SecurityEnhancedTLSSocketFactory with teardown on used socket context ...

[Brent Putman]

On 5/28/19 9:29 AM, Petra Berg wrote:
>  but after returning the socket to the data connector, the factory
> class call a teardown(context), which affect the socket to release
> all client certificate configurations. The following data resolver
> request fails because of missing client authentication.
>
As Scott said, based on your description your issue was likely fixed in
the most recent IdP patch v3.4.4. 

The full details are in:

https://issues.shibboleth.net/jira/browse/OSJ-265

Please try IdP 3.4.4 and let us know if that version doesn't resolve it
for you.


> If I remove the teardown(context) in finally block of
> org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory.connectSocket()
> it works fine.
> So my question is, why is the teardown(context) function called on a
> context, just installed on a working socket?
>

The whole issue addressed above is due to TLS renegotiation, which
wasn't accounted for in the original code.  This meant that the
(ThreadLocal) client authN credentials needed to be available even
after the call to SecurityEnhancedTLSSocketFactory finishes. Clearing
them directly in the socket factory's teardown(...) was too early, so
we effectively moved that logic to after the HttpClient execute(...)
method completes.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190528/8c9baee4/attachment.html>