[SANTUARIO-281] Invalid signature value when using XMLSignature in two EJB modules on AS

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Java 1.4.5
• Fix Version/s: Java 1.4.6
• Component/s: Java
• Security Level: Public (Public issues, viewable by everyone)
• Environment: JBoss 5.1, 6.0
• Assignee: Colm O hEigeartaigh
• Reporter: Tomasz Juchniewicz
• Created: 21/Jun/11 17:50
• Updated: 21/Oct/11 12:25
• Resolved: 18/Jul/11 09:23

Description

I'm using org.apache.xml.security.signature.XMLSignature to sign my document. First signature in first EJB module works fine, but second signature generated in second EJB module is invalid/different (using the same code, document, keys, certs etc.). References, certificates and key values in generated signatures are the same, only signature value is different.

The same situation occurs after redeploying application if using only one EJB module.

Classloader issue? I'm not sure if this is Santuario issue, maybe this is JBoss issue. Tested on JBoss 5.1 and 6.0.