Another "trustAnchors parameter must be non-empty" incident

[Paul B. Henson]

So one of my idp's started failing to download metadata from InCommon
again, with the same errors as the last few times:

2023-05-12 12:56:56,526 - 75.84.236.41/node0esigt6w8enz71g1mveuu3amwl781006 - ERROR [org.opensaml.saml.metadat
a.resolver.impl.AbstractDynamicMetadataResolver:869] - Metadata Resolver FunctionDrivenDynamicHTTPMetadataReso
lver incommon-mdq: Error fetching metadata from origin source
javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAncho
rs parameter must be non-empty
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:133)
Caused by: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the
 trustAnchors parameter must be non-empty
        at java.base/sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:102)
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
2023-05-12 12:56:56,527 - 75.84.236.41/node0esigt6w8enz71g1mveuu3amwl781006 - INFO [org.opensaml.saml.common.b
inding.impl.SAMLMetadataLookupHandler:161] - Message Handler:  No metadata returned for http://cpp.instructure
.com/saml2 in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML
:2.0:protocol


I have no idea what causes it, clearly something in the http client goes
bonkers 8-/.

It succeeds:

2023-05-11 11:47:12,657 - 2603:8001:a900:2f55:71bf:9302:b991:2696/node015rybr6zhgpz71wyzxphegefek668028 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver:1078] - Metadata Resolver FunctionDrivenDynamicHTTPMetadataResolver incommon-mdq: Successfully loaded new EntityDescriptor with entityID 'https://ticket.iop.org/shibboleth' from origin source

Then starts failing:

2023-05-11 12:05:32,219 - / - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] - Metadata Resolver FileBackedHTTPMetadataResolver ADFSTrust: Error retrieving metadata from https://sts.cpp.edu/federationmetadata/2007-06/federationmetadata.xml: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
2023-05-11 12:05:32,324 - / - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] - Metadata Resolver FileBackedHTTPMetadataResolver CSUconnect: Error retrieving metadata from https://wayf.test.calstate.edu/metadata/CSUconnect-test-metadata.xml: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
2023-05-11 12:37:49,441 - 2620:df:8000:4702:0:2:89b8:1141/node04tf038ntfgq0xy6r1fn82r7s673140 - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver:869] - Metadata Resolver FunctionDrivenDynamicHTTPMetadataResolver incommon-mdq: Error fetching metadata from origin source
javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:133)

and keeps failing until I restart the idp, which goes back to operating
normally until this gremlin comes back randomly in the future :(. It looks
like this time it started failing during a metadata refresh cycle. I don't
remember if those were the first failures last time, I'll have to see
if that's a pattern next time it randomly happens.


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768