SOAP Client: Client TLS credential selection

[Daniel Fisher]

On Wed, May 13, 2015 at 6:00 PM, Brent Putman <putmanb at georgetown.edu>
wrote:

> Ideally what we would want is for the client TLS cred to be selected in
> our "usual" way: via -Configuration(s) + -Resolver, producing a -Parameters
> stored in the operation context.  The issue is getting that info into the
> JSSE layer.  The only way I can see to do that is via a ThreadLocal
> approach.  I'm loathe to do it, b/c I really don't like circumventing
> defined interfaces like that.  But it's the only way I can see at the
> moment to make it work.  IIRC Daniel is doing something similar in ldaptive
> for (?) trust eval and X509TrustManager?
>
>
I was forced to use ThreadLocal for LDAPS connections in JNDI. This is due
to the fact that JNDI does not provide anyway to configure an
SSLSocketFactory except by providing a string that is the class name. Which
is used to load the class and invoke a static method. I would avoid this
strategy if at all possible. Besides the code being hard to read, all sorts
of interesting bugs can arise when connections need to be reopened by a
different thread.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150514/eea6268b/attachment.html>