[JIRA] (OSJ-379) "trustAnchors parameter must be non-empty" failure in httpClient

[Brent Putman (Jira)]

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) *commented* on OSJ-379 ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9 )

Re: "trustAnchors parameter must be non-empty" failure in httpClient ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9 )

Thanks for the stack trace and metadata provider config, that’s very helpful.

The summary is: (Not 100% on this yet, but pretty sure…) At the moment it doesn’t appear that any of “our” (OpenSAML) TLS or PKIX code is involved here. I think this is all standard default HttpClient TLS socket factory, which is in turn based on standard Java components.

If true, then there’s nothing that we can fix per se. I’m going to hunt around and see if this error is reported by others in other software or just in general. I’m betting someone out there has already seen it.

The details: With that DynamicHTTPMetadataProvider config (i.e. with no httpClientRef nor httpClientSecurityParametersRef nor disregardTLSCertificate) , you’re going to get the standard HttpClient TLS socket factory - what we refer to as the “strict” variety internally in OpenSAML.

That is I think confirmed by not seeing any of our OpenSAML components in the stack trace (indeed seeing the sun.security ones).

The error doesn’t match anything that our trust engine or PKIX code would throw. And in our PKIX eval component, we actually check for null/empty trust anchors explicitly and never call the java CertPath compoents in that case:

       final Set<TrustAnchor> trustAnchors = getTrustAnchors(validationInfo);
       if (trustAnchors == null || trustAnchors.isEmpty()) {
           throw new GeneralSecurityException(
                   "Unable to validate X509 certificate, no trust anchors found in the PKIX validation information" );
       }

So unless I’m way off, this is a Java issue, not a Shib/OpenSAML issue.

I’ll do some searching around on that, just to see if I can bottom it out. Paul B. Henson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5b58f937ffd0a32d7917a0df ) , it would help if you could provide the Java runtime (vendor, version, etc) that you are using. Could be a known bug somewhere.

( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:d57183e )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/7c8909d6/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e81a2485-005b-4756-82de-8dab8b431ee1
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/7c8909d6/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-99af4f88-3375-454d-a38f-dc6da9b63480
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/7c8909d6/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e87b443d-b2cd-47bf-9716-36f21f37ecf6
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230518/7c8909d6/attachment-0005.png>