ClassCastException when verifying XML signature, multiple WARs deployed to same
Tomcat instance
-----------------------------------------------------------------------------------------------
Key: WSS-320
URL: https://issues.apache.org/jira/browse/WSS-320
Project: WSS4J
Issue Type: Bug
Components: WSS4J Core
Affects Versions: 1.6.3, 1.6.2
Environment: Tomcat 7.0.16
Reporter: John Lazos
Assignee: Colm O hEigeartaigh
When I have multiple WARs deployed in the same Tomcat instance, I receive the
following exception when attempting to verify a signature in the security
header:
Caused by: javax.xml.crypto.dsig.XMLSignatureException:
javax.xml.crypto.dsig.TransformException: java.lang.ClassCastException:
org.apache.ws.security.WSDocInfo cannot be cast to
org.apache.ws.security.WSDocInfo
at org.jcp.xml.dsig.internal.dom.DOMReference.transform(Unknown Source)
at org.jcp.xml.dsig.internal.dom.DOMReference.validate(Unknown Source)
at org.jcp.xml.dsig.internal.dom.DOMXMLSignature.validate(Unknown
Source)
at
org.apache.ws.security.processor.SignatureProcessor.verifyXMLSignature(SignatureProcessor.java:348)
... 34 more
Caused by: javax.xml.crypto.dsig.TransformException:
java.lang.ClassCastException: org.apache.ws.security.WSDocInfo cannot be cast
to org.apache.ws.security.WSDocInfo
at
org.apache.ws.security.transform.STRTransform.transformIt(STRTransform.java:264)
at
org.apache.ws.security.transform.STRTransform.transform(STRTransform.java:121)
at org.jcp.xml.dsig.internal.dom.DOMTransform.transform(Unknown Source)
... 38 more
Caused by: java.lang.ClassCastException: org.apache.ws.security.WSDocInfo
cannot be cast to org.apache.ws.security.WSDocInfo
at
org.apache.ws.security.transform.STRTransform.transformIt(STRTransform.java:184)
... 40 more
When I put each WAR into its own Tomcat instance, the issue does not occur. I
am using WSS4J with CXF on Tomcat 7.0.16.
I do not know much about the implementation of WSS4J, but I suspect this is a
class loader issue related to https://issues.apache.org/jira/browse/WSS-282.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
