tomcat native/APR connector for SOAP requests / resolvertest

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2012-02-27 20:23]:
> > I've set up a new IdP for someone and noticed that the Tomcat Native
> > http://tomcat.apache.org/tomcat-6.0-doc/apr.html accepts an
> > SSLVerifyClient parameter with "optionalNoCA" as an argument.
> > Can anyone comment on whether this may or may not be usable instead
> > of the DelegateToApplication extension (or fronting Tomcat with
> > httpd)?
> 
> I don't know if it's implemented differently from the mod_ssl
> option, but I would guess it would be, so as far as what its quirks
> might be, I don't know.

It should actually share quite a bit of code but not everything is
exposed as tunables to the tomcat connector, AFAIU. I'll look at that
a bit later.

> > I just thought I'd ask if preventing libcurl from performing any such
> > checks on trust fabric certs in resolvertest might be a. possible and
> > b. generally desirable.
> 
> It's not possible, no. Whether it's desirable is a matter of
> opinion, but the trust engines we supply that bypass PKIX don't
> disable the name check, because we felt that it would lead to people
> deploying certs that would likely fail with essentially any other
> implementation. It's one thing to get around the cert chain check,
> but turning off the hostname check is usually going to be
> impossible.

Understood, thanks for the explanation.

> If you toggle various options to not require transport
> authentication on the SOAP calls, you can get it to ignore actual
> trust engine failure (if you want to do signing for example), but
> the name check is baked in ahead of time with a libcurl option
> that's other on or off, so I can't set it and then decide whether
> it's fatal. I'd essentially have to disable it, and then
> conditionally do the check myself. Could be done, but wasn't because
> of the above reasoning.

Thanks, I understand and (mostly) agree. It's not that changing the
primary/canonical DNS domain is daily business and keys will need to
be rolled over one way or another, once in a while.

In this case I might either renew the certs (to match the hostname in
DNS) or change the ACS URLs for SOAP requests to the former hostname
(to match the hostname in the cert), as this won't really be seen by
the subject's user agent. Then metadata changes will only affect SPs
doing queries (next to none, in this particular case).
-peter