[NIFI-8186] Exclude bcprov-ext-jdk15on from spring-security-saml2-core

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.13.0
• Fix Version/s: 1.13.0
• Labels: bouncycastle security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 01/Feb/21 15:26
• Updated: 01/Feb/21 18:22
• Resolved: 01/Feb/21 18:22

Description

The spring-security-saml2-core library has a transitive dependency on bcprov-ext-jdk15on version 1.60 through the com.narupley:not-going-to-be-commons-ssl library.  The standard bcprov-jdk15on library is configured with version 1.68 through the framework, so the older extension version of the Bouncy Castle Provider should be excluded to avoid expected runtime behavior.  The standard and extended versions of the Bouncy Castle Provider libraries are fundamentally similar, with the primary difference being the inclusion of classes to support of obscure NTRU algorithm in the extension library.

Issue Links

• links to: GitHub Pull Request #4793