Shib IdP - Metadata Download and Java 1.7.0_85

[Brent Putman]

On 7/23/15 2:20 AM, Brent Putman wrote:
>
>
> On 7/23/15 12:26 AM, Takeshi NISHIMURA wrote:
>> I think you should not rely on sslSession.getPeerHost() returning
>> original hostnames.
>
> Well, hindsight is 20/20.  But I think I modeled that code on
> something "official" at the time, although I don't remember what.  
> And I'd note that that's exactly what they do in their own
> X509TrustMangerImpl [1] for the new endpoint identification stuff
> that I earlier mentioned:

In addition to OpenJDK X509TrustManagerImpl, googling around it seems
that lots of JSSE examples on the internet use
SSLSession#getPeerHost(), rightly or wrongly.

Closer to home, @Daniel:  I noticed that both vt-ldap and ldaptive are
using this as well to get the hostname for verification:

vt-ldap: edu.vt.middleware.ldap.ssl.AbstractTLSSocketFactory

ldaptive: org.ldaptive.ssl.AbstractTLSSocketFactory,
org.ldaptive.ssl.HostnameVerifyingListener

I have not actually tested them, so don't know if they trip this new
behavior or not.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150723/eeb226ab/attachment.html>