OpenSAML/Spring安全設置重新部署在Tomcat上

Question

我們使用Tomcat 6.0.35在OpenJDK IcedTea6 1.13.6上運行Web應用程序。對於SSO，我們使用基於OpenSAML 2.6.1的Spring安全SAML擴展。

當重新部署我們的應用程序（無需重新啓動Tomcat的），我得到一個 NoClassDefFoundError的：組織/ BouncyCastle的/密碼/墊襯/ ISO10126d2Padding 這是非常漂亮的描述here。從Eclipse MAT分析中，我瞭解到BouncyCastleProvider或JCERSAPublicKey可以防止WebappClassLoader被佔用。

如何配置SAML以便所有（充氣城堡）實例都被正確銷燬？我很難相信SAML是這樣設計的，即部署要求Tomcat重啓。

我目前的配置： ...

<bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"> 
    <property name="logErrors" value="true"/> 
    <property name="logMessages" value="true"/> 
</bean> 

<bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"> 
    <constructor-arg value="classpath:security/samlKeystore.jks"/> 
    <constructor-arg type="java.lang.String" value="mypassword"/> 
    <constructor-arg> 
     <map> 
      <entry key="tenzingfaces" value="keyphrase"/> 
     </map> 
    </constructor-arg> 
    <constructor-arg type="java.lang.String" value="tenzingfaces"/> 
</bean> 

<bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"> 
    <property name="defaultProfileOptions"> 
     <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"> 
      <property name="binding" value="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/> 
      <property name="includeScoping" value="false"/> 
     </bean> 
    </property> 
</bean> 

<bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/> 

<bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"> 
    <property name="userDetails" ref="samlUserDetailService" /> 
    <property name="forcePrincipalAsString" value="false" /> 
</bean> 

<bean id="samlUserDetailService" class="ch.umbrella.springframework.security.SamlUserDetailsServiceImpl" /> 

<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/> 

<bean id="samlSuccessRedirectHandler" class="ch.umbrella.springframework.security.SsoAuthenticationSuccessHandler" > 
    <property name="defaultTargetUrl" value="/main.html" /> 
    <property name="alwaysUseDefaultTargetUrl" value="false" /> 
    <property name="credentialsExpiredUrl" value="/credentialsexpired.html" /> 
</bean> 
<bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"> 
    <property name="authenticationManager" ref="authenticationManager"/> 
    <property name="authenticationSuccessHandler" ref="samlSuccessRedirectHandler"/> 
</bean> 

<bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"> 
    <constructor-arg> 
     <list> 
      <ref bean="redirectBinding"/> 
      <ref bean="postBinding"/> 
     </list> 
    </constructor-arg> 
</bean> 

<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/> 
<bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/> 
<bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/> 
<bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/> 

<bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding"> 
    <constructor-arg ref="parserPool"/> 
    <constructor-arg ref="velocityEngine"/> 
</bean> 

<bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/> 

<bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding"> 
    <constructor-arg ref="parserPool"/> 
</bean> 

<bean class="org.springframework.security.saml.SAMLBootstrap"/> 

<bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" scope="singleton" init-method="initialize"/> 
<bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder" scope="singleton"/> 
...  

而且，在一個特定的臨時文件：

<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"> 
    <constructor-arg> 
     <list> 
      <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate" destroy-method="destroy"> 
       <constructor-arg> 
        <bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider" destroy-method="destroy"> 
         <constructor-arg ref="timer1" /> 
         <constructor-arg> 
          <bean class="org.opensaml.util.resource.ClasspathResource"> 
           <constructor-arg value="/security/idp.xml"/> 
          </bean> 
         </constructor-arg> 
         <property name="parserPool" ref="parserPool"/> 
        </bean> 
       </constructor-arg> 
       <constructor-arg> 
        <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"> 
        </bean> 
       </constructor-arg> 
      </bean> 
      <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate" destroy-method="destroy"> 
       <constructor-arg> 
        <bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider" destroy-method="destroy"> 
         <constructor-arg ref="timer2" /> 
         <constructor-arg> 
          <bean class="org.opensaml.util.resource.ClasspathResource"> 
           <constructor-arg value="/security/localhost_sp.xml"/> 
          </bean> 
         </constructor-arg> 
         <property name="parserPool" ref="parserPool"/> 
        </bean> 
       </constructor-arg> 
       <constructor-arg> 
        <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"> 
         <property name="local" value="true"/> 
         <property name="securityProfile" value="metaiop"/> 
         <property name="sslSecurityProfile" value="pkix"/> 
         <property name="signMetadata" value="true"/> 
         <property name="signingKey" value="tenzingfaces"/> 
         <property name="encryptionKey" value="tenzingfaces"/> 
         <property name="requireArtifactResolveSigned" value="false" /> 
         <property name="requireLogoutRequestSigned" value="false" /> 
         <property name="requireLogoutResponseSigned" value="false" /> 
         <property name="idpDiscoveryEnabled" value="false" /> 
        </bean> 
       </constructor-arg> 
      </bean> 
     </list> 
    </constructor-arg> 
    <property name="hostedSPName" value="https://hurricane.umbrellanet.ch/uf-test/saml/metadata" /> 
</bean> 

謝謝 西蒙

Answer 1

如果你在你的戰爭中捆綁了bouncycastle罐子，那麼不要那樣做。而是把這些罐子放在tomcat/lib中。希望這可以解決它。