Hi JB, Well the Karaf examples clearly uses Aries for the whiteboard example. At minimum this is no longer viable.
https://github.com/apache/karaf/blob/main/examples/karaf-rest-example/karaf-rest-example-features/src/main/feature/feature.xml So the way I see it is: 1.) Aries updated for CXF 4x (Jakarta) on JAX-RS Whiteboard 2.0 for r8 2.) Switch to the only (known) impl of 2.0 spec based on Jersey https://github.com/eclipse-osgi-technology/jakartarest-osgi and build new features around it. 3.) Drop support and remove the example (hopefully not) I'm leaning towards making features for 2.) and adding a new example using the Jakarta annotations for whiteboard 2.0? Thoughts? -- Chaz On Wed, Nov 11, 2026 at 05:19:41PM +0100, Jean-Baptiste Onofré wrote: > Hi, > > I consider this to be an Apache Aries issue rather than an Apache Karaf one. > WDYT? > > Regards, > JB > > > On Wed, Nov 11, 2026 at 1:37 AM apache-karaf-dev.pyr3x.com via dev < > [email protected]> wrote: > > > Hello, > > > > I'm testing out Apache Karaf 4.5.0 on main. I'm currently using Apache > > Aries for the JAX-RS Whiteboard impl. This includes the features: > > > > aries-jax-rs-whiteboard-jackson > > aries-jax-rs-whiteboard-openapi > > aries-jax-rs-whiteboard-shiro > > > > I also have a CXF phase interceptor which will convert the shiro subject > > to a JAAS subject and validate using the Karaf Service Guard (since my > > REST API injects a core where all methods are guarded). This via the > > org.apache.karaf.service.acl.myapi.cfg. This let's my centralize > > authc/authz for both the karaf commands / REST api. > > > > The upgrade in Pax Web means javax.servlet is no longer exported and I'm > > not sure what the future of the whiteboard pattern with aries is here? > > > > I did find this repository: > > > > https://github.com/eclipse-osgi-technology/jakartarest-osgi > > > > samples of what I'm doing below. I moved to Subject.callAs from Java 21 > > forward: > > > > @Component(service = Application.class) > > @ApplicationPath(ApiApplication.NAME) > > @JaxrsApplicationBase(ApiApplication.NAME) > > @JaxrsName(ApiApplication.NAME) > > > > --- > > > > @Component(service = ObjectsResource.class, scope = ServiceScope.PROTOTYPE) > > @JaxrsResource > > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > > @JSONRequired > > > > --- > > > > @Component(service = Feature.class) > > @Provider > > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > > @JaxrsExtension > > public class JaasSubjectDoAsFeature extends AbstractFeature { > > > > @Override > > protected void initializeProvider(final InterceptorProvider provider, > > final Bus bus) { > > provider.getInInterceptors().add(new JaasSubjectDoAsInterceptor()); > > } > > } > > > > --- > > > > public class JaasSubjectDoAsInterceptor extends > > AbstractPhaseInterceptor<Message> { > > > > public JaasSubjectDoAsInterceptor() { > > super(Phase.PRE_INVOKE); > > } > > > > @Override > > public void handleMessage(final Message message) { > > final org.apache.shiro.subject.Subject shiroSubject = > > SecurityUtils.getSubject(); > > if (shiroSubject == null > > || !(shiroSubject.getPrincipal() instanceof SecurityIdentity > > securityIdentity)) { > > return; > > } > > Subject.callAs( > > SecurityUtilities.toJaasSubject(securityIdentity), > > () -> { > > message.getInterceptorChain().doIntercept(message); > > return null; > > }); > > } > > } > > > > -- > > Chaz > >
