You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ws.apache.org by "Freeman Fang (Created) (JIRA)" <ji...@apache.org> on 2012/02/14 09:59:59 UTC
[jira] [Created] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
should set com....security.enableCRLDP when enableRevocation is true
--------------------------------------------------------------------
Key: WSS-338
URL: https://issues.apache.org/jira/browse/WSS-338
Project: WSS4J
Issue Type: Improvement
Affects Versions: 1.6.4
Reporter: Freeman Fang
Assignee: Colm O hEigeartaigh
Fix For: 1.6.5
When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Resolved] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Freeman Fang (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Freeman Fang resolved WSS-338.
------------------------------
Resolution: Not A Problem
Per the discussion in WSS-339, this isn't a problem
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Commented] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Colm O hEigeartaigh (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13208517#comment-13208517 ]
Colm O hEigeartaigh commented on WSS-338:
-----------------------------------------
Hi Freeman,
I'm -1 to this patch because of the system property requirement.
It's something that should be set at the application/container level if needed, and should be documented as such.
Colm.
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Updated] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Colm O hEigeartaigh (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh updated WSS-338:
------------------------------------
Fix Version/s: (was: 1.6.5)
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Commented] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Freeman Fang (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13209119#comment-13209119 ]
Freeman Fang commented on WSS-338:
----------------------------------
Hi colm,
Thanks for the reply.
But as I commented in WSS-339, we need enableCRLDP per service context, as different service may use different certificates issued by different CA, thus it's possible that use different certificates revocation check policies.
I'm going to introduce a new property enableCRLDP for WSHandler so that we can configure it per serivce easily, and use the solution I suggest in WSS-339, something like
synchronized (A Globel Lock Object from WSS4J) {
set properties,
validator.validate(path, param); // check if certificate is still valid
restore properties
}
in verifyTrust method, so that the property won't pollute the whole JVM context, this solution works by my test.
WDYT?
Best Regards
Freeman
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Issue Comment Edited] (WSS-338) should set
com....security.enableCRLDP when enableRevocation is true
Posted by "Freeman Fang (Issue Comment Edited) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13207595#comment-13207595 ]
Freeman Fang edited comment on WSS-338 at 2/14/12 9:01 AM:
-----------------------------------------------------------
Patch appended, please review and apply it if it's ok.
was (Author: ffang):
patch appended
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Commented] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Freeman Fang (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13207595#comment-13207595 ]
Freeman Fang commented on WSS-338:
----------------------------------
patch appended
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Updated] (WSS-338) should set com....security.enableCRLDP
when enableRevocation is true
Posted by "Freeman Fang (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-338?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Freeman Fang updated WSS-338:
-----------------------------
Attachment: WSS-338.patch
> should set com....security.enableCRLDP when enableRevocation is true
> --------------------------------------------------------------------
>
> Key: WSS-338
> URL: https://issues.apache.org/jira/browse/WSS-338
> Project: WSS4J
> Issue Type: Improvement
> Affects Versions: 1.6.4
> Reporter: Freeman Fang
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6.5
>
> Attachments: WSS-338.patch
>
>
> When we use CRL to do revocation certificate check, generally the certificates can carry CRLDistributionPoints extension(which is http or ldap url), but currently we can't use this CRLDistributionPoints in certificates out of the box. It would be better that we can use CRLDistributionPoints out of box. Simply set com.sun|ibm.security.enableCRLDP property as true when enableRevocation ensure that we get chance to use the CRLDistributionPoints in certificates and no necessary to specify org.apache.ws.security.crypto.merlin.x509crl.file explicitly and whatnot for Crypto instance.
> Set this property won't affect current logic, e.g., if there is no CRLDistributionPoints in certificates then it still can use the crl file specified by org.apache.ws.security.crypto.merlin.x509crl.file
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org