eclipse-ee4j / eclipse-ee4j/metro-wsit
Remove usage of the RSA/NONE/OAEPPADDING algorithm from WSIT.
- Dominant language
- Java
- Stars
- 6
- Forks
- 21
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 1
Description
Sometime between update 21 and update 25 of JDK7, Oracle removed the RSA/NONE/OAEPPADDING algorithm:
[http://stackoverflow.com/questions/17207491/after-update-to-java7u25-from-java7u21-jax-ws-client-of-my-program-throws-cannot](http://stackoverflow.com/questions/17207491/after-update-to-java7u25-from-java7u21-jax-ws-client-of-my-program-throws-cannot)
Unlike CXF, WSIT is still using this algorithm, requiring Metro users to now have to install the Bouncy Castle JAR and make both client- and service-side changes in order to bring it in: [http://stackoverflow.com/a/17318843](http://stackoverflow.com/a/17318843). A better solution would be for WSIT to stop using this algorithm so it's no longer necessary to download BouncyCastle.
This matter can be replicated using my metro_ut_messagelayer sample ([http://www.jroller.com/gmazza/entry/usernametoken_messagelayer_encryption](http://www.jroller.com/gmazza/entry/usernametoken_messagelayer_encryption)), runnable via the following:
1.) Clone my blogsamples at [https://github.com/gmazza/blog-samples](https://github.com/gmazza/blog-samples) and do an mvn clean install -Dmaven.test.skip from the root folder.
2.) Navigate to metro_ut_messagelayer and run mvn tomcat7:run-war
3.) Navigate in a separate tab window to metro_ut_messagelayer/client and run mvn exec:exec. You'll see the error message quite similar to the one in the StackOverflow link above.
#### Affected Versions
[2.3]
Source: [https://github.com/javaee/metro-wsit/issues/1680](https://github.com/javaee/metro-wsit/issues/1680)
Author: glassfishrobot
Contributor guide
Research direction
Reproduce the failure with the metro_ut_messagelayer sample: run mvn clean install -Dmaven.test.skip from blogsamples, then mvn tomcat7:run-war and mvn exec:exec in the client directory. Search WSIT for RSA/NONE/OAEPPADDING and verify the sample no longer requires Bouncy Castle or fails with the reported algorithm error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100