Call for new maintainer

[markstos]

passport-saml has been successful, but now commits have now stalled for 6 months while there are almost a dozen open pull requests and as many forks with contributions that could be worth reviewing:

https://github.com/bergie/passport-saml/network

The project would benefit from someone stepping to help maintain this module or to fork it and maintain it under a different name.

There are already 31 results when search for "Passport SAML" modules for Node.js: https://www.npmjs.com/search?q=passport+saml

How many do we need? There's clearly a number of people willing to spend time coding for a feature like this. Before things get more fractured, it would be great if there was a new or additional maintainer to bring some vitality back to the passport-saml project and continue it as a best-in-class option.

The original authors have done a great job to bring the project this far but are under no obligation to give more time than they already have. New talent would be welcome be of benefit to the community.

Thanks.

[bergie]

@ploer are you still around?

If not, I'm willing to give the maintainership over to another volunteer

[markstos]

@bergie Thanks for the reply. I see that @ploer has had zero public Github contributions in the past year. There are several other Passport+SAML projects on NPM, though. Maybe one of them is interested in joining forces.

[pitbulk]

Hi,

I'm the maintainer of Onelogin's PHP, Java, Python and Ruby open source SAML toolkits and I want to see the Node.js SAML community united and active.

I'm not able to code in that language but I offer my help reviewing functionalities of the Node.js implementations available and try to bring the right functionality/decision.
I also offer my knowledge of SAML and my know-how implementing SAML toolkits.

So if a maintainer appears, will not be alone and I offer him my spare time to push the project.

[markstos]

CC: @jameswomack, author of the "passport-saml-restify" fork. The passport-saml project is looking for maintenance help.

[markstos]

CC: @ucsf-ckm, @dmapper, @ZheFeng, @lmarkus, @drstearns, @scottylogan, @codeNgamer authors of passport-saml related modules: The passport-saml project is looking for maintenance help if you are interested to collaborate. By following this related bug tracker, you can find out immediately about bugs and security issues which may also affect your related project.

[lmarkus]

@markstos @pitbulk , Apologies, I won't be able to participate, as I'm personally strapped for time these days.
Thanks for the initiative, and best of luck!

[pdspicer]

@markstos @bergie I have no affiliation to any SAML or passport-saml* projects but am familiar with the protocol and implementation and would be happy to help in maintaining this project, if there's still interest.

[markstos]

@pdspicer Thanks for your interest. It will be up to @bergie to make a final call about granting direct repo access.

[bergie]

@pdspicer you have access now. Thanks!

[pdspicer]

@bergie thanks, I promise only to use my access rights for good.. Will you make publish available on npm as well?

[cjbarth]

@pdspicer I will certainly do what I can to help work with you on clearing out this backlog of issues and PRs. Do you have an approach to clearing this out that you are considering so that @pitbulk and others that are interested can help handle things in a reasonable and sensible order?

[pdspicer]

@cjbarth right now looking at PRs, providing feedback and trying to gauge which ones potentially still have interest from their various authors. At the same time considering consolidation of those that are similar in scope: for example many are around customization of attributes in various places, and may be addressed through a common approach. Goal in the short-term is to bring in as much as possible without introducing breaking changes, giving priority to PRs as many of them also address issues that have been raised. Will look at other issues (without PRs) next, then those that will require a bump in major version for being backward-incompatible.

[bergie]

@pdspicer done

[markstos]

As a new SAML library maintainer, it could also be helpful to brush up on SAML security considerations, https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet so that any changes don't inadvertently introduce or re-introduce security problems. I would have suggested reviewing the Changelog to see what security issues have already come in the past, but I see now there is no Changelog. That would also be on my wishlist for improvements. http://keepachangelog.com/ Thanks for helping with passport-saml!

…

On Fri, Mar 31, 2017 at 6:18 AM, Henri Bergius ***@***.***> wrote: @pdspicer <https://github.com/pdspicer> done — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#162 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABk5bT-eOCr7imep5NrlE0tqZUmJgsyks5rrNLzgaJpZM4Jb6RT> .

-- Mark Stosberg Senior Systems Engineer RideAmigos

[pdspicer]

@markstos Yes, adding a changelog for future enhancements will be up there on the list of todos, as will ensuring that security best practices are being followed. Thanks for the refs!

@bergie thank you, I will mark this issue as closed.