当XMLSignatureFactory在WSO2-AM中介器中使用时，如何修复ClassCastException？

Question

我已经创建了一个新的WSO2 Api管理器中介器，它将负责过滤签名的SOAP信封。在请求中，我收到一个标签，我想用XMLSignatureFactory解析它。

数字签名接口：https://www.oracle.com/technetwork/articles/javase/dig-signature-api-140772.html

输入：

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                       Id="SIG-1F873A0D2A87BCE8721558280884557279">
            <ds:SignedInfo>
               ...
               <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
               <ds:Reference URI="#id-349F63E22F25E7CF2915581003601374">
                  <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
                  <ds:DigestValue>..Base64 encoded value...</ds:DigestValue>
               </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>..Base64 encoded value...</ds:SignatureValue>
            <ds:KeyInfo Id="KI-1F873A0D2A87BCE8721558280884517277">
               ...
            </ds:KeyInfo>
         </ds:Signature>

源代码：

XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
        // Find Signature element.

        NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        if (nl.getLength() == 0) {
            throw new Exception("Cannot find Signature element");
        }

        // Create a DOMValidateContext and specify a KeySelector
        // and document context.
        DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), nl.item(0));

        // Unmarshal the XMLSignature.
        XMLSignature signature = fac.unmarshalXMLSignature(valContext);

        // Validate the XMLSignature.
        boolean coreValidity = signature.validate(valContext);

        // Check core validation status.
        if (coreValidity == false) {
            System.err.println("Signature failed core validation");
}

在标准的Java SE程序中，它工作得很好，但是当我在Mediator中使用它时，我得到了以下错误：

Exception occured! java.lang.ClassCastException: org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory cannot be cast to javax.xml.crypto.dsig.XMLSignatureFactory
        at javax.xml.crypto.dsig.XMLSignatureFactory.findInstance(XMLSignatureFactory.java:202)
        at javax.xml.crypto.dsig.XMLSignatureFactory.getInstance(XMLSignatureFactory.java:250)

Maven配置：

...
<java.version>1.8</java.version>
        <maven.compiler.source>1.8</maven.compiler.source>
        <maven.compiler.target>1.8</maven.compiler.target>
        <bouncycastle.version>1.61</bouncycastle.version>
...
<dependency>
            <groupId>org.apache.synapse</groupId>
            <artifactId>synapse-core</artifactId>
            <version>2.1.7-wso2v80</version>
        </dependency>
<dependency>
            <groupId>org.apache.ws.commons.axiom.wso2</groupId>
            <artifactId>axiom</artifactId>
            <version>1.2.11.wso2v11</version>
        </dependency>
<dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>
...
<plugin>
                <groupId>org.apache.felix</groupId>
                <artifactId>maven-bundle-plugin</artifactId>
                <version>2.3.7</version>
                <extensions>true</extensions>
                <configuration>
                    <instructions>
                        <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
                        <Bundle-Name>${project.artifactId}</Bundle-Name>
                        <!-- <Export-Package>mediator</Export-Package> -->
                        <!--<DynamicImport-Package>*</DynamicImport-Package>-->
                        <Import-Package>
                            !javax.xml.crypto.*; version="???",
                            org.apache.xml.security;version="0.0.0",
                            *
                        </Import-Package>
                    </instructions>
                </configuration>
            </plugin>

Answer 1

我猜测发生这种情况的原因是，使用wso2 wss4j包导出的package javax.xml.crypto.；version="xxx"与JDK导出的默认javax.xml.crypto.包冲突。

为了克服这个问题，您可以将中介打包为bundle ( OSGI bundle并将其放在dropins文件夹中)，并限制中介中的特定导入，如下所示。

请在osgiConsole (带有-DosgiConsole标志)中启动AM，并检查wss4j导出的javax.xml.crypto.*包的版本。然后从中介器的导入部分中排除该特定版本。

示例代码如下所示。

<plugin>
    <groupId>org.apache.felix</groupId>
    <artifactId>maven-bundle-plugin</artifactId>
    <version>2.3.7</version>
    <extensions>true</extensions>
    <configuration>
        <instructions>
            <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
            <Bundle-Name>${project.artifactId}</Bundle-Name>
            <Import-Package>
                !javax.xml.crypto.*; version="xxx",
                org.apache.xml.security;version="0.0.0",
                *
            </Import-Package>
        </instructions>
    </configuration>
</plugin>

谢谢