Notes on jdk.certpath.disabledAlgorithms

[Brent Putman]

On 1/23/17 8:16 PM, Cantor, Scott wrote:
> That's bizarrely complicated the way they piecemeal all of it. Don't see why they don't just lay out a file of properties and chain it to the system properties, same as Spring.

My hazy recollection is that it's all about limiting who/what can access
and change things when you are running under a security manager, since
the java.security props configure and influence the security manager
behavior itself (like policy, etc).  So they maintain a segregation
between system props and the security props so that they aren't all in
the same bucket, and the perms are distinct. You may want to give a
program the ability to read and/or modify system props, but that
shouldn't inherently include influencing the very behavior of the
security manager itself.

If/when you're not running under a security manager, there may or may
not be any practical benefit to the segregation, so the reason for it is
less obvious I guess.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170123/241f58b4/attachment.html>