Dave Riseley created CXF-9117:
---------------------------------
Summary: CXF 4.1.1 cxf-rt-ws-security fails if JCache is not on
the classpath
Key: CXF-9117
URL: https://issues.apache.org/jira/browse/CXF-9117
Project: CXF
Issue Type: Bug
Components: WS-* Components
Affects Versions: 4.1.1
Environment: Spring Boot 3.4.3 / Java 21
Reporter: Dave Riseley
CXF-8765 (released in 4.1.1) introduced the option to remove EHCache as
dependency, but has the side effect of forcing a dependency on JCache, so our
CXF application fails to start as we don't have JCache available (and don't
want to add it)
This is an abstract of the stack trace:
{{java.lang.NoClassDefFoundError: javax/cache/configuration/Configuration}}
{{ at
org.apache.cxf.ws.security.tokenstore.TokenStoreFactory.newInstance(TokenStoreFactory.java:35)}}
{{ at
org.apache.cxf.ws.security.tokenstore.TokenStoreUtils.getTokenStore(TokenStoreUtils.java:43)}}
{{ at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getCallback(WSS4JInInterceptor.java:688)}}
{{ at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getCallback(WSS4JInInterceptor.java:628)}}
{{ at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:271)}}
{{ at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:213)}}
{{ at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:93)}}
{{ at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)}}
{{ at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)}}
{{ at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267)}}
{{ at
org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:238)}}
{{ at
org.apache.cxf.transport.http_jetty.JettyHTTPHandler.service(JettyHTTPHandler.java:97)}}
{{ at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1619)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1552)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)}}
{{ at
org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)}}
{{ at
org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)}}
From
[https://github.com/apache/cxf/blob/cxf-4.1.1/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/TokenStoreFactory.java]
{{ if (WSS4JCacheUtil.isEhCacheInstalled()) {}}
{{ return new EHCacheTokenStoreFactory();}}
{{ } else if (JCacheUtils.isJCacheInstalled()) {}}
{{ return new JCacheTokenStoreFactory();}}
{{ } else {}}
{{ return new MemoryTokenStoreFactory();}}
{{ }}}
Looking at
[https://github.com/apache/cxf/blob/main/rt/ws/security/src/main/java/org/apache/cxf/ws/security/utils/JCacheUtils.java]
it attempts to check for JCache via reflection - but also has imports for the
jcache classes:
{{import javax.cache.Cache;}}
{{import javax.cache.CacheManager;}}
{{import javax.cache.configuration.MutableConfiguration;}}
which causes the NoClassDefFoundError
I think moving the JCache check to WSS4JCacheUtil would fix the issue?
For now we will remain on v4.1.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
