SimpleSAMLphp Project update

PRESENTED BY:

Dedra Chamberlin on behalf of the SSP Board of Directors

SSP 2.0

• First release candidate - July 2022
• Second (and maybe final) released candidate - Sept 2022

​

What’s changing?

• Support for certificate fingerprints was removed
• Support for SAML 1.1 was removed
• Old-style PHP templates were removed
• Old-style dictionaries were removed
• The default value for attrname-format was changed to 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri' to comply with SAML2INT
• core:PairwiseID and core:SubjectID authprocs no longer support the 'scope' config-setting. Use 'scopeAttribute' instead to identify the attribute holding the scope.
• Accepting unsolicited responses can be disabled by setting enable_unsolicited to false in the SP authsource.
• Certificates and private keys can now be retrieved from a database
• Support for Redis sentinel was added (#1699)

[ 2 ]

Staffing

• Posted job listing for lead maintainer summer 2022
• New lead maintainer chosen: John Sinteur - in the process of completing hiring
• This position will work closely with active contributors on code review, merges, and pushing new code to production, as well as prioritizing next efforts
• Hope is to have a SSP hackathon/workshop in February or March 2023

[ 3 ]

New Authmodule for Microsoft VerifiedID

• SURFnet developed ReadID module (https://github.com/SURFnet/simplesamlphp-module-readid)
• Cirrus Identity now refactoring it for SSP v2 compatibility.
• Utilizes the MS Entra Verified ID REST API for Verifiers (https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/presentation-request-api), and requires the use of Microsoft Authenticator (https://www.microsoft.com/en-us/security/mobile-authenticator-app) by end users to present credentials issued by a Microsoft Entra Verified ID issuer.
• End-user presentation of verified credentials issued by an allowed issuer (specified in configuration) constitutes successful authentication.
• Claims in verification callback responses are returned as attributes, which can be mapped to SAML attributes via the core:AttributeMap authproc filter.

[ 4 ]

Fundraising campaign

• Current financial contributions from:

​

​

​

​

​

• New fundraising solicitation just starting
• Goal to raise $100K per year in operating revenue
• SSP Board hopes to expand hours of the lead maintainer and add a project coordinator / communications person to handle communications and organize community events
• If your organization leverages the SSP project, and/or values the project and its future, please consider making a recurring contribution

[ 5 ]

More Info?

If you have questions, would like more info, or would like to contribute to the project:

​

SSAML.board@commonsconservancy.org

​

SSP Board Members:

Marina Adomeit

Dedra Chamberlin

Niels van Dijk

Jan Meijer

Jaime Perez