philduba.com

1. Download the Apache XML Security library version 1.2.0
2. Unzip the file into a non-web based folder (I defaulted mine to the base drive the CFMX server was on)
3. Download a second file which is an update to the xmlsec.jar file found in the file downloaded in step 1, xmlsec-1.2.96.jar
4. Save the xmlsec-1.2.96.jar file in the libs folder where you extracted the file in step 2 and remove the xmlsec.jar file as having both in the same directory will cause issues
5. The following files should be iin the drive/xml-security-1_2_0/libs directory
   • xmlsec-1.2.96.jar
   • xercesImpl.jar
   • xml-apis.jar
   • xmlParserAPIs.jar
   • commons-logging.jar
   • commons-logging-api.jar
   • xmlsecSamples.jar
6. Add each one of the files listed above to your ColdFusion classpath
7. Restart the ColdFusion server

At this point, you should have the Apache XML Security Library installed and it registered with ColdFusion. Since ColdFusion can access Java objects, one might be tempted to go ahead and perform a CreateObject("java",...) to get at the various classes in the library. This type of logic cannot be done for a variety of reasons, but the two main ones are: ColdFusion's representation of XML is not the same as required by the library and in order to use almost any class in the library, the following must be run: org.apache.xml.security.Init.init(). Unfortunately, the way ColdFusion uses init() on Java objects causes it to call the constructor, in this case Init(), which obviously does not do the same thing and an error will result. So, the end result is that a Java class to accept XML in string representation to sign or verify needs to be built. I will cover this in the next installment as I want to keep this entry specifically related to the Apache XML Security library setup.