Name: open federation sharedlib

WWW: http://www.forgerock.com/

License: CDDL


The Open Web SSO project (OpenSSO) provides core identity services to simplify the
implementation of transparent single sign-on (SSO) as a security component in a network
infrastructure. OpenSSO provides the foundation for integrating diverse web applications that
might typically operate against a disparate set of identity repositories and are hosted on a
variety of platforms such as web and application servers. This project is based on the code
base of Sun JavaTM System Access Manager, a core identity infrastructure product offered by
Sun Microsystems.

Changes:
- opensso sharedlib express 8, patch3 (matti, 2017-03-20)
  ALIAM-5485: Disabled validation again because our own messages did not
  always validate correctly.
- opensso sharedlib express 8, patch2 (matti, 2017-03-14)
  ALIAM-5485: Fixed XML XXEA Vulnerability by adding validation and disabling
  remote file inclusion.
- openfedlib - opensso express 8, patch6 (rmarti, 2016-03-22); ALIAM-3854
  Added 'Content-Type' header for HTML form in com.sun.identity.saml2.common.SAML2Utils.
- openfedlib - opensso express 8, patch5 (matti, 2015-11-25); ALIAM-3556
  Fixed NPE in IDPAccountMapperImpl when an AuthnRequest didn't contain a NameIDPolicy or SpNameQualifier,
  since previously, the spNameQualifier was passed in as SP entity ID which was not always set.
- openfedlib - opensso express 8, patch4 (schneadr, matti, 2014-01-20); ALIAM-720
  Created new class SamlSignatureProvider to replace FMSigProvider to be able to
  handle several different signature algorithms and key types in same instance.
  Note: FMSigProvider has been reverted to original version (patch2 and patch3 are
  now included in the new class).
- openfedlib - opensso express 8, patch3 (seitz, 2013-06-24); MEDUSASUPPORT-485
  fixed JRE-1.7.0_25 incompatibility in com.sun.identity.saml2.xmlsig.FMSigProvider
  by using the XML Digital Signature API in sign() and verify() instead of the Apache santuario API.
  fixed JRE-1.7.0_25 incompatibility in com.sun.identity.saml.xmlsig.AMSignatureProvider
  by using the XML Digital Signature API in
  signXML(Document doc, String certAlias, String algorithm, String idAttrName, String id, boolean includeCert, String xpath)
  instead of the Apache santuario API.
- opensso sharedlib express 8, patch1 (matti, 2013-01-22)
  Removed an unwanted runtime shutdownhook which prevented the WebappClassLoader
  from being garbage collected.
- openfedlib - opensso express 8, patch2 (matti, 2012-08-13); ALIAM-208
  Fixed a vulnerability in com.sun.identity.saml2.xmlsig.FMSigProvider.verify() line
  282: XML signature verification was vulnerable to an XML Signature Wrapping attack.
  See also upstream patch http://sources.forgerock.org/changelog/openam?cs=1514
- openfedlib: opensso express 8, patch1 (matti, 2010-02-23)
  Fixed a bug in com.sun.identity.saml2.profile.IDPSingleLogout.processLogoutResponse() line
  1037: The SP entity ID passed in the method call was always the SP who just sent the
  LogoutResponse instead of the next SP which lead to incorrect configuration values being used
  (specifically the wantLogoutResponseSigned attribute was used from the wrong SP).
  See also https://opensso.dev.java.net/issues/show_bug.cgi?id=6125

