OpenSAML in 9.1

Question

We use opensaml(www.opensaml.org) for creating saml tokens.Opensaml.jar conforms to the DOM level 3 specification. In WLS 8.1.4 we used the endorsed override mechanism and had the dom3-xercesImpl-2.5.0.jar and dom3-xml-apis-2.5.0.jar in the endorsed directory so that opensaml.jar could use these xml parsers. WL 9.X and higher use the parser and transformer that comes with JDK 1.5(xerces.jar) and that conforms to the DOM 2 specs. And WL 9.X and higher do not even support the endorsed override mechanism. So now when i try to upgrade our app to use WL 9.1, i am not able to log in since the tokens are not getting created and the exception that i get is
java.lang.NoClassDefFoundError: org/apache/xml/utils/WrongParserException
at org.opensaml.SAMLObject.<init>(Unknown Source)
at org.opensaml.SAMLNameIdentifier.<init>(Unknown Source)
at com.ams.csf.auth.CSFSAMLToken.generate(CSFSAMLToken.java:328)
at com.ams.csf.auth.CSFSAMLToken.exportToken(CSFSAMLToken.java:294)
at com.ams.core.security2.auth.servlet.service.AuthServiceServlet.genera
teSecurityToken(AuthServiceServlet.java:96)
Does anyone know how to overcome this problem or is there a way to use any other parser other than the default one that is shipped with JDK1.5

Answer 1

in an article on WLS/SAML integration in dev2dev
"Finally, if your application's security model is completely independent of the WebLogic Security Service, you will not be able to take advantage of WebLogic's SAML tools."
http://dev2dev.bea.com/pub/a/2006/08/introduction-saml.html?page=last
I am also trying to get the opensaml-1.1 implementation to work with WLS9.2 packaged inside the weblogic.jar is an older version of an opensaml implementation. Because weblogic.jar trumps the jars in the lib directory of my webapp, I was forced to put opensaml-1.1.jar in my server classpath. opensaml has a dependency on log4j which is in the lib directory of my webapp. when called from within my code, the log4j calls work flawlessly. However, whenever I use a opensaml api, it complains about log4j not being in the classpath? Can the classes into the classpath not see the classes in the jars in the lib directory?