OpenSAML user discussion

["Hayden Bakkum [DATACOM]" <>]

Hi,

 

The following tests are failing for me when building the OpenSAML-J (v2.3.1) project:

 

Failed tests:

 (a) testMessageEndpointInvalidHost(org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoderTest)

 (b) testMessageEndpointInvalidHost(org.opensaml.saml1.binding.decoding.HTTPSOAP11DecoderTest)

 (c) testMessageEndpointInvalidHost(org.opensaml.saml2.binding.decoding.HTTPPostDecoderTest)

 

I’ve isolated the cause of the failures down to the use of the URL.equals(URL) in the BaseSAMLMessageDecoder.compareEndpointURIs(String,String) method. Was there a reason for the use of the java.net.URL class here? This class is known to have a somewhat dodgy implementation in which it performs a blocking DNS lookup of the host strings during a call to URL.equals(URL) and then compares the IP addresses for equality. However, if no internet connection is available it may return a different result...

 

For example, if I do the following:

 

1)      With networking enabled, run the build, unit tests fail (see above).

2)      Disable networking, run the build, no tests fail.

 

From unit test (a) above this translates to the following behaviour:

 

[networking enabled] https://bogusidp.example.com/idp/sso == https://idp.example.com/idp/sso -> test fails

[networking disabled] https://bogusidp.example.com/idp/sso != https://idp.example.com/idp/sso -> test passes

 

I think it would be better here to use the URI class for comparing URL’s (however you would probably  need to remove default ports from the URL strings first as http://fqdn/blah != http://fqdn:80/blah for java.net.URI). Thoughts?

 

Thanks,

Hayden.

 

Hayden Bakkum | Java Developer | Datacom Systems (Wellington) Ltd
Office Ph: 64 4 463 7147 |

Email: | Web: www.datacom.co.nz |