<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 5/28/19 9:29 AM, Petra Berg wrote:<br>
</div>
<blockquote type="cite"
cite="mid:f95bd07d-fffb-ab43-e5f0-67216ea74951@cms.hu-berlin.de"> but
after returning the socket to the data connector, the factory
class call a teardown(context), which affect the socket to release
all client certificate configurations. The following data resolver
request fails because of missing client authentication.
<br>
<br>
</blockquote>
<p>As Scott said, based on your description your issue was likely
fixed in the most recent IdP patch v3.4.4. <br>
</p>
<p>The full details are in:</p>
<p><a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/OSJ-265">https://issues.shibboleth.net/jira/browse/OSJ-265</a><br>
</p>
<p>Please try IdP 3.4.4 and let us know if that version doesn't
resolve it for you.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:f95bd07d-fffb-ab43-e5f0-67216ea74951@cms.hu-berlin.de">If
I remove the teardown(context) in finally block of
org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory.connectSocket()
it works fine.
<br>
So my question is, why is the teardown(context) function called on
a context, just installed on a working socket?
<br>
<br>
</blockquote>
<p><br>
</p>
<p>The whole issue addressed above is due to TLS renegotiation,
which wasn't accounted for in the original code. This meant that
the (ThreadLocal) client authN credentials needed to be available
even after the call to SecurityEnhancedTLSSocketFactory finishes.
Clearing them directly in the socket factory's teardown(...) was
too early, so we effectively moved that logic to after the
HttpClient execute(...) method completes.<br>
</p>
</body>
</html>