Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id CDA56200B7E for ; Tue, 6 Sep 2016 16:28:22 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id CC2F1160ACB; Tue, 6 Sep 2016 14:28:22 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id C62A9160AA9 for ; Tue, 6 Sep 2016 16:28:21 +0200 (CEST) Received: (qmail 76365 invoked by uid 500); 6 Sep 2016 14:28:20 -0000 Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list issues@cxf.apache.org Received: (qmail 76229 invoked by uid 99); 6 Sep 2016 14:28:20 -0000 Received: from arcas.apache.org (HELO arcas) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 06 Sep 2016 14:28:20 +0000 Received: from arcas.apache.org (localhost [127.0.0.1]) by arcas (Postfix) with ESMTP id A71B72C1B7B for ; Tue, 6 Sep 2016 14:28:20 +0000 (UTC) Date: Tue, 6 Sep 2016 14:28:20 +0000 (UTC) From: "Colm O hEigeartaigh (JIRA)" To: issues@cxf.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (CXF-6604) Sporadic ClassCastException in AsymmetricBindingHandler#doSignBeforeEncrypt MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 archived-at: Tue, 06 Sep 2016 14:28:23 -0000 [ https://issues.apache.org/jira/browse/CXF-6604?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15467539#comment-15467539 ] Colm O hEigeartaigh commented on CXF-6604: ------------------------------------------ I merged a fix to CXF to only import the Element node if the owning Document does not match that of the request. However, for the IssuedToken use-case, the owning documents won't match anyway... The code in CXF is just a simple DOM call to the JDK, so I think this issue is not a CXF issue. I would try updating both JDK + Tomcat to more recent versions and see if you can reproduce it still... > Sporadic ClassCastException in AsymmetricBindingHandler#doSignBeforeEncrypt > --------------------------------------------------------------------------- > > Key: CXF-6604 > URL: https://issues.apache.org/jira/browse/CXF-6604 > Project: CXF > Issue Type: Bug > Components: WS-* Components > Affects Versions: 3.0.4 > Reporter: Andreas Vallen > > Our application sporadically experiences ClassCastExceptions in a CXF web service client when performing a signature that is required by an AssymetricBinding assertion of a WS-SecurityPolicy. See the stacktrace below. > The fediz-based system is set-up as a relying party similarly to the one found in the wsclientWebapp sample from the fediz distribution. > The system is based on fediz 1.2.0, CXF 3.0.4, Windows Server 2008 R2, java 8u51, tomcat 8.0.23. > {code} > 2015-09-15 14:42:12,171Z WARN [http-apr-443-exec-30] [michael.shultz@sitranov.com] [053e8a73-a64d-4212-b10a-4263c3f9d528] - o.a.c.w.s.w.p.AsymmetricBindingHandler : Sign before encryption failed due to : null > 2015-09-15 14:42:12,187Z WARN [http-apr-443-exec-30] [michael.shultz@sitranov.com] [053e8a73-a64d-4212-b10a-4263c3f9d528] - o.a.cxf.phase.PhaseInterceptorChain : Interceptor for {http://service.ejb.ecs.birn.net/}ECSServiceService#{http://service.ejb.ecs.birn.net/}GetSaltCodes has thrown exception, unwinding now > org.apache.cxf.interceptor.Fault: null > at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.doSignBeforeEncrypt(AsymmetricBindingHandler.java:233) > at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.handleBinding(AsymmetricBindingHandler.java:110) > at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessageInternal(PolicyBasedWSS4JOutInterceptor.java:201) > at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:114) > at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:101) > at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) > at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:516) > at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:425) > at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:326) > at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:279) > at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96) > at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:138) > at com.sun.proxy.$Proxy248.getSaltCodes(Unknown Source) > at net.sitranov.birn.unify.unifyweb.HomeResource.getSaltCodes(HomeResource.java:60) > at sun.reflect.GeneratedMethodAccessor237.invoke(Unknown Source) > at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > at java.lang.reflect.Method.invoke(Method.java:497) > at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181) > at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97) > at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200) > at net.sitranov.birn.unify.unifyweb.AntiXSSInvoker.invoke(AntiXSSInvoker.java:58) > at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:99) > at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59) > at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96) > at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) > at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) > at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:251) > at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234) > at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208) > at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160) > at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:171) > at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:293) > at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doGet(AbstractHTTPServlet.java:217) > at javax.servlet.http.HttpServlet.service(HttpServlet.java:622) > at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:268) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at net.sitranov.birn.unify.unifyweb.security.ManageMDCFilter.doFilterInternal(ManageMDCFilter.java:37) > at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at net.sitranov.birn.unify.unifyweb.UIFilter.doFilter(UIFilter.java:25) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at net.sitranov.birn.unify.unifyweb.security.ResourceFilter.doFilter(ResourceFilter.java:62) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:108) > at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at net.sitranov.birn.unify.unifyweb.security.HttpHeaderFilter.doFilter(HttpHeaderFilter.java:16) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) > at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118) > at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50) > at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144) > at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) > at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) > at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) > at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85) > at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.springframework.boot.context.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:116) > at org.springframework.boot.context.web.ErrorPageFilter.access$000(ErrorPageFilter.java:60) > at org.springframework.boot.context.web.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:91) > at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) > at org.springframework.boot.context.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:109) > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) > at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) > at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) > at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) > at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) > at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) > at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) > at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:617) > at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) > at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518) > at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091) > at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:668) > at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2463) > at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2452) > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) > at java.lang.Thread.run(Thread.java:745) > Caused by: java.lang.ClassCastException: null > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)