Shib IdP - Metadata Download and Java 1.7.0_85

[Wolfgang Pempe]

Dear all,

recently, a java update 1.7.0_85 became available - at least for RHEL 
and SL. After having installed this update, some of our users reported 
on problems with the download of federation metadata 
(FileBackedHTTPMetadataProvider), e.g.

2015-07-22 10:05:27.001 - ERROR
[org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] -
[Timer-0:] - Error retrieving metadata from
https://www.aai.dfn.de/fileadmin/metadata/DFN-AAI-Basic-metadata.xml
javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
validation for name: 194.95.248.235

This behaviour seems to go back to a security fix which is described at
http://www.oracle.com/technetwork/java/javase/7u85-relnotes-2587591.html
(end of the page).

Even though the workaround is obvious (-Djdk.tls.trustNameService=true), 
I'm wondering whether this is an intended feature (well, should better 
ask the java developers) which may presumably cause many other web 
applications to 'break' - or do we have to deal with a Shib IdP-specific 
problem?

Thanks,
Wolfgang
-- 
---------------------------------------------------------------------
Wolfgang Pempe                         Phone  : +49 711 63314-208
DFN-Verein, Geschäftsstelle Stuttgart  Fax    : +49 711 63314-133
Lindenspürstr.32                       E-Mail : pempe at dfn.de
D-70176 Stuttgart                      WWW    : http://www.dfn.de
---------------------------------------------------------------------
--------------------- Deutsches Forschungsnetz ----------------------
--------- Germany's National Research and Education Network ---------
---------------------------------------------------------------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4938 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20150722/650646a5/attachment.p7s>