Secured WS works fine in CF8, completely crashes CF9

[fedsol]

We are in the testing phase of a webservice client deployment with a major telecom carrier. They require the SOAP messages to be signed, which is not anything we haven't done 10 times before, and works perfectly fine on our CF8 dev server. However, on the CF9 "new prod" server (not yet in production, thankfully), this webservice invocation literally forces a JRun restart. The error thrown is

java.lang.NoSuchMethodError: org.apache.xpath.compiler.FunctionTable.installFunction(Ljava/lang/String;Lorg/apache/xpath/Expression;)I
    at org.apache.xml.security.Init.registerHereFunction(Init.java:417)
    at org.apache.xml.security.Init.init(Init.java:124)

The error occurs in the Axis layer when running a handler. Both servers are running CF Enterprise standalone. The working one is 32-bit Win2K and the new one is 64-bit Win2008. Old server is CF 8.0.1, new server is CF 9.0.1, both current on hotfixes. I am at my wits end, appreciate any help you can offer.

[fedsol]

So, it looks like CF8 ran Xalan 2.5.1, and CF9 runs Xalan 2.7.1, which is where this class comes from. But this still doesn't make sense - if it's still running Axis 1.2.1 (which it says it is), then theoretically any WS-Security-enabled web service would fail out of the box in CF9, which obviously isn't happening or someone would have noticed. What on Earth am I missing here?

[fedsol]

Ok, I've found that if I replace CF9's xalan.jar with CF8's, (and add wss4j-1.5.8.jar to CF9), this works again. I can't wait to find out what's going to break as a result of downgrading Xalan though.

[JR__Bob__Dobbs]

This is good information.  Thanks for posting your fix.  I would submit this as a bug to Adobe.

http://cfbugs.adobe.com

[fedsol]

I agree that it's nice to have it patched for now, but I can't imagine this is supposed to be how it works. It was fairly easy to run WS-Security secured webservices in CF8; why would CF9 require that I downgrade a component in order for it to work? I wish there was a beta going on to ask this kind of question in.