[WSS-320] ClassCastException when verifying XML signature, multiple WARs deployed to same Tomcat instance

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.2, 1.6.3
• Fix Version/s: 1.6.4
• Component/s: WSS4J Core
• Labels: classloader
• Environment: Tomcat 7.0.16, 6.0.33
• Assignee: Colm O hEigeartaigh
• Reporter: John Lazos
• Created: 18/Oct/11 14:07
• Updated: 06/Dec/11 10:31
• Resolved: 04/Nov/11 11:49

Description

When I have multiple WARs deployed in the same Tomcat instance, I receive the following exception when attempting to verify a signature in the security header:

Caused by: javax.xml.crypto.dsig.XMLSignatureException: javax.xml.crypto.dsig.TransformException: java.lang.ClassCastException: org.apache.ws.security.WSDocInfo cannot be cast to org.apache.ws.security.WSDocInfo
at org.jcp.xml.dsig.internal.dom.DOMReference.transform(Unknown Source)
at org.jcp.xml.dsig.internal.dom.DOMReference.validate(Unknown Source)
at org.jcp.xml.dsig.internal.dom.DOMXMLSignature.validate(Unknown Source)
at org.apache.ws.security.processor.SignatureProcessor.verifyXMLSignature(SignatureProcessor.java:348)
... 34 more
Caused by: javax.xml.crypto.dsig.TransformException: java.lang.ClassCastException: org.apache.ws.security.WSDocInfo cannot be cast to org.apache.ws.security.WSDocInfo
at org.apache.ws.security.transform.STRTransform.transformIt(STRTransform.java:264)
at org.apache.ws.security.transform.STRTransform.transform(STRTransform.java:121)
at org.jcp.xml.dsig.internal.dom.DOMTransform.transform(Unknown Source)
... 38 more
Caused by: java.lang.ClassCastException: org.apache.ws.security.WSDocInfo cannot be cast to org.apache.ws.security.WSDocInfo
at org.apache.ws.security.transform.STRTransform.transformIt(STRTransform.java:184)
... 40 more

When I put each WAR into its own Tomcat instance, the issue does not occur. I am using WSS4J with CXF on Tomcat 7.0.16.

I do not know much about the implementation of WSS4J, but I suspect this is a class loader issue related to https://issues.apache.org/jira/browse/WSS-282.