如何通过POM或WebLogic配置避免应用运行时加载bcprov-jdk16-1.45.jar

Absolutely, you have two reliable approaches to resolve this BouncyCastle (BC) version conflict without modifying the WebLogic server's internal JARs—adjusting the weblogic.xml deployment descriptor or tweaking your Maven POM configuration. Let’s break them down:

1. Force WebLogic to prioritize your WAR's BC version via weblogic.xml #

WebLogic uses a parent-first class loading strategy by default, which means it loads server-provided classes (like the old 1.45 BC) before checking your WAR's WEB-INF/lib. You can override this for BC specifically (or globally) using weblogic.xml:

Option 1a: Target only BouncyCastle classes (recommended) #

This is the safest approach, as it only prioritizes BC classes from your WAR without affecting other WebLogic dependencies. Add this to your WAR's WEB-INF/weblogic.xml:

<weblogic-web-app xmlns="http://xmlns.oracle.com/weblogic/weblogic-web-app"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.7/weblogic-web-app.xsd">
    <container-descriptor>
        <prefer-application-packages>
            <!-- Tell WebLogic to load all BC classes from your WAR first -->
            <package-name>org.bouncycastle.*</package-name>
        </prefer-application-packages>
    </container-descriptor>
</weblogic-web-app>

Option 1b: Global WAR class priority #

If your application doesn’t rely on any WebLogic-specific older APIs, you can enable full WEB-INF class priority. Note this may cause conflicts with other server-provided libraries, so use cautiously:

<weblogic-web-app xmlns="http://xmlns.oracle.com/weblogic/weblogic-web-app"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.7/weblogic-web-app.xsd">
    <container-descriptor>
        <prefer-web-inf-classes>true</prefer-web-inf-classes>
    </container-descriptor>
</weblogic-web-app>

2. Lock down BC dependencies in your Maven POM #

Ensure your build correctly packages BC 1.49 and excludes any accidental old versions from transitive dependencies (like the WebLogic Maven plugin):

Step 1: Explicitly declare BC 1.49 dependencies #

Add these to your POM's <dependencies> section to ensure the correct version is included:

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk15on</artifactId>
    <version>1.49</version>
    <scope>compile</scope>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.49</version>
    <scope>compile</scope>
</dependency>

Step 2: Exclude old BC from WebLogic Maven plugin #

The WebLogic plugin may pull in the 1.45 version transitively—exclude it to prevent contamination:

<build>
    <plugins>
        <plugin>
            <groupId>com.oracle.weblogic</groupId>
            <artifactId>weblogic-maven-plugin</artifactId>
            <version>12.1.3-0-0</version>
            <dependencies>
                <dependency>
                    <groupId>org.bouncycastle</groupId>
                    <artifactId>bcprov-jdk16</artifactId>
                    <version>1.45</version>
                    <exclusions>
                        <exclusion>
                            <groupId>*</groupId>
                            <artifactId>*</artifactId>
                        </exclusion>
                    </exclusions>
                </dependency>
            </dependencies>
        </plugin>
        <!-- Ensure WAR plugin packages all dependencies -->
        <plugin>
            <artifactId>maven-war-plugin</artifactId>
            <version>3.3.2</version>
            <configuration>
                <failOnMissingWebXml>false</failOnMissingWebXml>
                <packagingIncludes>WEB-INF/lib/*.jar</packagingIncludes>
            </configuration>
        </plugin>
    </plugins>
</build>

Verify the fix #

To confirm WebLogic is using your BC version, add a quick check in your application:

import org.bouncycastle.jce.provider.BouncyCastleProvider;

// Call this method somewhere in your app
public void checkBCVersion() {
    BouncyCastleProvider bcProvider = new BouncyCastleProvider();
    System.out.println("Loaded BouncyCastle version: " + bcProvider.getVersion());
}

If the output shows 1.49, your configuration works.

内容的提问来源于stack exchange，提问作者VKP