Remote attribute-filter.xml not updating after upgrading

[Christopher Greiner]

Turning up logging gives me a "SSL peer failed hostname validation for
name" error:

2015-09-01 17:04:55,202 - TRACE
[org.opensaml.util.resource.ResourceChangeWatcher:159] -  - Checking
resource for changes:
https://rr.aai.switch.ch/switchaai/unil.ch/attribute-filter.xml
2015-09-01 17:04:55,205 - DEBUG
[org.apache.commons.httpclient.HttpConnection:692] -  - Open connection
to rr.aai.switch.ch:443
2015-09-01 17:04:55,219 - DEBUG
[org.apache.commons.httpclient.HttpMethodDirector:404] -  - Closing the
connection.
2015-09-01 17:04:55,219 - INFO
[org.apache.commons.httpclient.HttpMethodDirector:439] -  - I/O
exception (javax.net.ssl.SSLPeerUnverifiedException) caught when
processing request: SSL peer failed hostname validation for name:
130.59.138.32
2015-09-01 17:04:55,220 - DEBUG
[org.apache.commons.httpclient.HttpMethodDirector:443] -  - SSL peer
failed hostname validation for name: 130.59.138.32
javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
validation for name: 130.59.138.32
	at
org.opensaml.ws.soap.client.http.TLSProtocolSocketFactory.verifyHostname(TLSProtocolSocketFactory.java:233)
~[openws-1.5.5.jar:na]
	at
org.opensaml.ws.soap.client.http.TLSProtocolSocketFactory.createSocket(TLSProtocolSocketFactory.java:194)
~[openws-1.5.5.jar:na]
	at
org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
~[commons-httpclient-3.1.jar:na]
	at
org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
[commons-httpclient-3.1.jar:na]
	at
org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
[commons-httpclient-3.1.jar:na]
	at
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
[commons-httpclient-3.1.jar:na]
	at
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
[commons-httpclient-3.1.jar:na]
	at
org.opensaml.util.resource.HttpResource.exists(HttpResource.java:102)
[openws-1.5.5.jar:na]
	at
org.opensaml.util.resource.FileBackedHttpResource.exists(FileBackedHttpResource.java:127)
[openws-1.5.5.jar:na]
	at
org.opensaml.util.resource.ResourceChangeWatcher.run(ResourceChangeWatcher.java:160)
[openws-1.5.5.jar:na]
	at java.util.TimerThread.mainLoop(Timer.java:555) [na:1.7.0_85]
	at java.util.TimerThread.run(Timer.java:505) [na:1.7.0_85]


I notice that the openws-1.5.5.jar has been updated between IdP v2.4.3
and v2.4.4 and seems to be the cause of this particular issue.

Any pointers as to what I can do to so the connexion doesn't fail?

Cheers

 Chris



> Message: 5
> Date: Tue, 1 Sep 2015 15:05:39 +0100
> From: "Rod Widdowson" <rdw at steadingsoftware.com>
> To: "'Shib Users'" <users at shibboleth.net>
> Subject: RE: Remote attribute-filter.xml not updating after upgrading
> 	to IdP v2.4.4
> Message-ID: <01f601d0e4bf$4a067cd0$de137670$@steadingsoftware.com>
> Content-Type: text/plain;	charset="Windows-1252"
> 
> There is something very odd in the apache http client (or our use of it -
> but we see errors in three completely different usage patterns).  We have
> had several  attempts to bottom this out and still haven?t got anywhere
> 
> As I recall (but I may be wrong) there was an upgrade to that package needed
> for 2.4.4.
> 
> I'd suggest that you turn up logging on "org.apache.http" and see if that
> provides more info.
> 
> Anecdotally, adding memory to the VM can sometime help as well.
> 
> Rod