Security Advisory 20120227

[Mark Cairney]

OK I've amended my config to point at one of the individual servers which does match the *.authorise-test.is.ed.ac.uk pattern and that seems to be working.

authorise-test.is.ed.ac.uk is a round-robin DNS between 2 servers. We do have another identical round-robin DNS which does match the pattern- using this instead would be the simplest solution.

Thanks,

Mark

On 27 Feb 2012, at 15:38, Cantor, Scott wrote:

> On 2/27/12 10:28 AM, "Mark Cairney" <mark.cairney at ed.ac.uk> wrote:
>> 
>> 15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109]
>> - unabled to connect to the ldap
>> javax.naming.CommunicationException: hostname of the server
>> 'authorise-test.is.ed.ac.uk' does not match the hostname in the server's
>> certificate.
> 
> That doesn't match the wildcard you have here:
> 
>> Owner: EMAILADDRESS=ext6033 at ed.ac.uk, CN=*.authorise-test.is.ed.ac.uk,
>> OU=Information Services, O=University of Edinburgh, L=Edinburgh,
>> ST=Scotland, C=GB
> 
> That would be a bug to accept it.
> 
>> Is this expected behaviour and are you aware of any workarounds? This
>> setup was working fine with Shibboleth 2.3.5..
> 
> That's because the library in 2.3.5 didn't verify it at all.
> 
> I believe Daniel allowed for an override of the hostname verification via
> a custom class. I don't know if there's a class built-in that literally
> disables the check.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

/********************************* 
Mark Cairney
ITI UNIX Section
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: mark.cairney at ed.ac.uk

*********************************/


-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.