commons-codes library 1.4 - 1.5 ?

[Michael Schwartz]

Shib Dev Gurus:

I just wanted to forward you the email from Yuriy Movchan, who is working 
on a Shibboleth authentication plugin for OX. He raises an issue of 
upgrading the commons-codes library from 1.4 to 1.5 in order to fix a bug. 
Any thoughts if that is possible? I think we are going to patch our own 
war, but we'd like to be aligned with the main distribution...

thx,

Mike



------------- Forwarded Message--------------
Date: Wed, 20 Mar 2013 11:40:54 +0200
From: Yuriy Movchan <yure at gluu.org> 
Subject: Problem with getting access token

Hi,



I would like to share experience about oxauth-client.jar integration with
another existing products. Maybe it will save many hours.



I'm trying to make oxauth plugin for shibboleth working.

The main idea was to add oxauth-client.jar and another required libraries
inside idp.war (Shibboleth)



But I got issue with code which request access token. The apache server had
returned error that it can't understand authentication method .. Finally I
realized that request even not reached our tomcat server.



Finally after one day of debugging and verifying the code I understand what
cause the issue. The problem was in next line:

org.xdi.oxauth.client.TokenClient.request.getEncodedCredentials()

It return chunked base64 encoded user:password. But apache required non
chunked string.



This issue appears from commons-codes library. Here are notes from method
encodeBase64String:

@since 1.4 (NOTE:  1.4 chunked the output, whereas 1.5 does not).



But in idp.war there is commons-codes 1.4!

After upgrading this library I resolved this issue.



But I'm not sure that it's good idea to upgrade idp.war libraries.. Maybe in
our client libraries we need to continue to focus on latest libraries but
use only old methods of these libraries. What do you think?



Regards,

Yura