OpenWS library 1.5.6 requires TLS session resume to connect?

[Brent Putman]

On 5/20/16 7:52 PM, Randall,Matt wrote:
> We encountered a fairly esoteric problem in upgrading org.opensaml
> openws-1.5.5 to openws-1.5.6 in that we can no longer make SOAP calls
> (or fetch metadata) against TLS implementations that do not provide
> TLS session resume capabilities.  This appears to be associated with
> this commit [1] where a check for SSLSession.isValid() was
> introduced, which checks if an SSL session can be resumed.  I
> couldn’t infer from the JIRA [2] if the repercussions of this
> particular change were understood.

No, I don't think I understood anything there about TLS session resume.


>  
> For background, isValid() returns false if .invalidate() [3] has been
> invoked on the SSLSession by another object, or if the remote
> connection does not support TLS session resume capabilities.  This
> functionally is generally used when needing to construct new socket
> connections with an existing SSL Session, and allows one to determine
> if a referenced session can be re-used in doing so.


I don't know whether the behavior you describe is a fundamental API
contract, or just a detail of the particular Java impl you're using.  
Just for the record, what is the Java platform and version you are
using here?


>   I don’t believe it makes sense to call it in context of this
> particular code.

Perhaps, perhaps not, it's not clear to me from the docs. 

It could very well be that I misunderstood the API. Ironically it
probably isn't necessary for the session isValid() call anymore
anyway.  IIRC, the reason for that is we were originally and
incorrectly obtaining the hostname against which to perform hostname
validation from the SSLSession.  That returns null when the session
isn't valid, so that was the reasons for the change.  But that was
fixed in a later change for JOWS-47.  So the isValid() call is
*probably* superfluous at this point (unless I'm misremembering or
forgetting something, which is entirely possible...).

But unfortunately it's moot at this point. v2 is EOL at end of July and
there will be no more releases aside from important (through May 31)
and critical (through July 31) security vulnerability bug fixes.  And
this isn't a security bug period, just a functionality bug.

Because of that you should really be looking to migrate to v3 asap.  If
you really have to stay on v2 for now, I guess your only option is to
do a local patch and build.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160522/1273b209/attachment.html>