Good morning peeps, I would like to give to you a heads up to avoid any kind of confusion (sorry for the long e-mail). If you are too lazy to read the whole e-mail here is the TL;DR: Don't make use of AeroGear Security PicketLink 1.1.2/1.2.0 because they have critical bugs. Use the snapshot release 1.2.1-SNAPSHOT. Some weeks ago AeroGear Security 1.2.0 was released with PicketLink Beta 6, Before the released I tested it against AeroGear Controller demo and couldn't find any issue. Changelog - AeroGear Security 1.2.0 * [7743790] - Formatting * [85805a4] - POJO is an acronym, should be uppercase * [ee0f8fb] - mention Apache Shiro and Hawk * [b65e403] - bump up to 1.2.0 * [a177956] - Adding unit tests for empty passwords and certificates * [7d7e6ed] - [maven-release-plugin] prepare for next development iteration * [c1f8aee] - [maven-release-plugin] prepare release 1.2.0 - AeroGear Security PicketLink 1.2.0 (PL beta6) * [3d1407a] - [maven-release-plugin] prepare for next development iteration * [10b05d7] - [maven-release-plugin] prepare release 1.2.0 * [7c1001f] - Merge branch 'AGSEC-93' * [1d84d7d] - Fixing unit tests and ignoring some methods * [93ce3f2] - Display the correct OTP login name * [98b444f] - Bump up to PicketLink beta6 After the released we found some compatibility issues with the push server and also security issues, so we had to keep the Unified push server stable and for this reason was created a branch '1.1.x' on AeroGear Security and released 1.1.2 with PicketLink Beta 5. Changelog - AeroGear Security 1.1.2 * [86f1a3c] - [maven-release-plugin] prepare for next development iteration * [271d52e] - [maven-release-plugin] prepare release 1.1.2 * [4851dc7] - Equate API release with ag-sec PL to prevent Broken APIs * [df99702] - Merge branch 'password_reset' into 1.1.x * [60b5d1f] - Grab the HTTP status provided by AG Exception * [138ac22] - Message and HTTP status to credential already expired * [29e6ca2] - Exception handling for AeroGear messages * [475ecea] - Some Javadoc would be nice * [6ee19ae] - Inclusion of contracts to revoke roles * [d8afc7d] - Formatting - AeroGear Security PicketLink 1.1.2 * [091ef0f] - [maven-release-plugin] prepare for next development iteration * [c4c0199] - [maven-release-plugin] prepare release 1.1.2 * [79abc3c] - Switch to the correct version of AGSec API * [d0e80b0] - Merge branch 'password_reset' into 1.1.x * [8c69551] - Validate if credential has expired * [6eda9ae] - Credential matcher * [9df4cc6] - Validate provided credentials and reset password if credentials are valid or already expired * [24ddf34] - Extracting password validation to the credential matcher * [ffc70fd] - Make travis happy with snapshot repository * [bd44bb3] - Update the snapshot release from AGSec * [387e2c2] - Optimizing imports * [a7719f9] - Inclusion of a method to revoke roles to the specified user and avoiding a bunch of conditional statements at developers side * [b38185a] - Formatting * [757238c] - Parent POM * [ac321a6] - Bump up to the snapshot release * [4d9e397] - Validate the password expiration * [22e1b7e] - Preparing to release 1.1.1 * [d0e339a] - Merge branch 'AGSEC-75' * [4d98c9b] - Fixes NPE from PicketLink when some role can't be found Today PicketLink Beta7 was released (http://lists.jboss.org/pipermail/security-dev/2013-August/001415.html) with the security fixes based on team's feedback and I already deployed AeroGear Security 1.2.1 on snapshots. Changelog - AeroGear Security * [f1900fe] - Removing any dependencies on Resteasy - AeroGear Security PicketLink * [393a810] - Update to PicketLink 2.5.0 Beta7 * [829ff1a] - Bump up to snapshot release from PicketLink * [99cd2e5] - Fixes the API compatibility broken by PL The PicketLink API has changed a lot since Beta5 and some projects already received my PR: - https://github.com/aerogear/aerogear-unified-push-server/pull/72 - https://github.com/aerogear/aerogear-controller-demo Thanks for your patience and time reading it, 1.2.1 will be released on the next week after some feedback.

Karel Piwko wrote: > I'm a bit confused here. So does 1.2.1-SNAPSHOT solve incompatibility issues > for Unified Push Server? 1.1.2-SNAPSHOT solve security issues in any AeroGear project, not only on Unified Push server.

Or will there be 1.1.3 with PL Beta7 compatible with > stable Unified Push Server as well? The version 1.2.1 will be released once PicketLink Beta7 is a huge change to our projects. Makes sense now?

Karel Piwko wrote: > Not really. Let me rephrase. Previously, there were two branches for > Aerogear Security, 1.1.x and 1.2.x, Is not that true, the branch 1.2.x doesn't exist (http://photon.abstractj.org/aerogearaerogearsecurity_20130812_070155.jpg) according to your email 1.1.x existed due to > incompatibility with Unified Push Server. 1.1.x was created because PicketLink beta6 had a ton of changes and would break the API existent into Unified Push server. Our schedule was too tight for webinar, so the change wouldn't be a good idea. > > I was asking whether 1.2.1-SNAPSHOT solves that 1.2.1 release solves critical security issues founded into PicketLink beta5 / beta6 , that is could I use > Aerogear Security 1.2.1-SNAPSHOT with Unified Push Server right now Yes -> https://github.com/aerogear/aerogear-unified-push-server/pull/72 (already fixed the issue reported by Matthias) , or there > is a work needed on Push to make it work with 1.2.1-SNAPSHOT or even > whether you plan to continue with Aerogear Security 1.1.x series for that > reason. > No work is needed. > Makes sense now? Clear now? Let me know.