsd now local due to to timeout errors on www.w3.org
  • Updated xsd/saml/saml-schema-metadata-2.0.xsd. xmldsig-core-schema.xsd and xenc-schema.xsd now local due to to timeout errors on www.w3.org
  • Updated xsd/saml/saml-schema-protocol-2.0.xsd. xmldsig-core-schema.xsd now local due to to timeout errors on www.w3.org
  • Updated xsd/shibboleth/shibboleth-metadata-1.0.xsd. xmldsig-core-schema.xsd now local due to to timeout errors on www.w3.org
  • Added xmldsig/xmldsig-core-schema.xsd
  • Added xmldsig/xenc-schema.xsd
Common
  • 2.0.10
  • Updated org.guanxi.common.Utils. Added decodeBase64b to sort deflation encoding errors on linux
  • Updated org.guanxi.common.trust.TrustUtils.Updated verifySignature to guard against wrap attacks.
  • Added maven-deploy-plugin
Common::Lite
  • 1.0.2
  • Added maven-deploy-plugin
Core
  • 2.0.10
  • Removed Guanxi from dependencyManagement as the modules now include explicit versions themselves.
  • Removed maven-deploy-plugin as each module will now deploy itself
  • Moved maven-javadoc-plugin to here
  • Updated scm plugin to use git
  • Removed site from distributionManagement
IdP
  • 2.2.4
  • Updated org.guanxi.idp.service.saml2.WebBrowserSSOAuthHandler. Updated preHandle to use byte[] to decompress SAMLRequest in HTTP_REDIRECT binding
  • Added maven-deploy-plugin
Provider
  • 1.0.1
  • Added maven-deploy-plugin
Engine
  • 2.2.4
  • Added maven-deploy-plugin
  • Updated org.guanxi.sp.engine.service.generic.GenericProfileService. Updated gps to fix wrong error message for profile service error
  • Updated org.guanxi.sp.engine.service.saml2.SAML2ProfileService. Fixed bug in doProfile where it wasn’t accepting SAML2 HTTP_REDIRECT binding in metadata
  • Updated org.guanxi.sp.engine.service.saml2.WebBrowserSSOAuthConsumerService. Updated acs to display an error if no Guard/Engine session is present. Also displays an error now if it can’t decrypt the response. Also removes the Guard session after it has processed it to stop replay attacks.
Guard
  • 3.0.2
  • Updated src/main/java/org/guanxi/sp/guard/Logout.java. Fixed bug in processLogout. Added goto request parameter. Logout service will redirect to this URL if it is specified
  • Added maven-deploy-plugin
WAYF
  • 1.2.9
  • Added maven-deploy-plugin

comments powered by Disqus