<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"> <base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429;">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="border-collapse: collapse; padding: 10px 20px;">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px;" width="32"><img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/2f98d29d4ac57bc97153bbbc19937838?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FBP-2.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top;"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px;"><a class="user-hover" rel="557058:97de0981-adc3-4044-95ed-131622fad81e" style="color: #3b73af; text-decoration: none;" id="email_557058:97de0981-adc3-4044-95ed-131622fad81e" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e"> Brent Putman </a> <strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none;"><img src="cid:jira-generated-image-avatar-99af4f88-3375-454d-a38f-dc6da9b63480" height="16" width="16" border="0" align="absmiddle" alt="Bug"> OSJ-379</a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="border-collapse: collapse; padding: 0 20px;">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate;">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="border-collapse: collapse; color: #ffffff; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly;" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff;" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td style="vertical-align: top; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly;" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle;"> <a href="https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none;">Re: "trustAnchors parameter must be non-empty" failure in httpClient</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0;" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px;">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="border-collapse: collapse; padding: 0 0 10px;"><p style="margin: 10px 0 0; margin-top: 0;">Thanks for the stack trace and metadata provider config, that’s very helpful.</p> <p style="margin: 10px 0 0;">The summary is: (Not 100% on this yet, but pretty sure…) At the moment it doesn’t appear that any of “our” (OpenSAML) TLS or PKIX code is involved here. I think this is all standard default <tt>HttpClient</tt> TLS socket factory, which is in turn based on standard Java components.</p> <p style="margin: 10px 0 0;">If true, then there’s nothing that we can fix per se. I’m going to hunt around and see if this error is reported by others in other software or just in general. I’m betting someone out there has already seen it.</p> <p style="margin: 10px 0 0;">The details: With that <tt>DynamicHTTPMetadataProvider</tt> config (i.e. with no <tt>httpClientRef</tt> nor <tt>httpClientSecurityParametersRef</tt> nor <tt>disregardTLSCertificate)</tt>, you’re going to get the standard <tt>HttpClient</tt> TLS socket factory - what we refer to as the “strict” variety internally in OpenSAML.</p> <p style="margin: 10px 0 0;">That is I think confirmed by not seeing any of our OpenSAML components in the stack trace (indeed seeing the <tt>sun.security</tt> ones).</p> <p style="margin: 10px 0 0;">The error doesn’t match anything that our trust engine or PKIX code would throw. And in our PKIX eval component, we actually check for null/empty trust anchors explicitly and never call the java CertPath compoents in that case:</p>
<div class="code panel" style="border-width: 1px; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0;">
<div class="codeContent panelContent" style="padding: 9px 12px;">
<pre class="code-java" style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal;"> <span class="code-keyword" style="color: #000091;">final</span> Set<TrustAnchor> trustAnchors = getTrustAnchors(validationInfo);
<span class="code-keyword" style="color: #000091;">if</span> (trustAnchors == <span class="code-keyword" style="color: #000091;">null</span> || trustAnchors.isEmpty()) {
<span class="code-keyword" style="color: #000091;">throw</span> <span class="code-keyword" style="color: #000091;">new</span> GeneralSecurityException(
<span class="code-quote" style="color: #009100;">"Unable to validate X509 certificate, no trust anchors found in the PKIX validation information"</span>);
}</pre>
</div>
</div> <p style="margin: 10px 0 0;">So unless I’m way off, this is a Java issue, not a Shib/OpenSAML issue.</p> <p style="margin: 10px 0 0;">I’ll do some searching around on that, just to see if I can bottom it out. <a href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5b58f937ffd0a32d7917a0df" class="user-hover" rel="5b58f937ffd0a32d7917a0df" data-account-id="5b58f937ffd0a32d7917a0df" accountid="5b58f937ffd0a32d7917a0df" style="color: #3b73af; text-decoration: none;">Paul B. Henson</a>, it would help if you could provide the Java runtime (vendor, version, etc) that you are using. Could be a known bug somewhere.</p></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff;" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/OSJ-379?inbox=true&focusedCommentId=34888&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-34888",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px;">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0;">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle;"><a href="https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none;"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-e81a2485-005b-4756-82de-8dab8b431ee1" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle;"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px;"><a href="https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiZDc1YzZjNGQyNTc2NDdjYjgzZTJlYmRkNDJhOTJjMTAiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none;">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly;" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="border-collapse: collapse; padding: 12px 20px;">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px;">Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none;">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none;">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px;">This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100225-<span title="d57183e3fed6fdf57150cdd23beff8a631bedd93" data-commit-id="d57183e3fed6fdf57150cdd23beff8a631bedd93}">sha1:d57183e</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top;">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150;"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-e87b443d-b2cd-47bf-9716-36f21f37ecf6" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>