Information

Title	OEAUTH and stsclientutil can only use one protocol

URL Name	oeauth-stsclientutil-can-only-use-one-protocol

Article Number	000112414

Environment	Product: OpenEdge Version: 11.6.x, 11.7.x OS: All supported platforms

Question/Problem Description

When more than one protocol is defined OEAUTH and stsclientutil fail if the default protocol cannot be used
OEAUTH can only use one protocol
stsclientutil can only use one protocol

Steps to Reproduce	export SSL_DEBUG_LOGGGING=D export PSC_SSLCLIENT_PROTOCOLS=TLSv1.2,TLSv1 _progres -b -p tsslsocket.p -param "-H <host> -S <port>" 2>&1 \| tee /dev/null View the log file in local directory

Clarifying Information

ABL socket connect test: tsslsocket.p

DEF VAR hSock 		AS HANDLE NO-UNDO.
DEF VAR csslopts    AS CHAR INITIAL " -ssl -nohostverify" NO-UNDO.
DEF VAR cconopts    AS CHAR INITIAL "-H localhost -S 4433" NO-UNDO.

IF (SESSION:PARAMETER <> "" ) THEN
    cconopts = SESSION:PARAMETER.
MESSAGE "connecting to: " + cconopts + csslopts.
CREATE SOCKET hSock.

hSock:CONNECT(cconopts + csslopts).
MESSAGE "Connected to " + hSock:SSL-SERVER-NAME.
hSock:DISCONNECT().

DELETE OBJECT hSock.

Error Message	Error 6, 35 from STS user exchange authentication: SSL connect error. $ENV{'PSC_SSLCLIENT_PROTOCOLS'} = 'TLSv1.2,TLSv1'; Debug: Auth Gateway - unknown SSL version specified (TLSv1.2,TLSv1) ... using default TLSv1.2

Defect Number

Enhancement Number

Cause

This is expected behavior:
OEAUTH and stsclientutil can only use one protocol, If multiple protocols specified it will use the default TLS1.2
The OE database's connection to the STS can specify the PSC_SSLCLIENT_PROTOCOLS environment variable, but that ENVAR can only be set to one protocol. It is a known limitation

Resolution

Before starting the database set PSC_SSLCLIENT_PROTOCOLS

set PSC_SSLCLIENT_PROTOCOLS=TLSv1.2
PSC_SSLCLIENT_PROTOCOLS=TLSv1.2, export PSC_SSLCLIENT_PROTOCOLS
$ proserve dbname ....

When using stsclientutil set PSC_SSLCLIENT_PROTOCOLS:
set PSC_SSLCLIENT_PROTOCOLS=TLSv1.2
PSC_SSLCLIENT_PROTOCOLS=TLSv1.2, export PSC_SSLCLIENT_PROTOCOLS
$ stsclientutil -cmd ping -url https://<host>:<port -logginglevel 5

Workaround

Notes

References to Other Documentation:

Progress Article(s):
How to set Client SSL Protocols and Ciphers in OpenEdge

Keyword Phrase

Last Modified Date	11/20/2020 6:51 AM