OpenSAML user discussion

["Scott Cantor" <>]

> Hmm any thoughts on if there is a way I could package an alternative JAXP 
> 1.3 implementation with my servlet or any other approaches?

Here's the bottom line...

The only JAXP 1.3 code that doesn't leak or break when using OpenSAML that I
know of is a recent Xerces version.

The 1.5 JDK comes with JAXP 1.3 with a leaky Sun parser.

The 1.4 JDK comes with older JAXP that requires endorsement of Xerces to
even use at all.

Nothing that breaks in the presence of endorsed Xerces ought to run with JDK
1.5 anyway, since that has an even more broken version. So I'm guessing
you're using JDK 1.4, in which case I refer to the item above; you can't use
the SAML code on 1.4 without endorsing.

The selection of the JAXP code is AFAIK a container-wide selection, but if
it's not, there is a way on JDK 1.5 to get the JAXP code replaced without
endorsement (not true of 1.4). However, Xerces has/had bugs that prevent
that non-endorsed approach from working right, and I don't know when/if they
got fixed.

-- Scott