Shib IdP - Metadata Download and Java 1.7.0_85

[Brent Putman]

On 7/23/15 1:57 PM, Cantor, Scott wrote:
> As far as people patching, there's the ability to set the flag in
> Java to turn off the bug, whether they intended that to happen or not.

Maybe.  Hopefully that works for most people.  On further reflection,
however: if the hostname -> IP addr conversion is really unintentional
and buried somewhere, then it may be that setting the flag doesn't just
give you the original hostname.  It might be doing a 2nd (reverse)
resolution of the IP addr -> hostname.  If that is the case, and there
are multiple PTR records for the IP, there's no guarantee that the
(single) hostname it picks for getPeerHost() will be the original one. 
The double resolution would be lossy, basically.

I thought of that because we actually have several web servers with
that exact situation, due to name-based virtual hosting.  And not all
of the domains have an https listener, so the shared multi-domain cert
doesn't have all of them as subject alt names.  This would break there.
(Before someone asks: no SNI here b/c the Apache/mod_ssl is too old).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150723/5b43d9e3/attachment.html>