tomcat native/APR connector for SOAP requests / resolvertest

[Cantor, Scott]

> I've set up a new IdP for someone and noticed that the Tomcat Native
> http://tomcat.apache.org/tomcat-6.0-doc/apr.html accepts an
> SSLVerifyClient parameter with "optionalNoCA" as an argument.
> Can anyone comment on whether this may or may not be usable instead
> of the DelegateToApplication extension (or fronting Tomcat with
> httpd)?

I don't know if it's implemented differently from the mod_ssl option, but I would guess it would be, so as far as what its quirks might be, I don't know.

> I just thought I'd ask if preventing libcurl from performing any such
> checks on trust fabric certs in resolvertest might be a. possible and
> b. generally desirable.

It's not possible, no. Whether it's desirable is a matter of opinion, but the trust engines we supply that bypass PKIX don't disable the name check, because we felt that it would lead to people deploying certs that would likely fail with essentially any other implementation. It's one thing to get around the cert chain check, but turning off the hostname check is usually going to be impossible.

If you toggle various options to not require transport authentication on the SOAP calls, you can get it to ignore actual trust engine failure (if you want to do signing for example), but the name check is baked in ahead of time with a libcurl option that's other on or off, so I can't set it and then decide whether it's fatal. I'd essentially have to disable it, and then conditionally do the check myself. Could be done, but wasn't because of the above reasoning.

-- Scott