<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hello list.
<div class=""><br class="">
</div>
<div class="">
<div class="">I believe I have found a regression in <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">X509</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""> </span>client certificate validation when the client
presents a certificate chain longer than 1.</div>
<div class=""><br class="">
</div>
<div class="">We rely heavily on authentication validating x509 client certificates. The authentication is primarily done by Jetty but the certificate is also validated by Shibboleth by bean with id="shibboleth.authn.X509.TrustEngine". It differs in how our
Windows or Linux clients present the same client certificate. The Linux clients present only the leaf certificate without a certificate chain and validates Ok. The Windows clients present the client certificate with a certificate chain and this is correctly
validated by Jetty but not by Shibboleth.</div>
<div class=""><br class="">
</div>
<div class="">The change is in commit bc7f6bbcd37f4aa9fd247e13d55a7268894655c9, related to
<a href="https://shibboleth.atlassian.net/browse/IDP-2083" class="">https://shibboleth.atlassian.net/browse/IDP-2083</a>, in class org.opensaml.security.x509.BasicX509Credential. The problems are encountered in net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator.java#126-133.
You try to add additional certificates to the certificate chain. The problem is that getEntityCertificateChain() has previously returned an ImmutableList with one element, which is why an error occurs when adding additional elements. Before the change, a list <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">was
returned </span>to which elements could be added. As a suggestion, the list should be created first and then set on the certificate object using `BasicX509Credential.setEntityCertificateChain()`.</div>
</div>
<div class=""><br class="">
</div>
<div class="">For now, we only rely on the validation of certificates that takes place in Jetty.</div>
<div class=""><br class="">
</div>
<div class="">Kind regards,</div>
<div class="">Per Engström</div>
<div class=""><br class="">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<b class="">Per Engström</b><br class="">
Systemutvecklare / Systems Developer<br class="">
<br class="">
<b class="">SMHI / Swedish Meteorological and Hydrological Institute</b><br class="">
SE - 601 76 NORRKÖPING<br class="">
<a href="http://www.smhi.se" class="">www.smhi.se</a><br class="">
<br class="">
E-post / Email: per.engstrom@smhi.se<br class="">
Tel / Phone: +46 (0)11 495 83 37<br class="">
Besöksadress / Street address: Folkborgsvägen 17</div>
</div>
</div>
<br class="">
</div>
</body>
</html>