[CXF-6537] Missing shibboleth dependency in the wss4j feature

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.2
• Fix Version/s: 3.1.10
• Component/s: OSGi
• Estimated Complexity: Unknown
• Assignee: Daniel Kulp
• Reporter: Xilai Dai
• Created: 13/Aug/15 06:55
• Updated: 31/Mar/17 19:38
• Resolved: 22/Mar/17 19:13

Description

In the default constructor of org.apache.cxf.rt.security.saml.xacml2.AbstractXACMLAuthorizingInterceptor

......
org.apache.wss4j.common.saml.OpenSAMLUtil.initSamlEngine();

and the net.shibboleth.utilities.java.support.xml.BasicParserPool class is used in the OpenSAMLUtil.initSamlEngine() (wss4j version 2.1.2)

the ClassNotFoundException will be thrown when the default constructor of AbstractXACMLAuthorizingIntercept has been invoked.

It can be fixed by adding

<bundle start-level="30" dependency="true">wrap:mvn:net.shibboleth.utilities/java-support/7.1.1</bundle>

into the wss4j feature in the apache-cxf-3.1.2-features.xml

Or maybe changes should be made on wss4j-ws-security-common bundle, which make net.shibboleth.utilities.java.support.xml packge not optional.