seems as we can't get rid of xml-apis on a clean Maven repo. downgrade opensaml. also found one more bouncycastle reference in a jar