eclipse-ee4j / eclipse-ee4j/metro-wsit

Remove usage of the RSA/NONE/OAEPPADDING algorithm from WSIT.

Open
#382 0 comments 0 reactions 0 assignees View on GitHub
Component: security ERR: Assignee Priority: Major Type: Improvement
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

Sometime between update 21 and update 25 of JDK7, Oracle removed the RSA/NONE/OAEPPADDING algorithm:
[http://stackoverflow.com/questions/17207491/after-update-to-java7u25-from-java7u21-jax-ws-client-of-my-program-throws-cannot](http://stackoverflow.com/questions/17207491/after-update-to-java7u25-from-java7u21-jax-ws-client-of-my-program-throws-cannot)

Unlike CXF, WSIT is still using this algorithm, requiring Metro users to now have to install the Bouncy Castle JAR and make both client- and service-side changes in order to bring it in: [http://stackoverflow.com/a/17318843](http://stackoverflow.com/a/17318843). A better solution would be for WSIT to stop using this algorithm so it's no longer necessary to download BouncyCastle.

This matter can be replicated using my metro_ut_messagelayer sample ([http://www.jroller.com/gmazza/entry/usernametoken_messagelayer_encryption](http://www.jroller.com/gmazza/entry/usernametoken_messagelayer_encryption)), runnable via the following:
1.) Clone my blogsamples at [https://github.com/gmazza/blog-samples](https://github.com/gmazza/blog-samples) and do an mvn clean install -Dmaven.test.skip from the root folder.
2.) Navigate to metro_ut_messagelayer and run mvn tomcat7:run-war
3.) Navigate in a separate tab window to metro_ut_messagelayer/client and run mvn exec:exec. You'll see the error message quite similar to the one in the StackOverflow link above.
#### Affected Versions
[2.3]

Source: [https://github.com/javaee/metro-wsit/issues/1680](https://github.com/javaee/metro-wsit/issues/1680)
Author: glassfishrobot

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the metro_ut_messagelayer sample: run mvn clean install -Dmaven.test.skip from blogsamples, then mvn tomcat7:run-war and mvn exec:exec in the client directory. Search WSIT for RSA/NONE/OAEPPADDING and verify the sample no longer requires Bouncy Castle or fails with the reported algorithm error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend-api-design, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.