OpenWS library 1.5.6 requires TLS session resume to connect?

[Brent Putman]

On 5/23/16 10:34 AM, Randall,Matt wrote:
>
>
> >> I don't know whether the behavior you describe is a fundamental API
> contract, or just a detail of the particular Java impl you're
> using.   Just for the record, what is the Java platform and version
> you are using here?
>
> It’s the fundamental API contract.  Using Sun and IBM JDKs for Java
> 8; also verified the OpenJDK implementation is in-line with my
> understanding of this function call [1].
>

You may be correct.  The Javadocs are are a little unclear though, at
least to me.  2, and perhaps all 3, of those JDKs are essentially based
off the same codebase, fwiw.  I think IBM licensed Sun/Oracle's, at
least at one point, not sure about currently.


>  
>
> >> v2 is EOL at end of July and there will be no more releases aside
> from important (through May 31) and critical (through July 31)
> security vulnerability bug fixes.
>
>  
>
> I hadn’t inspected v3’s code base to know whether this issue would
> carry-forward or not.
>

No, it doesn't carry forward to v3. OpenSAML/Shibboleth v3 use
HttpClient v4, which has a completely different set of components for
TLS, with a different API.  We do use a custom TLS socket factory there
as well, but the impl is very different and there is no call to
SSLSession#isValid() anywhere.

The v2 code used with HC v3 was based on their original socket factory
impl, It was only changed because of the previously issues around
hostname validation.  IIRC, the HC v3 SSL/TLS stuff didn't even do
hostname validation, so we had to introduce our own code and deal with
all that low-level mess.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160523/1fbb687e/attachment-0001.html>