tomcat6-dta-ssl does not work with Tomcat 6.0.43

[Charles R. Tompkins]

There was lots of SSLv3 dePOODLEing going on in tomcat 6.0.43:
https://tomcat.apache.org/tomcat-6.0-doc/changelog.html

Maybe the SOAP query is somehow negotiating SSLv3?

You could try to specify your Connector "sslProtocols" directive with the TLS versions you feel comfortable with?

-Charles


-----Original Message-----
From: Cantor, Scott [cantor.2 at osu.edu]
Received: Saturday, 04 Apr 2015, 3:05PM
To: Shib Users [users at shibboleth.net]
Subject: Re: tomcat6-dta-ssl does not work with Tomcat 6.0.43


On 4/4/15, 2:11 AM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:

>Shibboleth IdPv2's tomcat6-dta-ssl does not seem to work with Tomcat 6.0.43.
>In our environment, SAML Attribute Query always fails and the SP logs this error message.
>
>2015-03-10 15:47:42 ERROR Shibboleth.AttributeResolver.Query [3]: exception during SAML query to https://...:8443/idp/profile/SAML1/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint (https://...:8443/idp/profile/SAML1/SOAP/AttributeQuery): error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown
>2015-03-10 15:47:42 ERROR Shibboleth.AttributeResolver.Query [3]: unable to obtain a SAML response from attribute authority
>
>I think the signature change of getServerSocketFactory() would affect this issue.

That seems like an odd result unless there's something clearly pointing to this in the Tomcat log, but you can certainly file a bug (V2 IdP project is fine, we don't have separate ones for the plugins).

This is yet another example of why Tomcat should no longer be considered a good choice. Breaking an API in a patch release? Classic.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net