If it is not a problem taking OpenSAML off of the classpath, perhaps the next question should be asked: should the manifest for cxf-rt-ws-security be changed to make the opensaml dependencies optional?
but not by you but by maven-build-plugin..OSGI reads the manifest and either includes or excludes dependencies depending on which dependencies are contained in Import Package Specification and version <ranges> of dependencies Import Package: This header declares the external dependencies of the bundle that the OSGi Framework uses to resolve the bundle. Specific versions or version ranges for each package can be declared https://www.ibm.com/support/knowledgecenter/it/SSAW57_8.5.5/com.ibm.websphere.osgi.nd.multiplatform.doc/ae/ra_bundle_mf.html HTH
