<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 9/30/15 4:27 PM, Nickles, Brent
wrote:<br>
</div>
<blockquote
cite="mid:B8D2FE15BD5BE540AC8CC9D20C148A120CEE6F55@CITS-EX1.campus.umaryland.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1"><br>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Has anyone else experienced this? <br>
</p>
</div>
</blockquote>
<br>
Yes it's a known issue for a couple of months now. It's an Oracle
and OpenJDK bug. Discussed on the list in great detail here:<br>
<br>
<a class="moz-txt-link-freetext" href="http://marc.info/?l=shibboleth-users&m=143756726417879&w=2">http://marc.info/?l=shibboleth-users&m=143756726417879&w=2</a><br>
<br>
<br>
<blockquote
cite="mid:B8D2FE15BD5BE540AC8CC9D20C148A120CEE6F55@CITS-EX1.campus.umaryland.edu"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"> Short of rolling java versions back, is
there a fix?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
<br>
You can supply a system property to the JVM
-Djdk.tls.trustNameService=true that should work (although its
original intention is for another reason). That's a global change,
so if you have other apps in the same JVM, just be aware.<br>
<br>
I just checked in a provisional fix to OpenSAML v2 to bypass the
buggy JDK behavior. It will be in the next IdP patch release, but
we haven't decided exactly when that will be yet. We're currently
fully engaged in trying to get the IdP 3.2.0 out.<br>
<br>
Here's the issue tracking the v2 fix: <br>
<br>
<a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/JOWS-47">https://issues.shibboleth.net/jira/browse/JOWS-47</a><br>
<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
</body>
</html>