Hello, I'm testing out Apache Karaf 4.5.0 on main. I'm currently using Apache Aries for the JAX-RS Whiteboard impl. This includes the features:
aries-jax-rs-whiteboard-jackson aries-jax-rs-whiteboard-openapi aries-jax-rs-whiteboard-shiro I also have a CXF phase interceptor which will convert the shiro subject to a JAAS subject and validate using the Karaf Service Guard (since my REST API injects a core where all methods are guarded). This via the org.apache.karaf.service.acl.myapi.cfg. This let's my centralize authc/authz for both the karaf commands / REST api. The upgrade in Pax Web means javax.servlet is no longer exported and I'm not sure what the future of the whiteboard pattern with aries is here? I did find this repository: https://github.com/eclipse-osgi-technology/jakartarest-osgi samples of what I'm doing below. I moved to Subject.callAs from Java 21 forward: @Component(service = Application.class) @ApplicationPath(ApiApplication.NAME) @JaxrsApplicationBase(ApiApplication.NAME) @JaxrsName(ApiApplication.NAME) --- @Component(service = ObjectsResource.class, scope = ServiceScope.PROTOTYPE) @JaxrsResource @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) @JSONRequired --- @Component(service = Feature.class) @Provider @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) @JaxrsExtension public class JaasSubjectDoAsFeature extends AbstractFeature { @Override protected void initializeProvider(final InterceptorProvider provider, final Bus bus) { provider.getInInterceptors().add(new JaasSubjectDoAsInterceptor()); } } --- public class JaasSubjectDoAsInterceptor extends AbstractPhaseInterceptor<Message> { public JaasSubjectDoAsInterceptor() { super(Phase.PRE_INVOKE); } @Override public void handleMessage(final Message message) { final org.apache.shiro.subject.Subject shiroSubject = SecurityUtils.getSubject(); if (shiroSubject == null || !(shiroSubject.getPrincipal() instanceof SecurityIdentity securityIdentity)) { return; } Subject.callAs( SecurityUtilities.toJaasSubject(securityIdentity), () -> { message.getInterceptorChain().doIntercept(message); return null; }); } } -- Chaz
