Hi Chaz, We have a few open PRs regarding the Jakarta changes expected for version 4.5.0.
I will review them, but I do not want to delay the 4.5.0 release any further. Any remaining fixes can be included in subsequent releases (4.5.1, 4.5.2, etc.). I'll check what I can get done for this release and keep you updated. Regards, JB On Wed, Nov 11, 2026 at 7:18 PM apache-karaf-dev.pyr3x.com via dev < [email protected]> wrote: > Hi JB, > > Well the Karaf examples clearly uses Aries for the whiteboard example. > At minimum this is no longer viable. > > > https://github.com/apache/karaf/blob/main/examples/karaf-rest-example/karaf-rest-example-features/src/main/feature/feature.xml > > So the way I see it is: > > 1.) Aries updated for CXF 4x (Jakarta) on JAX-RS Whiteboard 2.0 for r8 > 2.) Switch to the only (known) impl of 2.0 spec based on Jersey > https://github.com/eclipse-osgi-technology/jakartarest-osgi and build > new features around it. > 3.) Drop support and remove the example (hopefully not) > > I'm leaning towards making features for 2.) and adding a new example > using the Jakarta annotations for whiteboard 2.0? Thoughts? > > -- > Chaz > > On Wed, Nov 11, 2026 at 05:19:41PM +0100, Jean-Baptiste Onofré wrote: > > Hi, > > > > I consider this to be an Apache Aries issue rather than an Apache Karaf > one. > > WDYT? > > > > Regards, > > JB > > > > > > On Wed, Nov 11, 2026 at 1:37 AM apache-karaf-dev.pyr3x.com via dev < > > [email protected]> wrote: > > > > > Hello, > > > > > > I'm testing out Apache Karaf 4.5.0 on main. I'm currently using Apache > > > Aries for the JAX-RS Whiteboard impl. This includes the features: > > > > > > aries-jax-rs-whiteboard-jackson > > > aries-jax-rs-whiteboard-openapi > > > aries-jax-rs-whiteboard-shiro > > > > > > I also have a CXF phase interceptor which will convert the shiro > subject > > > to a JAAS subject and validate using the Karaf Service Guard (since my > > > REST API injects a core where all methods are guarded). This via the > > > org.apache.karaf.service.acl.myapi.cfg. This let's my centralize > > > authc/authz for both the karaf commands / REST api. > > > > > > The upgrade in Pax Web means javax.servlet is no longer exported and > I'm > > > not sure what the future of the whiteboard pattern with aries is here? > > > > > > I did find this repository: > > > > > > https://github.com/eclipse-osgi-technology/jakartarest-osgi > > > > > > samples of what I'm doing below. I moved to Subject.callAs from Java 21 > > > forward: > > > > > > @Component(service = Application.class) > > > @ApplicationPath(ApiApplication.NAME) > > > @JaxrsApplicationBase(ApiApplication.NAME) > > > @JaxrsName(ApiApplication.NAME) > > > > > > --- > > > > > > @Component(service = ObjectsResource.class, scope = > ServiceScope.PROTOTYPE) > > > @JaxrsResource > > > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > > > @JSONRequired > > > > > > --- > > > > > > @Component(service = Feature.class) > > > @Provider > > > @JaxrsApplicationSelect(ApiApplication.NAME_FILTER) > > > @JaxrsExtension > > > public class JaasSubjectDoAsFeature extends AbstractFeature { > > > > > > @Override > > > protected void initializeProvider(final InterceptorProvider provider, > > > final Bus bus) { > > > provider.getInInterceptors().add(new JaasSubjectDoAsInterceptor()); > > > } > > > } > > > > > > --- > > > > > > public class JaasSubjectDoAsInterceptor extends > > > AbstractPhaseInterceptor<Message> { > > > > > > public JaasSubjectDoAsInterceptor() { > > > super(Phase.PRE_INVOKE); > > > } > > > > > > @Override > > > public void handleMessage(final Message message) { > > > final org.apache.shiro.subject.Subject shiroSubject = > > > SecurityUtils.getSubject(); > > > if (shiroSubject == null > > > || !(shiroSubject.getPrincipal() instanceof SecurityIdentity > > > securityIdentity)) { > > > return; > > > } > > > Subject.callAs( > > > SecurityUtilities.toJaasSubject(securityIdentity), > > > () -> { > > > message.getInterceptorChain().doIntercept(message); > > > return null; > > > }); > > > } > > > } > > > > > > -- > > > Chaz > > > >
