Security Advisory 20120227

[Cantor, Scott]

On 2/27/12 10:28 AM, "Mark Cairney" <mark.cairney at ed.ac.uk> wrote:
>
>15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109]
>- unabled to connect to the ldap
>javax.naming.CommunicationException: hostname of the server
>'authorise-test.is.ed.ac.uk' does not match the hostname in the server's
>certificate.

That doesn't match the wildcard you have here:

>Owner: EMAILADDRESS=ext6033 at ed.ac.uk, CN=*.authorise-test.is.ed.ac.uk,
>OU=Information Services, O=University of Edinburgh, L=Edinburgh,
>ST=Scotland, C=GB

That would be a bug to accept it.

>Is this expected behaviour and are you aware of any workarounds? This
>setup was working fine with Shibboleth 2.3.5..

That's because the library in 2.3.5 didn't verify it at all.

I believe Daniel allowed for an override of the hostname verification via
a custom class. I don't know if there's a class built-in that literally
disables the check.

-- Scott