Validation of x509 client certificate chain breaks as of v. 5.0.0

[Engström Per]

Hello list.

I believe I have found a regression in X509 client certificate validation when the client presents a certificate chain longer than 1.

We rely heavily on authentication validating x509 client certificates. The authentication is primarily done by Jetty but the certificate is also validated by Shibboleth by bean with id="shibboleth.authn.X509.TrustEngine". It differs in how our Windows or Linux clients present the same client certificate. The Linux clients present only the leaf certificate without a certificate chain and validates Ok. The Windows clients present the client certificate with a certificate chain and this is correctly validated by Jetty but not by Shibboleth.

The change is in commit bc7f6bbcd37f4aa9fd247e13d55a7268894655c9, related to https://shibboleth.atlassian.net/browse/IDP-2083, in class org.opensaml.security.x509.BasicX509Credential. The problems are encountered in net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator.java#126-133. You try to add additional certificates to the certificate chain. The problem is that getEntityCertificateChain() has previously returned an ImmutableList with one element, which is why an error occurs when adding additional elements. Before the change, a list was returned to which elements could be added. As a suggestion, the list should be created first and then set on the certificate object using `BasicX509Credential.setEntityCertificateChain()`.

For now, we only rely on the validation of certificates that takes place in Jetty.

Kind regards,
Per Engström

Per Engström
Systemutvecklare / Systems Developer

SMHI / Swedish Meteorological and Hydrological Institute
SE - 601 76 NORRKÖPING
www.smhi.se<http://www.smhi.se>

E-post / Email: per.engstrom at smhi.se
Tel / Phone: +46 (0)11 495 83 37
Besöksadress / Street address: Folkborgsvägen 17

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240821/06722db3/attachment.htm>