[shib_auth] New releases

[Kristof Bajnok]

Hi Drupal shib_auth users,

it's been several years that no new shib_auth releases turned up. Today,
you're receiving actually four, so let me clarify.

1. Security
-----------
A Cross Site Request Forgery was reported by the Drupal Security Team,
that affects all versions (both D6 and D7). This vulnerability allows an
attacker delete from the role matching rules list by getting an
administrator's browser to visit a crafted URL.

This security bug was fixed in 6.x-4.1 and 7.x-4.1. This is actually a
backport, read on.

2. Bug fixes, new functionality
-------------------------------
Unfortunately, there is a very long backlog of issues that were fixed in
the -dev version but the fix was not released. Those changes were tagged
as 6.x-4.2-rc1 and 7.x-4.2-rc1, respectively.

I think that the release candidate versions are more stable than 4.0 /
4.1 is, but since they received limited testing, I decided to tag them
as release candidates. If no issues are reported in the next couple of
days, I'll re-release them as stable versions.

The list of changes of the D7 version is much longer than D6, the latter
is absolutely minimal. This means that the focus of the development is
D7 at the moment, D6 will receive only minimal maintenance in the future.


3. Profile fields
-----------------
A major work has been contributed to shib_auth from Géant3+ HEXAA
project (as a sub-module): it is now possible to map Shibboleth
variables to the profile of the user. However, this functionality was
only implemented to D7 and we have no plans to backport it to D6.

See
https://wiki.aai.niif.hu/index.php?title=DrupalShibbolethReadmeDev#User_profile_mapping
for details.

+1. Drupal 8 transition
-----------------------
Unfortunately the work hasn't really started. There are substantial
changes in D8 regarding the external user registration, that would
possibly need a major rewrite. We'll report here if there is any
progress in this area.


Cheers,
Kristof