{"action":"created","issue":{"url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/139","repository_url":"https://api.github.com/repos/GluuFederation/oxAuth","labels_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/139/labels{/name}","comments_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/139/comments","events_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/139/events","html_url":"https://github.com/GluuFederation/oxAuth/issues/139","id":129511419,"number":139,"title":"Update httpclient on oxauth / oxtrust to at least 4.3.2 so that it properly supports Server Name Indication","user":{"login":"nynymike","id":3717101,"avatar_url":"https://avatars.githubusercontent.com/u/3717101?v=3","gravatar_id":"","url":"https://api.github.com/users/nynymike","html_url":"https://github.com/nynymike","followers_url":"https://api.github.com/users/nynymike/followers","following_url":"https://api.github.com/users/nynymike/following{/other_user}","gists_url":"https://api.github.com/users/nynymike/gists{/gist_id}","starred_url":"https://api.github.com/users/nynymike/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nynymike/subscriptions","organizations_url":"https://api.github.com/users/nynymike/orgs","repos_url":"https://api.github.com/users/nynymike/repos","events_url":"https://api.github.com/users/nynymike/events{/privacy}","received_events_url":"https://api.github.com/users/nynymike/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GluuFederation/oxAuth/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"yurem","id":6104200,"avatar_url":"https://avatars.githubusercontent.com/u/6104200?v=3","gravatar_id":"","url":"https://api.github.com/users/yurem","html_url":"https://github.com/yurem","followers_url":"https://api.github.com/users/yurem/followers","following_url":"https://api.github.com/users/yurem/following{/other_user}","gists_url":"https://api.github.com/users/yurem/gists{/gist_id}","starred_url":"https://api.github.com/users/yurem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yurem/subscriptions","organizations_url":"https://api.github.com/users/yurem/orgs","repos_url":"https://api.github.com/users/yurem/repos","events_url":"https://api.github.com/users/yurem/events{/privacy}","received_events_url":"https://api.github.com/users/yurem/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GluuFederation/oxAuth/milestones/2","html_url":"https://github.com/GluuFederation/oxAuth/milestones/CE%202.4.2","labels_url":"https://api.github.com/repos/GluuFederation/oxAuth/milestones/2/labels","id":1469960,"number":2,"title":"CE 2.4.2","description":null,"creator":{"login":"yurem","id":6104200,"avatar_url":"https://avatars.githubusercontent.com/u/6104200?v=3","gravatar_id":"","url":"https://api.github.com/users/yurem","html_url":"https://github.com/yurem","followers_url":"https://api.github.com/users/yurem/followers","following_url":"https://api.github.com/users/yurem/following{/other_user}","gists_url":"https://api.github.com/users/yurem/gists{/gist_id}","starred_url":"https://api.github.com/users/yurem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yurem/subscriptions","organizations_url":"https://api.github.com/users/yurem/orgs","repos_url":"https://api.github.com/users/yurem/repos","events_url":"https://api.github.com/users/yurem/events{/privacy}","received_events_url":"https://api.github.com/users/yurem/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":21,"state":"open","created_at":"2015-12-21T17:29:19Z","updated_at":"2016-03-05T02:46:16Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-01-28T17:00:56Z","updated_at":"2016-03-18T21:03:29Z","closed_at":"2016-01-29T15:22:47Z","body":"Affects: gluu-server-2.3.x - 2.4.1, Ubuntu / CentOS\r\n\r\nServer Name Indication allows a server to present different SSL certificates depending on the server name requested by the client. It may be used in testing Gluu server on the same machine as other applications, which may have their own SSL certificates.\r\n\r\n[Wikipedia Article on Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)\r\n\r\nTesting:\r\n\r\n  * Gluu is installed behind a reverse proxy web server (apache or nginx)\r\nweb server is configured with multiple SSL certificates on the same IP address. One domain name is assigned to Gluu with the correct certificate (gluu.local). The Gluu certificate is NOT the default.\r\n  * Attempt to login to oxtrust by visiting the Gluu URL (gluu.local).  oxtrust redirects to oxauth and asks for a login upon successful login, oxauth redirects to oxtrust, which goes into a redirect loop\r\n  * Upon investigating the logs, oxtrust fails to connect to the token endpoint due to an SSL error. (see oxtrust-redirect-loop.log)\r\n  * The SSL error is treated as a null token, which makes oxtrust repeat the request again ad infinitum.\r\n  * This is the case even when all SSL certificates of the Gluu server are trusted at the OS level. The problem goes away if you set the Gluu certificate as the default SSL certificate on the web server (but this may not be desired).\r\n  \r\nOn further investigation, the client code in this backtrace:\r\n\r\n    at org.jboss.resteasy.client.ClientRequest.post(ClientRequest.java:566)\r\n    at org.jboss.resteasy.client.ClientRequest.post(ClientRequest.java:571)\r\n    at org.xdi.oxauth.client.TokenClient.exec(TokenClient.java:303)\r\n    at org.xdi.oxauth.client.TokenClient.execAuthorizationCode(TokenClient.java:112)\r\n\r\nIndicates that the code executing the connection is JBoss Resteasy library.\r\n\r\nJBoss resteasy currently has an issue supporting Server Name Indication _if httpclient is older than 4.3.2_\r\n\r\nhttps://issues.jboss.org/browse/RESTEASY-1089\r\n\r\nA quick search through the /opt/tomcat/ filesystem shows that the default installed httpclient is 4.2.3\r\n\r\n    GLUU.root@gluu:/opt/tomcat# find -iname 'httpclient-*'\r\n    ./webapps/oxauth/WEB-INF/lib/httpclient-4.2.3.jar\r\n    ./webapps/identity/WEB-INF/lib/httpclient-4.2.2.jar\r\n    ./work/Catalina/localhost/idp/WEB-INF/lib/httpclient-4.2.5.jar\r\n\r\nCan we update the packaged `httpclient` on oxauth / oxtrust to at least 4.3.2 so that it properly supports Server Name Indication?"},"comment":{"url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/comments/198541660","html_url":"https://github.com/GluuFederation/oxAuth/issues/139#issuecomment-198541660","issue_url":"https://api.github.com/repos/GluuFederation/oxAuth/issues/139","id":198541660,"user":{"login":"JohnTheodore","id":1904409,"avatar_url":"https://avatars.githubusercontent.com/u/1904409?v=3","gravatar_id":"","url":"https://api.github.com/users/JohnTheodore","html_url":"https://github.com/JohnTheodore","followers_url":"https://api.github.com/users/JohnTheodore/followers","following_url":"https://api.github.com/users/JohnTheodore/following{/other_user}","gists_url":"https://api.github.com/users/JohnTheodore/gists{/gist_id}","starred_url":"https://api.github.com/users/JohnTheodore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JohnTheodore/subscriptions","organizations_url":"https://api.github.com/users/JohnTheodore/orgs","repos_url":"https://api.github.com/users/JohnTheodore/repos","events_url":"https://api.github.com/users/JohnTheodore/events{/privacy}","received_events_url":"https://api.github.com/users/JohnTheodore/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T21:03:29Z","updated_at":"2016-03-18T21:03:29Z","body":"@madumlao here is https://gist.github.com/JohnTheodore/ac138c62b2f5c151b466 with a full log loop cycle in /opt/tomcat/logs/wrapper.log. That pattern repeats for as long as my web browser is trying to login."}}