grith/sibboleth — pull request #5 by vladimir-mencl-eresearch (2012-08-16 04:48:45+00:00)
Title: SSL issue workaround: replace ssl._make_ssl_socket

Hack the ssl class in socket.py NOT to enable all supported ciphersuits when setting up an SSL connection.

Enabling all supported ciphersuits causes an issue on:
* some Java platforms (OpenJDK, Mac Java 1.6.0_33)
* in combination for some IdPs (Canterbury IdP behing a BigIP firewall)
* In this combination, a second https connection (e.g., after a 302 redirect) breaks.

Replace the _make_ssl_socket method from socket.ssl class with our own version that does not enable all ciphersuits that Java lists as supported.

The replacement method is in sibboleth/socketsslonlydefaultciphers.py

Importing this module (in sibboleth/shibboleth.py) activates this workaround.