Shibboleth Identity Provider Security Advisory [4 October 2017]

[Muzinich, Mike]

Does anyone know the logic behind JVM’s not trusting certs signed by a ‘trusted’ CA?


From: users <users-bounces at shibboleth.net> on behalf of "Cantor, Scott" <cantor.2 at osu.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, November 9, 2017 at 2:11 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Shibboleth Identity Provider Security Advisory [4 October 2017]

I'm not sure I understand this. The certificates have a validity period and
eventually expire. Isn't that to be expected and neither good or bad?

Certificates don't need to expire annually, they do because people are hidebound in their thinking. But that's beside the point, as Mike said. If you need/want to trust a CA, then you can trust a CA. Just *trust* it by putting it into the configuration instead of assuming the right things will happen by default.

I feel like I don't really have enough context to
understand this. If there's IdP documentation that will give a better
grasp of this, I'd be happy if you could refer me to it.

We haven't tried to document PKIX for anybody, it's not a Shibboleth thing. What we document is how to configure the trusted certificates, like most server software does, and the affected case is the LDAP DataConnector, so that's the relevant documentation. The simplest way to configure it in any recent version is with a simple "trustFile" attribute in the connector element. Put the CA in a file, point trustFile at it, done. It's that simple. That's what the advisory says, or at least it's what I thought it said.

For instance, based on your reply here, it's not clear to me if maintaining the LDAP
cert locally will be required going forward regardless of IdP updates as
a best practice, or whether 3.3.2 obviates that need in the future. On
what basis do we evaluate how we want or need to establish the validation?

There's nothing that implies you have to trust the server certificate directly, and there is nothing that will tell you what to do either way, that's a choice. If I could get my LDAP admins to use a long-lived self-signed certificate, I would use it directly. But they do not, as yours do not.

-- Scott

--

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171109/022e16d1/attachment-0001.html>