Shib IdP - Metadata Download and Java 1.7.0_85

[Nate Klingenstein]

> I don't understand what that has to do with this bug. Resolving the name to do a check is itself the bug.

Resolving the name turns into bunches of IP addresses and these change.  Here are the results of some digs on www.google.com.

www.google.com.		125	IN	A	74.125.227.179
www.google.com.		125	IN	A	74.125.227.180
www.google.com.		125	IN	A	74.125.227.176
www.google.com.		125	IN	A	74.125.227.178
www.google.com.		125	IN	A	74.125.227.177
www.google.com.		83	IN	A	173.194.115.84
www.google.com.		83	IN	A	173.194.115.83
www.google.com.		83	IN	A	173.194.115.81
www.google.com.		83	IN	A	173.194.115.82
www.google.com.		83	IN	A	173.194.115.80
www.google.com.		300	IN	A	173.194.204.105
www.google.com.		300	IN	A	173.194.204.147
www.google.com.		300	IN	A	173.194.204.104
www.google.com.		300	IN	A	173.194.204.103
www.google.com.		300	IN	A	173.194.204.106
www.google.com.		300	IN	A	173.194.204.99

My understanding is that I would need to try to get all those IP addresses into subjectAltNames, or get everyone to patch in time.  If I’m misinterpreting this, please let me know and I’ll stop worrying.

> And there's a trivial flag you can set on the JVM to work around it too. As problems go, I can think of many worse ones.

I’m worried about deployments that update software without reading all the release notes.  I know that’s something you’d trash, but there is an awful lot of them.  I would not have expected this change and would agree with Brent’s “flabbergasted” unless I really misread it.