Java 仅当Tomcat按特定顺序部署时：无法初始化类org.apache.wss4j.stax.setup.WSSec

在发布之前，我已经在互联网上搜索了一个解决方案，我没有发现任何有助于我的案例的东西

我有一个Tomcat（9.0.5）实例，它包含两个webapp，我们称它们为webapp

foo

和webapp

bar

。这些Web应用程序是使用Maven 3.5.3编译的

foo

包括一个Maven依赖项：

org.apache.wss4j:wss4j ws-security stax:jar:2.2.4

。这个Java库也包含在

foo

的

WEB-INF/lib

目录中，打包在它自己的.war文件中（Maven构建过程似乎很好）

foo

使用CXF 3.3.5和WSS4J 2.2.4

Webapp

bar

不包括org.apache.wss4j:wss4j ws-security stax:jar:2.2.4

我必须在同一个Tomcat实例下部署这两个webapps，所以我将它们上传到

${catalina.base}/webapps

下，然后运行Tomcat

如果Tomcat先部署

foo

webapp，就不会出什么问题

如果Tomcat首先部署

bar

webapp，则会出现以下错误：

Could not load or register WS-SecurityPolicy related classes. Please check that (the correct version of) Apache WSS4J is on the classpath: Could not initialize class org.apache.wss4j.stax.setup.WSSec

我快疯了。基于其他主题，我找到了执行Tomcat部署顺序的方法，但老实说，我不喜欢那个解决方案。在我看来，这是一种错误的做法

我没有在Tomcat类路径上设置自定义，我不理解为什么会发生这种情况。您可以在

mvn依赖关系的结果下方进行微调：tree

of

foo

和

bar

酒吧：

在此之后，我得到了以下错误：

Could not load or register WS-SecurityPolicy related classes. Please check that (the correct version of) Apache WSS4J is on the classpath: org/apache/xml/security/exceptions/XMLSecurityException

---

这似乎是相同的错误，但在另一个类上。

可能是委托和类加载器优先级的问题。在java中，类从自己的类加载器和更高层次结构中解析自己的依赖项。这可能导致应用程序中的类被忽略，即使它们包含在war中。尝试使用classloader的委托设置。详细说明：

---

非常感谢您的帮助。我更改了加载程序delegate=“true”。我在另一个类上遇到了相同的错误：

无法加载或注册与WS-SecurityPolicy相关的类。请检查Apache WSS4J的（正确版本）是否在类路径上：org/Apache/xml/security/exceptions/XMLSecurityException

通常您应该将xml相关的类与您的webapp捆绑在一起-servlet容器可能有自己的版本，这与您的不兼容。

[INFO] -------------------< foo >--------------------
[INFO] Building foo
[INFO] --------------------------------[ war ]---------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ bar-war ---
[INFO] foo.modules:bar-war:war:1.0.0
[INFO] +- foo.modules:bar-notier-core:jar:1.0.0:compile
[INFO] |  +- javax.servlet:servlet-api:jar:2.5:compile
[INFO] |  +- com.sun.jersey:jersey-server:jar:1.17.1:compile
[INFO] |  |  \- com.sun.jersey:jersey-core:jar:1.17.1:compile
[INFO] |  +- com.sun.jersey.contribs:jersey-guice:jar:1.11:compile
[INFO] |  |  +- javax.inject:javax.inject:jar:1:compile
[INFO] |  |  \- com.sun.jersey:jersey-servlet:jar:1.11:compile
[INFO] |  +- foo.modules:bar-notier-integration:jar:1.0.0:compile
[INFO] |  +- org.apache.commons:commons-dbcp2:jar:2.2.0:compile
[INFO] |  |  \- org.apache.commons:commons-pool2:jar:2.5.0:compile
[INFO] |  +- no.difi.oxalis:bar-outbound:jar:4.1.1:compile
[INFO] |  |  +- no.difi.oxalis:bar-document-sniffer:jar:4.1.1:compile
[INFO] |  |  |  \- no.difi.vefa:peppol-icd:jar:1.1.3:compile
[INFO] |  |  +- no.difi.vefa:peppol-lookup:jar:1.1.3:compile
[INFO] |  |  |  +- no.difi.commons:commons-busdox:jar:0.9.5:compile
[INFO] |  |  |  +- no.difi.commons:commons-bdx:jar:0.9.5:compile
[INFO] |  |  |  \- dnsjava:dnsjava:jar:2.1.9:compile
[INFO] |  |  \- no.difi.vefa:peppol-security:jar:1.1.3:compile
[INFO] |  |     \- no.difi.commons:commons-certvalidator:jar:2.2.0:compile
[INFO] |  |        \- net.klakegg.pkix:pkix-ocsp:jar:0.9.0:compile
[INFO] |  +- no.difi.oxalis:bar-commons:jar:4.1.1:compile
[INFO] |  +- com.google.inject.extensions:guice-servlet:jar:4.2.2:compile
[INFO] |  +- commons-io:commons-io:jar:1.3.2:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.26:compile
[INFO] |  +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  |  \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] |  \- javax.transaction:jta:jar:1.1:compile
[INFO] +- foo.modules:bar-rest:jar:1.0.0:compile
[INFO] |  \- org.apache.httpcomponents:httpclient:jar:4.5.6:compile
[INFO] |     +- org.apache.httpcomponents:httpcore:jar:4.4.10:compile
[INFO] |     \- commons-codec:commons-codec:jar:1.11:compile
[INFO] +- javax.servlet:javax.servlet-api:jar:4.0.1:provided
[INFO] +- no.difi.oxalis:bar-as4:jar:4.1.9:compile
[INFO] |  +- org.apache.cxf:cxf-core:jar:3.3.5:compile
[INFO] |  |  +- org.glassfish.jaxb:jaxb-runtime:jar:2.3.2:compile
[INFO] |  |  |  +- org.glassfish.jaxb:txw2:jar:2.3.2:compile
[INFO] |  |  |  +- com.sun.istack:istack-commons-runtime:jar:3.0.8:compile
[INFO] |  |  |  +- org.jvnet.staxex:stax-ex:jar:1.8.1:compile
[INFO] |  |  |  \- com.sun.xml.fastinfoset:FastInfoset:jar:1.2.16:compile
[INFO] |  |  +- com.fasterxml.woodstox:woodstox-core:jar:5.0.3:compile
[INFO] |  |  |  \- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
[INFO] |  |  \- org.apache.ws.xmlschema:xmlschema-core:jar:2.2.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-security:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-bindings-soap:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-databinding-jaxb:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-wsdl:jar:3.3.5:compile
[INFO] |  |  +- wsdl4j:wsdl4j:jar:1.6.3:compile
[INFO] |  |  \- org.ow2.asm:asm:jar:7.1:compile
[INFO] |  +- org.apache.cxf:cxf-rt-features-logging:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-frontend-jaxws:jar:3.3.5:compile
[INFO] |  |  +- xml-resolver:xml-resolver:jar:1.2:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.3.5:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-frontend-simple:jar:3.3.5:compile
[INFO] |  |  \- org.apache.cxf:cxf-rt-ws-addr:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-transports-http:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-ws-policy:jar:3.3.5:compile
[INFO] |  +- org.apache.cxf:cxf-rt-ws-security:jar:3.3.5:compile
[INFO] |  |  +- org.apache.cxf:cxf-rt-security-saml:jar:3.3.5:compile
[INFO] |  |  +- net.sf.ehcache:ehcache:jar:2.10.6:compile
[INFO] |  |  +- org.apache.wss4j:wss4j-ws-security-stax:jar:2.2.4:compile
[INFO] |  |  |  \- org.apache.wss4j:wss4j-bindings:jar:2.2.4:compile
[INFO] |  |  \- org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.2.4:compile
[INFO] |  +- org.apache.wss4j:wss4j-ws-security-common:jar:2.2.4:compile
[INFO] |  |  +- org.apache.santuario:xmlsec:jar:2.1.4:compile
[INFO] |  |  +- org.opensaml:opensaml-saml-impl:jar:3.3.0:compile
[INFO] |  |  |  +- org.opensaml:opensaml-profile-api:jar:3.3.0:compile
[INFO] |  |  |  |  \- org.opensaml:opensaml-core:jar:3.3.0:compile
[INFO] |  |  |  |     \- io.dropwizard.metrics:metrics-core:jar:3.1.2:compile
[INFO] |  |  |  +- org.opensaml:opensaml-saml-api:jar:3.3.0:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-xmlsec-api:jar:3.3.0:compile
[INFO] |  |  |  |  \- org.opensaml:opensaml-soap-api:jar:3.3.0:compile
[INFO] |  |  |  +- org.opensaml:opensaml-security-impl:jar:3.3.0:compile
[INFO] |  |  |  |  \- org.opensaml:opensaml-security-api:jar:3.3.0:compile
[INFO] |  |  |  |     \- org.cryptacular:cryptacular:jar:1.1.1:compile
[INFO] |  |  |  +- org.opensaml:opensaml-xmlsec-impl:jar:3.3.0:compile
[INFO] |  |  |  \- net.shibboleth.utilities:java-support:jar:7.3.0:compile
[INFO] |  |  +- org.opensaml:opensaml-xacml-impl:jar:3.3.0:compile
[INFO] |  |  |  \- org.opensaml:opensaml-xacml-api:jar:3.3.0:compile
[INFO] |  |  +- org.opensaml:opensaml-xacml-saml-impl:jar:3.3.0:compile
[INFO] |  |  |  \- org.opensaml:opensaml-xacml-saml-api:jar:3.3.0:compile
[INFO] |  |  \- org.jasypt:jasypt:jar:1.9.3:compile
[INFO] |  +- org.apache.wss4j:wss4j-ws-security-dom:jar:2.2.4:compile
[INFO] |  +- org.apache.wss4j:wss4j-policy:jar:2.2.4:compile
[INFO] |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
[INFO] |  +- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
[INFO] |  \- org.apache.neethi:neethi:jar:3.1.1:compile
[INFO] +- foo.modules:bar-notier-rest-server:jar:1.0.0:compile
[INFO] +- no.difi.oxalis:bar-inbound:jar:4.1.1:compile
[INFO] |  +- com.google.guava:guava:jar:27.0.1-jre:compile
[INFO] |  |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] |  |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] |  |  +- org.checkerframework:checker-qual:jar:2.5.2:compile
[INFO] |  |  +- com.google.errorprone:error_prone_annotations:jar:2.2.0:compile
[INFO] |  |  +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
[INFO] |  |  \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.17:compile
[INFO] |  +- joda-time:joda-time:jar:2.10.1:compile
[INFO] |  +- no.difi.oxalis:bar-as2:jar:4.1.1:compile
[INFO] |  |  \- javax.mail:mail:jar:1.4.7:compile
[INFO] |  +- org.bouncycastle:bcmail-jdk15on:jar:1.57:compile
[INFO] |  |  +- org.bouncycastle:bcprov-jdk15on:jar:1.57:compile
[INFO] |  |  \- org.bouncycastle:bcpkix-jdk15on:jar:1.57:compile
[INFO] |  \- io.opentracing.contrib:opentracing-web-servlet-filter:jar:0.2.2:compile
[INFO] |     +- io.opentracing:opentracing-api:jar:0.33.0:compile
[INFO] |     \- io.opentracing:opentracing-util:jar:0.31.0:compile
[INFO] +- foo.modules:bar-quartz:jar:1.0.0:compile
[INFO] |  \- org.quartz-scheduler:quartz:jar:2.2.1:compile
[INFO] |     \- c3p0:c3p0:jar:0.9.1.1:compile
[INFO] +- foo.modules:bar-persist:jar:1.0.0:compile
[INFO] |  +- javax.mail:javax.mail-api:jar:1.5.6:compile
[INFO] |  +- org.quartz-scheduler:quartz-jobs:jar:2.2.1:compile
[INFO] |  +- com.google.code.gson:gson:jar:2.2.2:compile
[INFO] |  +- no.difi.oxalis:bar-api:jar:4.1.1:compile
[INFO] |  |  \- no.difi.vefa:peppol-common:jar:1.1.3:compile
[INFO] |  +- org.slf4j:jcl-over-slf4j:jar:1.7.26:compile
[INFO] |  +- com.google.inject:guice:jar:4.2.2:compile
[INFO] |  |  \- aopalliance:aopalliance:jar:1.0:compile
[INFO] |  +- no.difi.vefa:peppol-mode:jar:1.1.3:compile
[INFO] |  |  \- com.typesafe:config:jar:1.3.4:compile
[INFO] |  +- no.difi.vefa:peppol-sbdh:jar:1.1.3:compile
[INFO] |  |  \- no.difi.commons:commons-sbdh:jar:0.9.5:compile
[INFO] |  +- no.difi.vefa:peppol-evidence:jar:1.1.3:compile
[INFO] |  +- io.zipkin.brave:brave:jar:5.6.5:compile
[INFO] |  |  +- io.zipkin.zipkin2:zipkin:jar:2.14.2:compile
[INFO] |  |  \- io.zipkin.reporter2:zipkin-reporter:jar:2.8.4:compile
[INFO] |  +- io.zipkin.reporter2:zipkin-sender-urlconnection:jar:2.7.10:compile
[INFO] |  +- io.opentracing:opentracing-noop:jar:0.33.0:compile
[INFO] |  +- io.opentracing.contrib:opentracing-apache-httpclient:jar:0.1.0:compile
[INFO] |  +- io.opentracing.contrib:opentracing-spanmanager:jar:0.0.5:compile
[INFO] |  \- io.opentracing.brave:brave-opentracing:jar:0.33.7:compile
[INFO] +- org.projectlombok:lombok:jar:1.18.4:provided
[INFO] \- org.kohsuke.metainf-services:metainf-services:jar:1.8:provided

    <Loader delegate="true" />

Could not load or register WS-SecurityPolicy related classes. Please check that (the correct version of) Apache WSS4J is on the classpath: org/apache/xml/security/exceptions/XMLSecurityException