xml-apis dependency causes sax parser exception in tomcqt with java security mgr enabled

[Shawn McKinney <sm...@apache.org>]

Hello,

This is an FYI not a bug (yet)...

The ldap api has a dependency on xml-apis jar.  I can verify this by running mvn dependency:tree

[INFO] |  |     +- org.apache.directory.api:api-all:jar:1.0.0:compile
[INFO] |  |     |  +- xml-apis:xml-apis:jar:1.0.b2:compile

Which causes trouble when the Fortress Realm is runnning inside tomcat with java security manager enabled.  Here's the exception reported in tomcat logs:

Caused by: javax.xml.parsers.FactoryConfigurationError: Provider for javax.xml.parsers.SAXParserFactory cannot be found

I can work around it by adding an exclusion to the fortress core's pom file:

    <dependency>
      <groupId>org.apache.directory.api</groupId>
      <artifactId>api-all</artifactId>
      <version>${version.api.all}</version>
      <type>jar</type>
      <exclusions>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

It's worth noting this issue first appeared when running tomcat with -security enabled.  Not sure if others using the api have experienced similar difficulties in Tomcat.  

I've still got some more testing / investigating to do before commiting the change or providing recommendations wrt change to api, if any.  We shall see.

Thanks

Shawn

Re: xml-apis dependency causes sax parser exception in tomcqt with java security mgr enabled

[Shawn McKinney <sm...@apache.org>]

> On Sep 16, 2017, at 5:19 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
> 
> I assume that's because api-all also contains the DSML engine and
> parser. If you don't need them in Fortress you can try to only use
> dependency api-ldap-client-all instead of api-all.

Yes that could work if fortress wasn’t pulling in another dependency,

    <dependency>
      <groupId>org.openldap</groupId>
      <artifactId>accelerator-impl</artifactId>
      <version>${version.accelerator.impl}</version>
    </dependency>

that is itself dependent on the api-all.  Guess who’s code that is?  :-)  And we haven’t had a new release in a few years there.  

But I did run some tests anyway and it ’should' work once I get the other transitive dependencies cleaned up.

Thanks for weighing in

Shawn

Re: xml-apis dependency causes sax parser exception in tomcqt with java security mgr enabled

[Stefan Seelmann <ma...@stefan-seelmann.de>]

On 09/16/2017 11:40 PM, Shawn McKinney wrote:
> Hello,
> 
> This is an FYI not a bug (yet)...
> 
> The ldap api has a dependency on xml-apis jar.  I can verify this by running mvn dependency:tree
> 
> [INFO] |  |     +- org.apache.directory.api:api-all:jar:1.0.0:compile
> [INFO] |  |     |  +- xml-apis:xml-apis:jar:1.0.b2:compile

I assume that's because api-all also contains the DSML engine and
parser. If you don't need them in Fortress you can try to only use
dependency api-ldap-client-all instead of api-all.

Kind Regards,
Stefan