<div dir="ltr"><div class="gmail_default" style="font-family:courier new,monospace">Hi Everyone,<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">Reading the recient security issue it sounds like we can be relitivly safe if we stay on 2.4.2 but follow the instructions in the "Recommendations" Section, however after modifying the internal.xml file<br>----------<br><entry><br><key><br><value><a href="http://apache.org/xml/properties/security-manager">http://apache.org/xml/properties/security-manager</a></value><br></key><br><bean id="shibboleth.XercesSecurityManager" class="com.sun.org.apache.xerces.internal.util.SecurityManager"/><br></entry><br>----------<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">We get the startup error in the catalina.out file:<br>----------<br>Caused by: javax.xml.parsers.FactoryConfigurationError: Provider org.apache.xerces.jaxp.SAXParserFactoryImpl not found<br>----------<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">I've been poking around but have not found any config sections that looks like it allows me to change that particular class from/to:<br>org.apache.xerces.jaxp.SAXParserFactoryImpl<br>com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">However barring that will the tomcat configuration of not allowing more than 100k POST sizes also fix the issue until we have a chance to get to IdPv3? It wasn't clear if the two config changes needed to be made to mitigate the issue or if the post size reduction would be enough for now.<br></div><div class="gmail_default" style="font-family:courier new,monospace"><br></div><div class="gmail_default" style="font-family:courier new,monospace"><br clear="all"></div><div><div class="gmail_signature"><div dir="ltr"><font face="courier new, monospace">Jeffrey E. Crawford<br></font><br><div><font face="courier new, monospace">Both pilots and IT professionals require training and currency before charging into clouds!<br></font></div><div><font face="courier new, monospace">---------------------------------------</font></div></div></div></div>
</div>