<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Addition: after I had copied the jar, I could revert the order of
the java.security file back, with BC at the end, and it still
worked.<br>
<br>
Martin<br>
<br>
<div class="moz-cite-prefix">Am 21.08.2013 13:51, schrieb Martin
Haase:<br>
</div>
<blockquote cite="mid:5214A9D8.4000304@DAASI.de" type="cite">
<pre wrap="">Hi Ian,
thanks for this! The articles you cited were also among the ones i had
found.
I tried the reordering, nothing happened. Then I realized that the
sunjce_provider.jar was still being used by the IdP. I fixed this by
copying bcprov-jdk15-1.46.jar to $JAVA_HOME/lib/ext/: seemingly the jar
that lives in idp.war was not picked up. And it worked!!!
</pre>
<blockquote type="cite">
<pre wrap="">Switching to <a class="moz-txt-link-freetext" href="http://">http://</a> would obviously do it (and there's really no reason to use TLS for metadata unless the metadata is itself unsigned). The other alternative would be to get them to use a more compatible set of cipher suites on their side.
Do you have any idea what their implementation is based on? When things like this come up I always worry that they are advance warnings of some platform distribution's default policies, which might affect lots of people in the long run. It's more often just a random person's individual choice, though.
</pre>
</blockquote>
<pre wrap="">That's a good point... I'd need to discuss this with the guy responsible.
Thanks again for your quick answer,
Martin
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Dr. Martin Haase, Solutions Engineer
DAASI International GmbH
Europaplatz 3
D-72072 Tübingen
Germany
phone: +49 7071 407109-6
fax: +49 7071 407109-9
email: <a class="moz-txt-link-abbreviated" href="mailto:martin.haase@daasi.de">martin.haase@daasi.de</a>
web: <a class="moz-txt-link-abbreviated" href="http://www.daasi.de">www.daasi.de</a>
Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz
</pre>
</body>
</html>