[JIRA] (OSJ-379) "trustAnchors parameter must be non-empty" failure in httpClient

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on OSJ-379 ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDJjOTM5ZWVmNTI3NDBiNWI3MzQxMmNkODMwZmQ5NjciLCJwIjoiaiJ9 )

Re: "trustAnchors parameter must be non-empty" failure in httpClient ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDJjOTM5ZWVmNTI3NDBiNWI3MzQxMmNkODMwZmQ5NjciLCJwIjoiaiJ9 )

The whole client stack is built internally to the Spring parser for the resolvers unless any of the special attributes are used to inject outside objects. There shouldn’t be any cross-contamination with anything else until Java’s runtime is involved, and those aren’t things we can fix obviously.

The disregardTLSCertificate option will cause it to build a no-trust socket factory and I would be pretty puzzled if that ever broke like this. So concretely, that’s going to be the fix for a while. Default trust is not substantially better than none since CAs have all been compromised by the government if nobody else, so I wouldn’t sweat it much personally. If I had the problem, I would definitely flip it myself, I just haven’t seen it.

With the change to HttpClient 5 I suspect it won’t be worth spending a lot of time until we see the problem there.

( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDJjOTM5ZWVmNTI3NDBiNWI3MzQxMmNkODMwZmQ5NjciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDJjOTM5ZWVmNTI3NDBiNWI3MzQxMmNkODMwZmQ5NjciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:11e4e77 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/8826784f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-71c20706-7fcf-4c71-a801-8e35c498f710
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/8826784f/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-cc92f42d-c9a9-4ba2-8b05-37c0e391216b
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/8826784f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-75caa7cf-257b-4e17-b582-220210a450c6
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/8826784f/attachment-0005.png>