Ex: Re: CAS proxy validation failure - Configured TLS trust engine was not used

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Monday, August 17, 2020 12:45 PM
> 
> This prevents a mis-configured HttpClient from appearing to be enforcing a
> trust check from not realizing the check was never done.
> 
> So it's a canary that's revealing the bug.

Cool. I vaguely remember ages ago inadvertently noticing the CAS proxy callback at the time was not actually validating the certificate. Looks like that was IDP-1371 not quite two years ago...

> Connection pooling of some sort I would imagine.

Hmm. I don't see anything suspicious set to 10 minutes. It looks like the time value settings are only for things like establishing the connection, killing idle connections, or other stuff involving a given connection. The proxy validation calls are coming as separate TCP connections, so it's not a keep alive thing. The other settings are for the size of the pools. I don't see anything that jumps out as "hold onto something for 10 minutes then reinitialize it"?

> Just to rule it out...is there any chance you set idp.httpclient.connectionDisregardTLSCertificate to true inside 
> services.properties?                                                            

Nope, that's commented out:

# grep -r connectionDisregardTLSCertificate /opt/shibboleth-idp
/opt/shibboleth-idp/conf/services.properties:#idp.httpclient.connectionDisregardTLSCertificate = false
/opt/shibboleth-idp/system/conf/global-system.xml:        p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
/opt/shibboleth-idp/system/conf/global-system.xml:        p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
/opt/shibboleth-idp/system/conf/global-system.xml:        p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
/opt/shibboleth-idp/system/conf/global-system.xml:        p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"