[jboss-jira] [JBoss JIRA] (WFLY-3253) CXF should not be installing BouncyCastle

[David Lloyd (JIRA)]

David Lloyd created WFLY-3253:
---------------------------------

             Summary: CXF should not be installing BouncyCastle
                 Key: WFLY-3253
                 URL: https://issues.jboss.org/browse/WFLY-3253
             Project: WildFly
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Web Services
            Reporter: David Lloyd
            Assignee: Alessio Soldano
            Priority: Critical
             Fix For: 8.0.1.Final


CXF installs a BouncyCastle provider globally into the security providers list.  This is causes performance and other problems when this provider gets chosen for whatever reason to be the system crypto provider for e.g. TLS.

The list of globally installed security providers should be a user concern only.  If CXF requires a specific provider for a specific purpose, it should be selecting that provider when constructing the crytpo API object, though generally this is to be discouraged.

Ultimately we want to introduce a configuration in the app server that allows the list of security providers to be specified in some way, without interference from any frameworks that we happen to have installed.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira