[JIRA] (OSJ-379) "trustAnchors parameter must be non-empty" failure in httpClient

[Paul B. Henson (Jira)]

Paul B. Henson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5b58f937ffd0a32d7917a0df ) *commented* on OSJ-379 ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDJkMDJmNWZhY2U4NDJhNGEzOWVmZWY1NjhkMmVhNDgiLCJwIjoiaiJ9 )

Re: "trustAnchors parameter must be non-empty" failure in httpClient ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDJkMDJmNWZhY2U4NDJhNGEzOWVmZWY1NjhkMmVhNDgiLCJwIjoiaiJ9 )

It’s a pretty basic config, the only specific piece TLS related is the https URL (as documented by InCommon). It’s using the default httpClient, which I believe validates the https cert based on the java CA store? It appears the InCommon mdq server also responds over http, so I guess I could use that instead (as the metadata is validated by the signature), but it would be nice to sort out why this happens, plus there’s no reason random network sniffers should know what services we use.

{{   <MetadataProvider id="incommon-mdq" xsi:type="DynamicHTTPMetadataProvider" }}
{{                     maxCacheDuration="PT24H" maxIdleEntityData="PT12H" }}
{{                     minCacheDuration="PT15M" cleanupTaskInterval="PT1H" }}
{{                     persistentCacheManagerDirectory="%

{idp.home}/metadata/cache/incommon-mdq">}}
{{       <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true" }}
{{                       certificateFile="%{idp.home}

/credentials/inc-md-cert-mdq.pem" /> }}

{{       <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" /> }}

<MetadataFilter xsi:type="SchemaValidation" />
{{<MetadataQueryProtocol> https://mdq.incommon.org/ </MetadataQueryProtocol> }}

</MetadataProvider>

( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDJkMDJmNWZhY2U4NDJhNGEzOWVmZWY1NjhkMmVhNDgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDJkMDJmNWZhY2U4NDJhNGEzOWVmZWY1NjhkMmVhNDgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:11e4e77 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/9959f1d1/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-wink-dbd1c64e-95b9-4106-bd06-6f85804733aa
Type: image/png
Size: 737 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/9959f1d1/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e20bd46f-0760-48b5-8848-629d7d6f73fe
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/9959f1d1/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-66d4a88a-c0d2-4846-9e51-3832c86237eb
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/9959f1d1/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-79f9f4aa-f56b-409c-9f7f-bdc758ccca61
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/9959f1d1/attachment-0007.png>