Upgrading commons-configuration library to latest version

[raj84gopal-git]

Upgrading commons-configuration library to latest version, doesn't work and it fails in SAML Validation while trying to get Idp Login page.

[thomasnymand]

Thanks for the report. A few things to help narrow this down, because the cause likely isn't in the library itself:

oiosaml3.java (OIOSAML 3) does not depend on commons-configuration. There's no reference to it in any POM (not even transitively via OpenSAML 3.4.5) and no source code references it — OIOSAML 3 reads its oiosaml.properties using plain java.util.Properties. So upgrading commons-configuration shouldn't affect anything inside OIOSAML 3 directly; a failure during SAML validation / fetching the IdP login page points more toward a classpath/dependency conflict in the host application (e.g. the upgrade dragged in incompatible commons-lang3 / commons-text / commons-logging versions).

Note that the older OIOSAML 2 (oiosaml2.java) did use commons-configuration, so the answer differs depending on which version you're on.

To investigate, could you share:

1. Which OIOSAML version are you using — oiosaml2.java or oiosaml3.java, and which release?
2. The commons-configuration version you upgraded from → to (and what prompted it, e.g. a CVE)?
3. The full stack trace / error message from the validation failure.
4. Output of mvn dependency:tree (or equivalent) for your application, so we can see how commons-configuration and its transitive deps resolve on your classpath.

With the stack trace and dependency tree we can tell whether this is a version conflict to pin/exclude on your side or something we need to address here.