SES-173: Move to Bouncy Castle 1.5.4

[spring-projects-issues]

George Stanchev (Migrated from SES-173) said:

Currently the spring-security-saml is dependent on "bcprov-jdk15-1.46.jar". Manual update to BC 1.5.x is not possible as due to refactoring in Bouncy Castle we get [1]. We are stuck with a later version of BC due to 3rd party dependency that cannot be resolved which forces us to implement the SP as a separate application. Upgrade to latest BC would be great.

[1]

ERROR 2016-01-07 12:37:02,402 [ContextLoader] -- [] Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadataController': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: org.springfram
ework.security.saml.metadata.MetadataManager org.springframework.security.saml.web.MetadataController.metadataManager; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadata' defined in ServletContext resourc
e [/WEB-INF/securityContext.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/bouncycastle/x509/extension/SubjectKeyIdentifierStructure
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1210)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:5003)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5517)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:677)
at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1912)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: org.springframework.security.saml.metadata.MetadataManager org.springframework.security.saml.web.MetadataController.metadataManager; nested exception is org.springframework.bea
ns.factory.BeanCreationException: Error creating bean with name 'metadata' defined in ServletContext resource [/WEB-INF/securityContext.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/bouncycastle/x509/extension/SubjectKey
IdentifierStructure
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:561)
at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:88)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:331)
... 26 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadata' defined in ServletContext resource [/WEB-INF/securityContext.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/boun
cycastle/x509/extension/SubjectKeyIdentifierStructure
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1574)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1120)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1044)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:942)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:533)
... 28 more
Caused by: java.lang.NoClassDefFoundError: org/bouncycastle/x509/extension/SubjectKeyIdentifierStructure
at org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator.(BasicX509CredentialNameEvaluator.java:90)
at org.springframework.security.saml.metadata.MetadataManager.getTrustEngine(MetadataManager.java:588)
at org.springframework.security.saml.metadata.MetadataManager.initializeProviderFilters(MetadataManager.java:523)
at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:237)
at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86)
at org.springframework.security.saml.metadata.MetadataManager.afterPropertiesSet(MetadataManager.java:142)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1633)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1570)
... 38 more
Caused by: java.lang.ClassNotFoundException: org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1858)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1709)
... 46 more

[jeremykittel]

I found you can get around this by updating the dependent org.opensaml.xmltooling.1.4.1.jar to org.opensaml.xmltooling.1.4.4 resolves the issue when using Bouncy Castle 1.5.4.

[chubbard]

Any chances of this getting done soon? We already use bouncy castle 1.54, and we have trouble downgrading to use saml library. What's the ETA?

[generiscorp]

Any update on it please?

[gstanchev]

BC is at 1.58 with soon to release 1.59, so perhaps the issue needs update.

[chubbard]

Also the 1.59 release has a fix to the latest TLS vulnerability Return Of Bleichenbacher's Oracle Threat (ROBOT). Something to note since 1.58 is vulnerable.