Jetty Keystore Trouble with jetty-base provided in Shibboleth 3

[Cantor, Scott]

On 7/22/15, 12:11 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:


>
>If I change the Jetty9 page, I can either document the new property names when it mentions modifying ssl.mod, and break Jetty 9.2, or I can do what I think the right answer is, stop documenting use of properties and just show example XML that confgures things correctly.

Actually, our page is basically correct. The problem, I guess, is that people aren't following it. We include an explicit jetty-ssl.xml file example in the page that has to be used and that supports the properties we describe being set in ssl.mod.

There's actually a bug in 9.3, sort of. They have a feature that lets them change a property name while deprecating the original:

<Configure id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
  <Set name="KeyStorePath">
    <Property name="jetty.base" default="." />/<Property name="jetty.sslContext.keyStorePath"
      deprecated="jetty.keystore" default="etc/keystore"/>
  </Set>
  <Set name="KeyStorePassword">
    <Property name="jetty.sslContext.keyStorePassword" deprecated="jetty.keystore.password"/>
  </Set>
  <Set name="KeyStoreType"><Property name="jetty.sslContext.keyStoreType" default="JKS"/></Set>

As you can see, they deprecated path and password, but ignored type. Thus, it breaks. They really shouldn't do that, it's sloppy, and I think I'll file a bug.


But our jetty-ssl.xml example doesn't have any of this new material in it. So I don't think it should have failed to work unless people didn't follow it.

And of course, the title of this specific thread I'm following is itself the point: you CANNOT use our jetty-base, period. That's not what it's for, and it's now hidden inside the directory tree.

We document how to set up Jetty in the wiki and that's the only example we provide to follow. jetty-base is for the Windows installer, period. If that changes, we'll be clear about it in the documentation.

So that's what broke here, but it didn't break because it was never intended to work to begin with.

-- Scott