build.shibboleth.net returning 403 — OpenSAML dependencies unresolvable

[morris-hong-querypie]

Description

As of April 15, 2026, build.shibboleth.net is returning HTTP 403 Forbidden for all requests, making it impossible to resolve OpenSAML dependencies required for Spring Security SAML support.

Affected URLs

All paths under build.shibboleth.net return 403:

$ curl -s -o /dev/null -w "%{http_code}" https://build.shibboleth.net/maven/releases/
403

$ curl -s -o /dev/null -w "%{http_code}" https://build.shibboleth.net/maven/releases/org/opensaml/opensaml-saml-impl/4.3.2/opensaml-saml-impl-4.3.2.pom
403

$ curl -s -o /dev/null -w "%{http_code}" https://build.shibboleth.net/
403

What we have verified

• Tested from multiple networks (wired broadband + mobile data) — same 403 from all
• All other Maven repositories (Maven Central, Gradle Plugin Portal, Spring) are working normally
• The old Nexus URL (/nexus/content/repositories/releases/) redirects (302) to the new path (/maven/releases/) which also returns 403
• No announcement found on Shibboleth wiki or mailing list archives
• At least one other report found today: Azure DevOps pipeline failing with same 403

Impact

This is the single-point-of-failure scenario previously discussed in #11966 and #14286.

Questions to the community

• Is anyone else experiencing this right now? We would like to understand how widespread this is.
• Does anyone have more context on whether this is a temporary outage, planned maintenance, or a policy change on Shibboleth side?
• Are there any alternative mirrors for OpenSAML artifacts?

[atulShu07]

@morris-hong-querypie yes we are also facing this from today :
Failed to collect dependencies at org.apache.cxf.services.xkms:cxf-services-xkms-common:jar:4.1.4 -> org.apache.wss4j:wss4j-ws-security-dom:jar:4.0.1 -> org.apache.wss4j:wss4j-ws-security-common:jar:4.0.1 -> org.opensaml:opensaml-saml-impl:jar:5.1.6: Failed to read artifact descriptor for org.opensaml:opensaml-saml-impl:jar:5.1.6: Could not transfer artifact org.opensaml:opensaml-saml-impl:pom:5.1.6 from/to B_shibboleth (https://build.shibboleth.net/nexus/content/groups/public): Authorization failed for https://build.shibboleth.net/nexus/content/groups/public/org/opensaml/opensaml-saml-impl/5.1.6/opensaml-saml-impl-5.1.6.pom 403 Forbidden

[e4711s]

Same problem here as well - builds breaking because https://build.shibboleth.net returns 403.

[md4cc]

Same problem here, when starting Maven Build within an Azure Pipeline.

[e4711s]

I found this announcement: https://shibboleth.net/pipermail/announce/2026-April/000377.html

[probststefan]

Does anybody already have a workaround for this?

[tmakar]

Does anybody already have a workaround for this?

We luckily had the jar files cached in our pipelines, but you could also add them temporarily to your repository and reference it in the <repositories> tag - the url is just pointing to a local libs directory (given your libs is in the root) which contains the structure listed below. Or you could upload the jars to some other storage you have and reference it from there.

libs/                                                                                                                                                                                                                                  
  ├── net/
  │   └── shibboleth/                                                                                                                                                                                                                    
  │       ├── parent/                                                                                                                                                                                                                  
  │       │   └── 17.1.6/                                                                                                                                                                                                                
  │       ├── shib-networking/                                                                                                                                                                                                         
  │       │   └── 9.1.6/                                                                                                                                                                                                                 
  │       ├── shib-security/
  │       │   └── 9.1.6/                                                                                                                                                                                                                 
  │       ├── shib-shared-parent/                                                                                                                                                                                                      
  │       │   └── 9.1.6/
  │       ├── shib-support/                                                                                                                                                                                                              
  │       │   └── 9.1.6/
  │       └── shib-velocity/                                                                                                                                                                                                             
  │           └── 9.1.6/                                                                                                                                                                                                               
  └── org/
      └── opensaml/
          ├── opensaml-core-api/                                                                                                                                                                                                         
          │   └── 5.1.6/
          ├── opensaml-core-impl/                                                                                                                                                                                                        
          │   └── 5.1.6/                                                                                                                                                                                                               
          ├── opensaml-messaging-api/
          │   └── 5.1.6/                                                                                                                                                                                                                 
          ├── opensaml-parent/
          │   └── 5.1.6/                                                                                                                                                                                                                 
          ├── opensaml-profile-api/                                                                                                                                                                                                    
          │   └── 5.1.6/
          ├── opensaml-saml-api/                                                                                                                                                                                                         
          │   └── 5.1.6/
          ├── opensaml-saml-impl/                                                                                                                                                                                                        
          │   └── 5.1.6/                                                                                                                                                                                                               
          ├── opensaml-security-api/
          │   └── 5.1.6/                                                                                                                                                                                                                 
          ├── opensaml-security-impl/
          │   └── 5.1.6/                                                                                                                                                                                                                 
          ├── opensaml-soap-api/                                                                                                                                                                                                       
          │   └── 5.1.6/
          ├── opensaml-soap-impl/                                                                                                                                                                                                        
          │   └── 5.1.6/
          ├── opensaml-storage-api/                                                                                                                                                                                                      
          │   └── 5.1.6/                                                                                                                                                                                                               
          ├── opensaml-xmlsec-api/                                                                                                                                                                                                       
          │   └── 5.1.6/
          └── opensaml-xmlsec-impl/                                                                                                                                                                                                      
              └── 5.1.6/    

<repository>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <id>shibboleth-local</id>
      <name>Shibboleth </name>
      <url>file://${maven.multiModuleProjectDirectory}/libs</url>
</repository>

Hope that helps somehow.

[beth-soptim]

Does anybody already have a workaround for this?

The artifacts are available via JBoss community repo: https://repository.jboss.org/org/opensaml/ + https://repository.jboss.org/net/shibboleth/