From 7fa1e033aab3c4f14a250ad018eeba966d7b1676 Mon Sep 17 00:00:00 2001 From: jhunzik <17188993+jhunzik@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:10:02 -0700 Subject: [PATCH 1/4] Upgrade apache shiro --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 4b74ed65ef7..856a18038ff 100644 --- a/pom.xml +++ b/pom.xml @@ -150,7 +150,7 @@ 1.1.3_2 1.1.3 4.3 - 1.13.0 + 2.2.1 9.9.1 3.1.6 1.84 From 03b3a855f00dcb0d384ba78b1fd09117f1e8da68 Mon Sep 17 00:00:00 2001 From: jhunzik <17188993+jhunzik@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:42:33 -0700 Subject: [PATCH 2/4] Fix Shiro 2.x OSGi compatibility by using official shiro-core feature Upgrade from shiro-core bundle to shiro-core feature from Apache Shiro's official Karaf feature repository. This fixes OSGi resolution errors where shiro-core 2.2.1 requires the osgi.serviceloader.registrar extender and shiro-lang bundle that were not previously included. The official shiro-core feature properly handles all dependencies including: - shiro-lang (base package) - spifly (provides osgi.serviceloader.registrar extender) - All other shiro-* modules in correct dependency order Also adds shiro-features descriptor to karaf-maven-plugin configurations in ddf-catalog and ddf distributions so the feature can be resolved at build time. --- distribution/ddf-catalog/pom.xml | 1 + distribution/ddf/pom.xml | 1 + features/security/src/main/feature/feature.xml | 3 ++- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/distribution/ddf-catalog/pom.xml b/distribution/ddf-catalog/pom.xml index a6ab50fccb7..2776143a26b 100644 --- a/distribution/ddf-catalog/pom.xml +++ b/distribution/ddf-catalog/pom.xml @@ -90,6 +90,7 @@ mvn:ddf.features/apps/${project.version}/xml/features mvn:ddf.features/branding/${project.version}/xml/features mvn:ddf.features/security/${project.version}/xml/features + mvn:org.apache.shiro/shiro-features/${apache.shiro.version}/xml/features mvn:ddf.features/solr/${project.version}/xml/features mvn:ddf.features/utilities/${project.version}/xml/features mvn:ddf.catalog/catalog-app/${project.version}/xml/features diff --git a/distribution/ddf/pom.xml b/distribution/ddf/pom.xml index 6ddf3b6668b..5dfcc684ac8 100644 --- a/distribution/ddf/pom.xml +++ b/distribution/ddf/pom.xml @@ -78,6 +78,7 @@ mvn:ddf.features/admin/${project.version}/xml/features mvn:ddf.features/branding/${project.version}/xml/features mvn:ddf.features/security/${project.version}/xml/features + mvn:org.apache.shiro/shiro-features/${apache.shiro.version}/xml/features mvn:ddf.features/solr/${project.version}/xml/features mvn:ddf.features/utilities/${project.version}/xml/features mvn:ddf.catalog/catalog-app/${project.version}/xml/features diff --git a/features/security/src/main/feature/feature.xml b/features/security/src/main/feature/feature.xml index 034dd10dbbe..7b6b983e295 100644 --- a/features/security/src/main/feature/feature.xml +++ b/features/security/src/main/feature/feature.xml @@ -22,6 +22,7 @@ mvn:ddf.features/utilities/${project.version}/xml/features mvn:ddf.features/branding/${project.version}/xml/features mvn:ddf.features/camel-karaf/${project.version}/xml/features + mvn:org.apache.shiro/shiro-features/${apache.shiro.version}/xml/features @@ -52,7 +53,7 @@ mvn:net.minidev/json-smart/${json-smart.version} - mvn:org.apache.shiro/shiro-core/${apache.shiro.version} + shiro-core mvn:com.sun.mail/jakarta.mail/${jakarta.mail.version} mvn:org.apache.commons/commons-text/${commons-text.version} From 085f9e2437ce2dccc42000998f9987e2c01c5a72 Mon Sep 17 00:00:00 2001 From: jhunzik <17188993+jhunzik@users.noreply.github.com> Date: Tue, 21 Jul 2026 10:04:56 -0700 Subject: [PATCH 3/4] Explicitly add shiro-core bundles and required dependencies --- .../security/src/main/feature/feature.xml | 19 +++++++++++++++++-- pom.xml | 3 ++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/features/security/src/main/feature/feature.xml b/features/security/src/main/feature/feature.xml index 7b6b983e295..f06a614839c 100644 --- a/features/security/src/main/feature/feature.xml +++ b/features/security/src/main/feature/feature.xml @@ -17,12 +17,12 @@ xsi:schemaLocation="http://karaf.apache.org/xmlns/features/v1.3.0 http://karaf.apache.org/xmlns/features/v1.3.0"> mvn:org.apache.karaf.features/spring/${karaf.version}/xml/features + mvn:org.apache.karaf.features/specs/${karaf.version}/xml/features mvn:org.apache.cxf.karaf/apache-cxf/${cxf.version}/xml/features mvn:ddf.features/kernel/${project.version}/xml/features mvn:ddf.features/utilities/${project.version}/xml/features mvn:ddf.features/branding/${project.version}/xml/features mvn:ddf.features/camel-karaf/${project.version}/xml/features - mvn:org.apache.shiro/shiro-features/${apache.shiro.version}/xml/features @@ -31,8 +31,24 @@ pax-web-http-whiteboard pax-web-jetty-websockets scr + spifly spring + + mvn:commons-beanutils/commons-beanutils/${commons-beanutils.version} + mvn:org.apache.commons/commons-configuration2/${commons-configuration2.version} + mvn:commons-collections/commons-collections/${commons-collections.version} + mvn:org.apache.geronimo.specs/geronimo-annotation_1.3_spec/${geronimo-annotation.version} + mvn:org.apache.shiro/shiro-lang/${apache.shiro.version} + mvn:org.apache.shiro/shiro-cache/${apache.shiro.version} + mvn:org.apache.shiro/shiro-config-ogdl/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-core/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-cipher/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-hash/${apache.shiro.version} + mvn:org.apache.shiro/shiro-config-core/${apache.shiro.version} + mvn:org.apache.shiro/shiro-event/${apache.shiro.version} + mvn:org.apache.shiro/shiro-core/${apache.shiro.version} + jackson wss4j @@ -53,7 +69,6 @@ mvn:net.minidev/json-smart/${json-smart.version} - shiro-core mvn:com.sun.mail/jakarta.mail/${jakarta.mail.version} mvn:org.apache.commons/commons-text/${commons-text.version} diff --git a/pom.xml b/pom.xml index 856a18038ff..22de1d0e3a2 100644 --- a/pom.xml +++ b/pom.xml @@ -166,7 +166,7 @@ 3.2.2 4.1 1.10 - 2.10.1 + 2.15.1 1.4 1.8.1 1.3 @@ -193,6 +193,7 @@ 2.1.30 geronimo-servlet_3.0_spec org.apache.geronimo.specs + 1.1 1.22.0 1.1.0 2.13.2 From 775c73f7a3da0fde59ce1c20a35f463912f6d898 Mon Sep 17 00:00:00 2001 From: Joshua Hunziker <17188993+jhunzik@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:53:00 -0700 Subject: [PATCH 4/4] Move shiro core bundles to their own feature --- .../security/src/main/feature/feature.xml | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/features/security/src/main/feature/feature.xml b/features/security/src/main/feature/feature.xml index f06a614839c..65b2e44e529 100644 --- a/features/security/src/main/feature/feature.xml +++ b/features/security/src/main/feature/feature.xml @@ -34,21 +34,6 @@ spifly spring - - mvn:commons-beanutils/commons-beanutils/${commons-beanutils.version} - mvn:org.apache.commons/commons-configuration2/${commons-configuration2.version} - mvn:commons-collections/commons-collections/${commons-collections.version} - mvn:org.apache.geronimo.specs/geronimo-annotation_1.3_spec/${geronimo-annotation.version} - mvn:org.apache.shiro/shiro-lang/${apache.shiro.version} - mvn:org.apache.shiro/shiro-cache/${apache.shiro.version} - mvn:org.apache.shiro/shiro-config-ogdl/${apache.shiro.version} - mvn:org.apache.shiro/shiro-crypto-core/${apache.shiro.version} - mvn:org.apache.shiro/shiro-crypto-cipher/${apache.shiro.version} - mvn:org.apache.shiro/shiro-crypto-hash/${apache.shiro.version} - mvn:org.apache.shiro/shiro-config-core/${apache.shiro.version} - mvn:org.apache.shiro/shiro-event/${apache.shiro.version} - mvn:org.apache.shiro/shiro-core/${apache.shiro.version} - jackson wss4j @@ -57,6 +42,7 @@ cxf-bindings-soap cxf-features-logging common-system + shiro-core wrap:mvn:com.nimbusds/nimbus-jose-jwt/${nimbus.jose.jwt.version} @@ -329,6 +315,23 @@ mvn:ddf.security.claims/security-claims-ldap/${project.version} + + + mvn:commons-beanutils/commons-beanutils/${commons-beanutils.version} + mvn:org.apache.commons/commons-configuration2/${commons-configuration2.version} + mvn:commons-collections/commons-collections/${commons-collections.version} + mvn:org.apache.geronimo.specs/geronimo-annotation_1.3_spec/${geronimo-annotation.version} + mvn:org.apache.shiro/shiro-lang/${apache.shiro.version} + mvn:org.apache.shiro/shiro-cache/${apache.shiro.version} + mvn:org.apache.shiro/shiro-config-ogdl/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-core/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-cipher/${apache.shiro.version} + mvn:org.apache.shiro/shiro-crypto-hash/${apache.shiro.version} + mvn:org.apache.shiro/shiro-config-core/${apache.shiro.version} + mvn:org.apache.shiro/shiro-event/${apache.shiro.version} + mvn:org.apache.shiro/shiro-core/${apache.shiro.version} + + security-core-services