[
https://issues.apache.org/jira/browse/CXF-9117?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andriy Redko updated CXF-9117:
------------------------------
Summary: cxf-rt-ws-security fails if JCache is not on the classpath (was:
CXF 4.1.1 cxf-rt-ws-security fails if JCache is not on the classpath)
> cxf-rt-ws-security fails if JCache is not on the classpath
> ----------------------------------------------------------
>
> Key: CXF-9117
> URL: https://issues.apache.org/jira/browse/CXF-9117
> Project: CXF
> Issue Type: Bug
> Components: WS-* Components
> Affects Versions: 3.5.11, 3.6.6, 4.0.7, 4.1.1
> Environment: Spring Boot 3.4.3 / Java 21
> Reporter: Dave Riseley
> Assignee: Andriy Redko
> Priority: Major
> Fix For: 4.1.2, 4.0.8, 3.6.7, 3.5.12
>
>
> CXF-8765 (released in 4.1.1) introduced the option to remove EHCache as
> dependency, but has the side effect of forcing a dependency on JCache, so our
> CXF application fails to start as we don't have JCache available (and don't
> want to add it)
> This is an abstract of the stack trace:
> {{java.lang.NoClassDefFoundError: javax/cache/configuration/Configuration}}
> {{ at
> org.apache.cxf.ws.security.tokenstore.TokenStoreFactory.newInstance(TokenStoreFactory.java:35)}}
> {{ at
> org.apache.cxf.ws.security.tokenstore.TokenStoreUtils.getTokenStore(TokenStoreUtils.java:43)}}
> {{ at
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getCallback(WSS4JInInterceptor.java:688)}}
> {{ at
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getCallback(WSS4JInInterceptor.java:628)}}
> {{ at
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:271)}}
> {{ at
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:213)}}
> {{ at
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:93)}}
> {{ at
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)}}
> {{ at
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)}}
> {{ at
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267)}}
> {{ at
> org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:238)}}
> {{ at
> org.apache.cxf.transport.http_jetty.JettyHTTPHandler.service(JettyHTTPHandler.java:97)}}
> {{ at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1619)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1552)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)}}
> {{ at
> org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)}}
> {{ at
> org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)}}
> From
> [https://github.com/apache/cxf/blob/cxf-4.1.1/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/TokenStoreFactory.java]
> {{ if (WSS4JCacheUtil.isEhCacheInstalled()) {}}
> {{ return new EHCacheTokenStoreFactory();}}
> {{ } else if (JCacheUtils.isJCacheInstalled()) {}}
> {{ return new JCacheTokenStoreFactory();}}
> {{ } else {}}
> {{ return new MemoryTokenStoreFactory();}}
> Looking at
> [https://github.com/apache/cxf/blob/main/rt/ws/security/src/main/java/org/apache/cxf/ws/security/utils/JCacheUtils.java]
> it attempts to check for JCache via reflection - but also has imports for the
> jcache classes:
> {{import javax.cache.Cache;}}
> {{import javax.cache.CacheManager;}}
> {{import javax.cache.configuration.MutableConfiguration;}}
> which causes the NoClassDefFoundError
> I think moving the JCache installation check to WSS4JCacheUtil would fix the
> issue?
> For now we will remain on v4.1.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
