Backchannel failing after upgrade

[James Drews]

Well, I'll go dig what version the SP is, but it's odd that on the same host using the same openssl program (Version: OpenSSL 1.0.1t  3 May 2016) when using one cert/key pair it fails, but another cert/key pair works. So I wouldn't think it is a library issue on the SP end.

I'm also having our SP guy look into the question of why is it even using the backchannel (attribute fetch?)....

I'll also mention, that if I use the non-working cert and connect to port 443 (same jetty engine), that works. So there is something else in the backchannel rejecting it.  

Thanks
James

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, January 12, 2017 10:24 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: Backchannel failing after upgrade

> I didn't see anything "extra" to do in the release notes that had to 
> be done after the upgrade install. I've also looked at the document 
> describing the jetty 9.3 config, and I'm not seeing anything out of place there either.

I doubt it has anything to do with the IdP per se, it's probably the fact that the TLS configuration was modernized.

You didn't indicate what the SP version is or the OpenSSL version, but a suitably old one doesn't connect to modern servers at the command line without other options due to SSLv3 being off and older ciphers disabled. The SP generally uses the right settings and should work regardless, but without any error to even respond to I have no further speculation. If it's really old and broken, then anything is possible.

Most shouldn't need the back channel at all, so an obvious question is what you're using it for.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net