SOAP Client: Client TLS credential selection

[Brent Putman]

On 5/14/15 12:13 AM, Daniel Fisher wrote:
>
>
> I was forced to use ThreadLocal for LDAPS connections in JNDI. This is
> due to the fact that JNDI does not provide anyway to configure an
> SSLSocketFactory except by providing a string that is the class name.
> Which is used to load the class and invoke a static method.

Ah, ok, I misremembered the details.

> I would avoid this strategy if at all possible. Besides the code being
> hard to read,

Yeah, that's why it's distasteful.  ThreadLocal always is.  But
sometimes probably a necessary evil.


> all sorts of interesting bugs can arise when connections need to be
> reopened by a different thread.


I actually don't think there's any dangers of that sort with this
specific use case, esp even compared to say the servlet request/response
ThreadLocal proxy stuff we did.  I think it's pretty much guaranteed
that the HttpClient request/response will always be synchronous and
happen in a single thread, period (they have an async httpclient, but
that's a whole 'nother library and programming model). So as long as the
ThreadLocal is cleaned up properly on each call, I'm not terribly
concerned about that aspect of this proposal.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150514/135dfd08/attachment-0001.html>