Re: AW: Axis, wss4j & oc4j

[Tim Williams]

Thanks for the info Chris.

I must say the more I use OC4J the more I grow not to like it. Oracle do say how to make it use the third party XML parser (as I'm sure you are aware), so I've gone that route for now. Lucky for me I can get away with making the switch without the customers minding too much.

It's funny how everything seems to work fine on Tomcat, but as soon as you make the switch to OC4J everything falls apart. I hope the next projects I have to do are Tomcat only.

Tim

On 10/10/05, Chris Nappin <[EMAIL PROTECTED]> wrote:

Yes, we've also been through this issue. We raised it with Oracle and they were unable to back down, even though it will loose them a lot of sales. Changing any of the default XML libraries in OC4J is not supported, which is a great shame as those libraries have some serious bugs in them (other to the one you've found).

 

We are migrating our customers onto an alternative application server purely because of this issue.

 

You might want to try the newly released 10g AS, as this apparently doesn't have these faults. I haven't tried it yet myself.

 

HTH,

 

  Chris.

 

---

From: Tim Williams [mailto:[EMAIL PROTECTED]]
Sent: 07 October 2005 11:35
To: Jorge Martín Cuervo
Cc: wss4j-dev@ws.apache.org
Subject: Re: AW: Axis, wss4j & oc4j

 

http://www.oracle.com/technology/tech/java/oc4j/904/collateral/oc4j-faq-904.html#oc4j_deploy

Point 25, I'm just trying now...

Ooh it works. Dunno what customers are gonna think about change the parser though. Urgh if only they used Tomcat.

Worth remembering though.

Thanks all
Tim

On 07 Oct 2005 12:24:15 +0200, Jorge Martín Cuervo < [EMAIL PROTECTED]> wrote:

try to put xerces jars in WEB-INF/lib

El vie, 07 de 10 de 2005 a las 12:16, Tim Williams escribió:

That it is. And it uses Crimson as it's XML parser, which xml-sec does not support. Have I found the route of my problem? Can I force OC4J into using Xerces instead of Crimson? I'll let you all know if I have any luck.

On 07 Oct 2005 12:14:00 +0200, Jorge Martín Cuervo <[EMAIL PROTECTED] > wrote:

El vie, 07 de 10 de 2005 a las 11:33, Dittmann, Werner escribió:

Tim,
 
XMLCipher is part of xml-sec library (jar).
 
What is OC4J?

the oracle servlet/jsp container.

 
regards,
Werner

-----Ursprüngliche Nachricht-----
Von: Tim Williams [mailto:

[EMAIL PROTECTED] ]
Gesendet: Freitag, 7. Oktober 2005 11:29
An: wss4j-dev@ws.apache.org
Betreff: Axis, wss4j & oc4j


Hey all,

I got 2 way encryption on the go with my web service on Tomcat, and it's working brilliantly.

The problem I'm having is with line 1224 in WSEngine:

xmlCipher.doFinal(doc, encBodyData, content);

This throws an illegal argument exception when trying to decrypt the imcomming message. I haven't found the source for XMLCipher.

As it all works on Tomcat, and it worked before I added the security handlers, I can only assume that OC4J causes axis to do something funny with messages as it passes them to the handler.

Any ideas on how to get it working?

Thanks
Tim

 

-- ;-)____________________________________Jorge Martin CuervoAnalista Programador Outsourcing EmarketplacedeFacto Powered by Standards email < [EMAIL PROTECTED]>voz +34 985 129 820voz +34 660 026 384____________________________________

-- ;-)____________________________________Jorge Martin CuervoAnalista Programador Outsourcing EmarketplacedeFacto Powered by Standards email < [EMAIL PROTECTED] >voz +34 985 129 820voz +34 660 026 384____________________________________

 

 

CONFIDENTIALITY & PRIVILEGE NOTICE

This e-mail is confidential to its intended recipient. It may also be privileged. Neither the confidentiality nor any privilege attaching to this e-mail is waived lost or destroyed by reason that it has been mistakenly transmitted to a person or entity other than its intended recipient. If you are not the intended recipient please notify us immediately by telephone or fax at the numbers provided above or e-mail by Reply To Author and return the printed e-mail to us by post at our expense. We believe, but do not warrant, that this e-mail and any attachments are virus-free, but you should check. We may monitor traffic data of both business and personal e-mails. We are not liable for any opinions expressed by the sender where this is a non-business e-mail. If you do not receive all the message, or if you have difficulty with the transmission, please telephone us immediately.