SecurityEnhancedTLSSocketFactory with teardown on used socket context ...

[Petra Berg]

Thanks a lot! - IdP 3.4.4 with openSAML lib 3.4.3 fix the problem. All 
is running fine now.

On 28.05.19 17:35, Brent Putman wrote:
>
>
> On 5/28/19 9:29 AM, Petra Berg wrote:
>>  but after returning the socket to the data connector, the factory 
>> class call a teardown(context), which affect the socket to release 
>> all client certificate configurations. The following data resolver 
>> request fails because of missing client authentication.
>>
> As Scott said, based on your description your issue was likely fixed 
> in the most recent IdP patch v3.4.4.
>
> The full details are in:
>
> https://issues.shibboleth.net/jira/browse/OSJ-265
>
> Please try IdP 3.4.4 and let us know if that version doesn't resolve 
> it for you.
>
>
>> If I remove the teardown(context) in finally block of 
>> org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory.connectSocket() 
>> it works fine.
>> So my question is, why is the teardown(context) function called on a 
>> context, just installed on a working socket?
>>
>
> The whole issue addressed above is due to TLS renegotiation, which 
> wasn't accounted for in the original code.  This meant that the 
> (ThreadLocal) client authN credentials needed to be available even 
> after the call to SecurityEnhancedTLSSocketFactory finishes. Clearing 
> them directly in the socket factory's teardown(...) was too early, so 
> we effectively moved that logic to after the HttpClient execute(...) 
> method completes.
>

-- 
___________________________________________________________________

Petra Berg                          Humboldt-Universitaet zu Berlin
Tel.: +49 (0)30-2093 70155          ZE Computer- und Medienservice
Fax:  +49 (0)30-2093 70135          Unter den Linden 6
petra.berg at cms.hu-berlin.de         D-10099 Berlin
___________________________________________________________________


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5411 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20190529/9baa0989/attachment.p7s>