OpenWS library 1.5.6 requires TLS session resume to connect?

[Randall,Matt]

We encountered a fairly esoteric problem in upgrading org.opensaml openws-1.5.5 to openws-1.5.6 in that we can no longer make SOAP calls (or fetch metadata) against TLS implementations that do not provide TLS session resume capabilities.  This appears to be associated with this commit [1] where a check for SSLSession.isValid() was introduced, which checks if an SSL session can be resumed.  I couldn't infer from the JIRA [2] if the repercussions of this particular change were understood.

For background, isValid() returns false if .invalidate() [3] has been invoked on the SSLSession by another object, or if the remote connection does not support TLS session resume capabilities.  This functionally is generally used when needing to construct new socket connections with an existing SSL Session, and allows one to determine if a referenced session can be re-used in doing so.  I don't believe it makes sense to call it in context of this particular code.

[1]: http://svn.shibboleth.net/view/java-openws/tags/1.5.6/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java?revision=479&view=markup
[2]: https://issues.shibboleth.net/jira/browse/JOWS-44
[3]: http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLSession.html#invalidate%28%29

Thank you,

Matt Randall - Cerner Corporation



CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160520/076b1e1e/attachment.html>