[WSS-301] WSS4J 1.6 incorrectly using XML-Security ResourceResolvers

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.1
• Fix Version/s: 1.6.2
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 26/Jul/11 09:10
• Updated: 16/Feb/12 01:58
• Resolved: 26/Jul/11 15:18

Description

WSS4J 1.6.x is incorrectly using XML-Security ResourceResolvers to "resolve" DOM Elements for use in signature creation and verification. WSS4J uses a custom IdResolver implementation to call a custom ResourceResolverSpi instance. This IdResolver implementation uses "internal" org.jcp.* classes, and this is causing problems when using JDK 1.6 for signature creation and validation in some containers (Jetty).

WSS4J should be using the JSR-105 API instead to find and supply elements for signature/creation.