[JIRA] Commented: (SSPCPP-441) Libcurl versions before 7.20 do not refresh caches of IdP IP address look-ups - this breaks SAML1 attribute query if the IdP's IP address is changed

[Sara Hopkins (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-441?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14176#comment-14176 ] 

Sara Hopkins commented on SSPCPP-441:
-------------------------------------

I've finally been able to test this, and as far as I can tell, it worked. This is what I did:

1) Located a V2.4.3 SP known to be affected by this issue, with a version of libcurl lower than 7.20

2) Ensured that this was configured in shibboleth2.xml:

<TransportOption provider="CURL" option="92">120</TransportOption>

3) Used my test IdP to authenticate with the SP using SAML1 protocol

4) Changed the IP address of my test IdP and arranged for a corresponding change in the DNS A record for the IdP hostname

5) Used the test IdP to authenticate with the SP using SAML1 again, checked the SP log and confirmed that attributes were released to the SP.

6) Verified by looking at the SP logs that the SP had not been restarted in the intervening time between my two tests (because restarting the SP clears the cache used by libcurl)


> Libcurl versions before 7.20 do not refresh caches of IdP IP address look-ups - this breaks SAML1 attribute query if the IdP's IP address is changed
> ----------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: SSPCPP-441
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-441
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>         Environment: CentOS 5, RedHat 5, any other distribution that ships a version of libcurl before 7.20
> CentOS 6 and RedHat 6 are not affected, please see Description for reason why.
>            Reporter: Sara Hopkins
>            Assignee: Scott Cantor
>             Fix For: 2.5
>
>
> Please see this shibboleth-users discussion, in particular the last six emails:
> http://groups.google.com/group/shibboleth-users/browse_thread/thread/03b347520659428c/1b866419a1198144?pli=1
> There is a bug in libcurl versions lower than 7.20 which means that once an IdP's IP address has been looked up for attribute query purposes, it is cached and no further DNS lookups are made for that hostname until the SP is restarted. The bug was fixed in libcurl 7.20 - http://daniel.haxx.se/blog/2010/02/09/a-big-curl-forward/ - and http://curl.haxx.se/changes.html
> So, if an IdP IP address is changed, and it runs up against this bug, the SP operator has to restart shibd to get things working again for that IdP/SP pair..
> I know that this is not an SP bug, but the problem is that the CentOS5/RedHat5 libcurl is only 7.15.5! This is something of a problem for operators of SPs on those platforms. But I know that the CentOS and RH6 platforms are not affected, even though they also ship a version of libcurl lower than 7.20, because of this:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxRH6
> Might I suggest that this solution is built for CentOS/RH5 as well, in order to work around this libcurl bug?

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira