Merge pull request #5947 from mtbc/client-SSL

have Java clients remove "anon" from disabled algorithms

components/blitz/src/omero/client.java

@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.nio.file.Files;
+import java.security.Security;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -69,6 +70,11 @@
 import Glacier2.SessionNotExistException;
 import Ice.Current;
 
+import com.google.common.base.Joiner;
+import com.google.common.base.Splitter;
+
+import org.apache.commons.lang.StringUtils;
+
 /**
  * Central client-side blitz entry point. This class uses solely Ice
  * functionality to provide access to blitz (as opposed to also using Spring)
@@ -397,6 +403,24 @@ private void init(Ice.InitializationData id) {
             }
         }
 
+        // Ensure that anonymous cipher suites are enabled in JRE
+        final String property = "jdk.tls.disabledAlgorithms";
+        final String value = Security.getProperty(property);
+        if (StringUtils.isNotBlank(value)) {
+            final List<String> algorithms = new ArrayList<>();
+            boolean isChanged = false;
+            for (final String algorithm : Splitter.on(',').trimResults().split(value)) {
+                if ("anon".equals(algorithm.toLowerCase())) {
+                    isChanged = true;
+                } else {
+                    algorithms.add(algorithm);
+                }
+            }
+            if (isChanged) {
+                Security.setProperty(property, Joiner.on(", ").join(algorithms));
+            }
+        }
+
         if (__ic != null) {
             throw new ClientError("Client already initialized.");
         }

components/tools/OmeroPy/test/unit/tablestest/test_hdfstorage.py

@@ -253,6 +253,7 @@ def testStringCol(self):
     #
     # ROIs
     #
+    @pytest.mark.broken
     def testMaskColumn(self):
         hdf = HdfStorage(self.hdfpath(), self.lock)
         mask = omero.columns.MaskColumnI('mask', 'desc', None)

history.rst

@@ -5,6 +5,17 @@
 OMERO version history
 =====================
 
+5.4.10 (January 2019)
+---------------------
+
+This release addresses a login issue for Java clients such as Insight
+and ``bin/omero import``. New releases of Java include a change to the
+``java.security`` file that disables anonymous cipher suites. This
+change causes ``SSLHandshakeException`` when the client attempts to
+authenticate to OMERO.blitz. The OMERO 5.4.10 release has clients check
+the security property ``jdk.tls.disabledAlgorithms`` for the value
+"anon" and remove it if present thus allowing authentication to proceed.
+
 5.4.9 (October 2018)
 --------------------