Shibboleth SP 2.4.3 and ExplictKey TrustEngine - SOAP 8443 vs other

[Cantor, Scott]

On 12/1/11 1:24 PM, "Marc Thornton" <joey.granville at gmail.com> wrote:

>Thanks for talking me through this, Scott.  It was, unfortunately
>(fortunately?) a mis-configuration in the Apache server.  A typo in
>another VirtualHost that I'd recently added meant a different/wrong
>certificate was being presented.  Your suggestion to double-check which
>cert is returned using a standard browser is what led me to the culprit.

I figured it had to be.

>I agree that a bit more debug information related to the cert in the
>XMLTooling handling of the X509 callback might be a nice addition, but
>obviously, proper management of configuration is what can make or break
>functionality pretty easily.

I would have logged it myself if I had known libcurl didn't, I just
thought it was redundant. If you file a bug on that, I'll remember to
address it.

>Thanks for the information on how the configuration is handled. Most of
>our "risk" is in the ApplicationDefaults and ApplicationOverride as these
>are the most often configured items by our internal clients (and hence,
>all possible configuration not as easily tested by us).  We will
>definitely keep in mind how other libraries impact the interpretation of
>configuration files if we need to make a reasonably quick release
>available again for issues or vulnerabilties.

I can't promise zero regressions obviously, but there are absolutely no
options or uses of features supported by 2.0 that aren't supported by
2.4.3, no exceptions. I am not aware of any actual regressions in
configuration handling either, only bugs in support of new options or bugs
that existed all along and just didn't get caught earlier (e.g. the recent
ECP thing).

-- Scott