[OpenSAML] opensaml in WebLogic 10.1

[Jon Solanu]

I am attempting to use opensaml in a WebLogic 10MP1 project and am receiving the following message.  
I have been able to run a junit test case against the samez code with no problems but deploying to WebLogic gives the following message. 

The xmlsec-1.4.2 jar file is in the WEB-INF/lib directory of this sample project and I added a property to the startup too explicitly define an endorced directory for the XML parsing libs.

Using opensaml 2.2.3.jar files.  


java.lang.NoClassDefFoundError: org/apache/xml/security/Init
	at org.opensaml.DefaultBootstrap.initializeXMLSecurity(DefaultBootstrap.java:103)
	at org.opensaml.DefaultBootstrap.bootstrap(DefaultBootstrap.java:79)

	at test.SAML.(SAML.java:72)
	at test.tst.processRequest(tst.java:52)
	at test.tst.doGet(tst.java:79)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)

	at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:226)
	at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:124)
	at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:283)

	at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
	at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3395)
	at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)

	at weblogic.security.service.SecurityManager.runAs(Unknown Source)
	at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2140)
	at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2046)

	at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1366)
	at weblogic.work.ExecuteThread.execute(ExecuteThread.java:200)
	at weblogic.work.ExecuteThread.run(ExecuteThread.java:172)

[Jon Solanu]

Looks like there's a different error the first time the code attempts to execute.  However commons-logging-api.jar and comments-logging.jar are in the classpath.



####<May 18, 2009 1:19:30 PM EDT> <Error> <HTTP> <SC2A6744> <AdminServer> <[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1242667170344> <BEA-101017> <[weblogic.servlet.internal.WebAppServletContext@b44232 - appName: '_appsdir_TestWebApp_war', name: 'TestWebApp.war', context-path: '/TestWebApp'] Root cause of ServletException.
java.lang.NoClassDefFoundError: org/apache/commons/logging/LogFactory
    at org.apache.xml.security.Init.<clinit>(Unknown Source)

    at org.opensaml.DefaultBootstrap.initializeXMLSecurity(DefaultBootstrap.java:103)
    at org.opensaml.DefaultBootstrap.bootstrap(DefaultBootstrap.java:79)

    at test.SAML.<init>(SAML.java:72)
    at test.tst.processRequest(tst.java:52)
    at test.tst.doGet(tst.java:80)

    at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
    at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:226)
    at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:124)
    at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:283)
    at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
    at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3395)
    at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
    at weblogic.security.service.SecurityManager.runAs(Unknown Source)
    at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2140)
    at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2046)
    at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1366)
    at weblogic.work.ExecuteThread.execute(ExecuteThread.java:200)
    at weblogic.work.ExecuteThread.run(ExecuteThread.java:172)

[Brent Putman]

Both of these are classloader issues, not really specific to OpenSAML.  You might want to consult some WebLogic lists or docs to get an idea of the problem.

I'm not familiar with WebLogic, but if its classloader design is a hierarchical one similar to Tomcat's, one way this could happen is if your xmlsec.jar is in your WEB-INF/lib (so web app context classloader), but opensaml.jar is in a hierarchically higher parent classloader.  The latter classloader would not delegate down to the web app context one.  The solution is to put them all in WEB-INF/lib, and avoid putting them in any container shared classloaders (or else put them *all* in the shared container one, but that's probably undesirable for other reasons).

--Brent

[frederi...@smals.be]

I think that is indeed the problem.
I have used Weblogic (10.x) servers with opensaml and xmlsecurity without running into your problem.
by default, Weblogic has a version of opensaml on its server's classpath (one of the many weblogic modules jars).
I also have xmlsecurity on the server's classpath.
I guess that is why I don't have the same problem.

I guess you should try to put xmlsecurity on your server's classpath.
If not possible,
maybe you can try adding all jars to WEB-INF/lib and set the prefer-web-inf-classes option in the weblogic.xml deployment descriptor.
or if you are using an ear to deploy, better is to use the more fine-grained prefer-application-packages in weblogic-application.xml

Hope that helps,

Frederik