You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by John Hite <jh...@appsecinc.com> on 2009/04/03 20:42:54 UTC
When does 2.2 need wss4j?
I'm trying to upgrade from 2.1.4 to 2.2. In 2.2, if I don't include wss4j on my classpath I get a java.lang.ClassNotFoundException: org.apache.ws.security.handler.WSHandler. This was not required in 2.1.4. Is wss4j always required in 2.2 or only in certain situations? I am not using any ws-security features in my webapp.
Thanks,
John
RE: When does 2.2 need wss4j?
Posted by John Hite <jh...@appsecinc.com>.
Here's the jira. Sorry for taking a while to get to it. It's been a crazy week.
https://issues.apache.org/jira/browse/CXF-2162
Thanks,
John
-----Original Message-----
From: Daniel Kulp [mailto:dkulp@apache.org]
Sent: Friday, April 03, 2009 5:21 PM
To: users@cxf.apache.org
Cc: John Hite
Subject: Re: When does 2.2 need wss4j?
Hmm.... To support the ws-securitypolicy/ws-secconv/ws-trust stuff, 2.2
will automatically register a bunch of policies and handlers with the policy
runtime at startup. It looks like one of those is definitely requiring the
wss4j jar on the classpath. Can you log a JIRA "improvement"? We could
probably check if wss4j is available and not register them if not.
You CAN workaround this by switching from the bigger cxf jar and substitute in
the smaller module jars. If you do that, you can probably strip out a ton of
stuff you aren't using (policy runtime, security, various transports and
bindings, etc....) which would reduce memory footprint and help the startup
time.
Dan
On Fri April 3 2009 2:42:54 pm John Hite wrote:
> I'm trying to upgrade from 2.1.4 to 2.2. In 2.2, if I don't include wss4j
> on my classpath I get a java.lang.ClassNotFoundException:
> org.apache.ws.security.handler.WSHandler. This was not required in 2.1.4.
> Is wss4j always required in 2.2 or only in certain situations? I am not
> using any ws-security features in my webapp.
>
> Thanks,
> John
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
Re: When does 2.2 need wss4j?
Posted by Daniel Kulp <dk...@apache.org>.
Hmm.... To support the ws-securitypolicy/ws-secconv/ws-trust stuff, 2.2
will automatically register a bunch of policies and handlers with the policy
runtime at startup. It looks like one of those is definitely requiring the
wss4j jar on the classpath. Can you log a JIRA "improvement"? We could
probably check if wss4j is available and not register them if not.
You CAN workaround this by switching from the bigger cxf jar and substitute in
the smaller module jars. If you do that, you can probably strip out a ton of
stuff you aren't using (policy runtime, security, various transports and
bindings, etc....) which would reduce memory footprint and help the startup
time.
Dan
On Fri April 3 2009 2:42:54 pm John Hite wrote:
> I'm trying to upgrade from 2.1.4 to 2.2. In 2.2, if I don't include wss4j
> on my classpath I get a java.lang.ClassNotFoundException:
> org.apache.ws.security.handler.WSHandler. This was not required in 2.1.4.
> Is wss4j always required in 2.2 or only in certain situations? I am not
> using any ws-security features in my webapp.
>
> Thanks,
> John
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog