Jetty Keystore Trouble with jetty-base provided in Shibboleth 3

[Cantor, Scott]

On 7/22/15, 1:33 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:



>On 7/22/15, 1:16 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:
>
>>To be clear, I had tried using the included jetty-base in Shibboleth initially, but then had transitioned to using what was on the wiki instead, where I still had the issue. The only solution I had found was using 9.2 instead.
>
>The differences are not minor the more I dig into the SSL files and the old example is not usable without a lot of assumptions and care.

In fact, they have a regression. The underlying issue is this wholesale refactoring of properties and SSL config, but it goes beyond that, they actually broke it.

If you override the keystore type to PKCS12, it doesn't load correctly because they do this dumb thing where they also load the keystore in as a trust store and in 9.3 they botched this and it tries to load the keystore file but with the TrustStoreType set to JKS. I compared the sources in 9.2 vs. 9.3 and found the bug.

I worked around it in the example by setting the TrustStoreType property explicitly to the same as the KeyStoreType, and now it's loading for me, but this is a bad bug on their part. I'll report it to them.

I guess it's us. Now that we committed to Jetty, they hired Tomcat's QA team.

-- Scott