SocketFactory property duplication

[Cantor, Scott]

On 5/26/17, 7:23 PM, "dev on behalf of Brent Putman" <dev-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:

> On the TBD HTTP Authentication section:  We probably need some pretty simple factory beans in spring-extensions to facilitate
> building an HC CredentialsProvider and its constituent components (AuthScope, Credentials).  Once we have those, I think
> documenting that for the advanced cases is pretty easy.

It wasn't exactly TBD for any specific reason other than I hadn't done it yet but I have a working case. It is a problem to get credentials applied with a scope though, it requires a two-parameter setter on the current builder factory bean, which means a method-invoking factory bean, etc. So probably needs some work.

> I see what you mean.  It was honestly intended as a feature that the caller can supply a TrustEngine or not, and if not then it
> skips the trust eval.  However, since that seems legitimately dangerous wrt accidental misconfiguration, etc, in the IdP, I think
> it's pretty easy to add a trustEngineRequired boolean to the SecurityEnhancedTLSSocketFactory, and have it throw if true and
> no engine is supplied.  We could even default it to true, either in the factory itself or in the support class factory constructing
> code.  (And if you turn that off, then you must know what you are doing.)  So maybe that would be a way to default it to a secure
> config out-of-the-box and avoid the caveats and warnings around this, and the fail-then-fix instructions.  Should we consider
> for 3.4?

Yes, that's probably a good step, I'll add an issue.

-- Scott