Shibboleth Developers

["Howard Gilbert" <>]

Recently it was discovered that the Sun JAXP parse was not catching errors
in the XML that should have been detected by XSD processing. The parser
generates correct results for a correct configuration file, but does not
report errors for an incorrect file. The problem definitely occurs in the
current J2SE 5.0 Update 4 (a.k.a. JDK 1.5.0_04) and does not appear to have
been reported in their bug database. It is fixed by Xerces 2.7.0 which was
released a few weeks ago and also supports JAXP 1.3. 

This, of course, puts us back in the Endorsed thing. Everyone should
remember how this works. There is an endorsed subdirectory and it gets
copied over to {tomcat}/common/endorsed after deleting any previous contents
of the directory. If you are frustrated with Sun and want to fix it
globally, you can also copy the libraries over to your favorite
{jre}/lib/endorsed (creating this directory).

However, the current checked in version of endorsed contains the closed
source version of the Sun code released with J2SE 5. Figuring that open
source is always better than closed source, especially when it works and the
closed source doesn't work, I figure we probably want to change to use
Xerces.

However, there is a slight problem. The latest version of Xalan is 2.6.0 and
it is currently tested against the previous release of Xerces. This release
of Xalan has worked with Shibboleth in the past and seems to work correctly.


If we are agreed, I will update the shib/endorsed directory to this version
of the Xerces/Xalan libraries.