Shib IdP - Metadata Download and Java 1.7.0_85

[Cantor, Scott]

On 7/22/15, 6:39 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:


>
>For the original issue in v2 where someone noticed IP address metadata URLs mysteriously passing validation [1], I'm still not 100% sure why it was.  Only thing I can think of is:  we evaluate the cert against what is returned from SSLSession#getPeerHost(). 
> If *that* is the place (or one of the places) where they were doing the reverse lookup, then that makes sense.  If not, then I still don't know how it was working there.

That seems plausible. What a mess.

>That's correct.  I'm not seeing how this change affects our hostname verification process in either v2 or v3, given that we aren't using AFAIK any JDK code for that, nor does not-yet-commons-ssl nor HttpClient v4 (modulo SSLSession#getPeerHost() in v2. Not
> applicable in v3).  Based on the log, the OP seems to be on v2.

That confirms my understanding. I didn't think we were routing anything through that code.

-- Scott