CODEWITHSUNDEEP
spring-securitysaml-2.0spring-saml
Atif Siddiqui
Atif Siddiqui

Reputation: 53

Spring SAML configuration is breaking other http connections

I am using Spring SAML to implement single sign on in my application. Evreything is integrated and works properly from SSO perspective. Another service of my application which also uses HTTP client post via Axis started failing with the following error

{http://xml.apache.org/axis/}stackTrace:javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: null

I have looked into the answer provided the link Spring Security SAML + HTTPS to another page and follow the same but to no avail.

Below is the configuration for TLSProtocolSocketFactory

    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="targetClass" value="org.apache.commons.httpclient.protocol.Protocol"/>
    <property name="targetMethod" value="registerProtocol"/>
    <property name="arguments">
        <list>
            <value>https</value>
            <bean class="org.apache.commons.httpclient.protocol.Protocol">
                <constructor-arg value="https"/>
                <constructor-arg>
                    <bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory">
                        <constructor-arg ref="keyManager"/>
                        <constructor-arg><null/></constructor-arg>
                        <constructor-arg value="allowAll"/>
                    </bean>
                </constructor-arg>
                <constructor-arg value="443"/>
            </bean>
        </list>
    </property>
</bean>

I have imported the cert of the other service in samlKeystore.jks as well.

Any help in the issue will be apreciated

Upvotes: 2

Views: 1385

Answers (2)

Atif Siddiqui
Atif Siddiqui

Reputation: 53

The issue is in checkNames() function of PKIXX509CredentialTrustEngine where we are checking the trustedNames collection only for null instead of "null or Empty".

Even though we are passing the value for trustedNames as null in TLSProtocolSocketFactory's getPKIXResolver() method to create StaticPKIXValidationInformatonResolver, the constructor of this class reinitialized the trustedNames collection to an empty collection.
Changing the line from
if(trustedNames == null) to

if(trustedNames == null || trustedNames.isEmpty())
fixed the problem for me.

Upvotes: 0

blur0224
blur0224

Reputation: 1012

I think this may be what you're looking for: Source

You are using bean TLSProtocolConfigurer which changes trusted certificates and hostname verification of the HTTPS protocol in the HTTP Client. You can revert behaviour of the HTTP Client back to defaults by removing this bean. You will then need to make sure that certificates used by entities from which you load metadata (https://idp.ssocircle.com/idp-meta.xml) are trusted in your cacerts, or use an endpoints without https (http://idp.ssocircle.com/idp-meta.xml).

Alternatively, you can disable hostname verification by setting property sslHostnameVerification to allowAll on bean TLSProtocolConfigurer. You will also need to make sure that the HTTPS certificate of https://www.somepage.com (or its CA) is included in the samlKeystore.jks (see Spring SAML manual).

You can find more details on the TLSProtocolConfigurer bean in the Spring SAML manual, chapter HTTP-based metadata provider with SSL.

Upvotes: 1

Related Questions