SecurityManager and JBoss EAP6.4

[Roehrl Patrick]

Hello everyone,

I'm in the process of upgrading from IdP V2.4.1 to V3.1.2 and I want to remove all Xerces dependencies like described in the Security Advisory (https://shibboleth.net/community/advisories/secadv_20141103.txt).
Therefore I added in the jboss-deployment-structure the following exclusion:
<exclusions>
...
<module name="org.apache.xerces" />
</exclusions>
To test it I changed the idp.xml.securityManager to org.apache.xerces.util.SecurityManager (in system/conf/global-system.xml). When I started the JBoss I got a ClassNotFoundException for org.apache.xerces.util.SecurityManager, so I think xerces should be successfully removed.

Afterwards I changed the securityManager back to com.sun.org.apache.xerces.internal.util.SecurityManager.
When I started the JBoss again I got an ClassNotFoundException for com.sun.org.apache.xerces.internal.util.SecurityManager.
After some research I found out that the JBoss doesn't load all classes from rt.jar.
Then I've added the package in the jboss-deployment-structure with:
<system>
<paths>
                        <path name="com/sun/org/apache/xerces/internal/util"/>
            </paths>
</system>
When I now start the server I get a class cast exception:
com.sun.org.apache.xerces.internal.util.SecurityManager cannot be cast to org.apache.xerces.util.SecurityManager

I've already did a lot of research (amongst others http://shibboleth.1660669.n2.nabble.com/deploying-the-current-Shib-v3-snapshot-on-Tomcat-td7606346.html )
Scott mentioned there "If you carry over a container that was endorsing Xeces/Xalan, then it would throw. If not, it won't."
But I think I've excluded Xerces already...
Perhaps some of you already deployed the IdP without Xerces on the JBoss.
What am I missing? Or has someone a hint what I can try or what I'm doing wrong?

Thanks a lot for your help!

Patrick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150717/066cdc63/attachment.html>