Hi, I consider this to be an Apache Aries issue rather than an Apache Karaf one. WDYT?
Regards, JB On Wed, Nov 11, 2026 at 1:37 AM apache-karaf-dev.pyr3x.com via dev < [email protected]> wrote: > Hello, > > I'm testing out Apache Karaf 4.5.0 on main. I'm currently using Apache > Aries for the JAX-RS Whiteboard impl. This includes the features: > > aries-jax-rs-whiteboard-jackson > aries-jax-rs-whiteboard-openapi > aries-jax-rs-whiteboard-shiro > > I also have a CXF phase interceptor which will convert the shiro subject > to a JAAS subject and validate using the Karaf Service Guard (since my > REST API injects a core where all methods are guarded). This via the > org.apache.karaf.service.acl.myapi.cfg. This let's my centralize > authc/authz for both the karaf commands / REST api. > > The upgrade in Pax Web means javax.servlet is no longer exported and I'm > not sure what the future of the whiteboard pattern with aries is here? > > I did find this repository: > > https://github.com/eclipse-osgi-technology/jakartarest-osgi > > samples of what I'm doing below. I moved to Subject.callAs from Java 21 > forward: > > @Component(service = Application.class) > @ApplicationPath(ApiApplication.NAME) > @JaxrsApplicationBase(ApiApplication.NAME) > @JaxrsName(ApiApplication.NAME) > > --- > > @Component(service = ObjectsResource.class, scope = ServiceScope.PROTOTYPE) > @JaxrsResource > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > @JSONRequired > > --- > > @Component(service = Feature.class) > @Provider > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > @JaxrsExtension > public class JaasSubjectDoAsFeature extends AbstractFeature { > > @Override > protected void initializeProvider(final InterceptorProvider provider, > final Bus bus) { > provider.getInInterceptors().add(new JaasSubjectDoAsInterceptor()); > } > } > > --- > > public class JaasSubjectDoAsInterceptor extends > AbstractPhaseInterceptor<Message> { > > public JaasSubjectDoAsInterceptor() { > super(Phase.PRE_INVOKE); > } > > @Override > public void handleMessage(final Message message) { > final org.apache.shiro.subject.Subject shiroSubject = > SecurityUtils.getSubject(); > if (shiroSubject == null > || !(shiroSubject.getPrincipal() instanceof SecurityIdentity > securityIdentity)) { > return; > } > Subject.callAs( > SecurityUtilities.toJaasSubject(securityIdentity), > () -> { > message.getInterceptorChain().doIntercept(message); > return null; > }); > } > } > > -- > Chaz >
