[CXF-8913] Avoid 3rd party maven repository for OpenSAML

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 4.0.2
• Component/s: WS-* Components
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Claus Ibsen
• Created: 15/Aug/23 07:58
• Updated: 18/Aug/23 14:43

Description

Apache CXF depends on OpenSAML from Apache WSSJ project

However this commit causes wss4j to download JARs from NOT maven central but from
https://build.shibboleth.net/nexus/content/groups/public

https://github.com/apache/ws-wss4j/commit/e4a33efcb2b474a1da2b2c08f815b2718e111823

Is there a way for Apache CXF to only use JARs from maven central. There is a trust issue when JARs are NOT downloaded from central.

At Apache Camel we only download from maven central - except for camel-jira which sadly had to download from Atlassian. We are considering deprecating and removing this component for that reason.

Issue Links

• causes: CAMEL-19745 camel-cxf-soap - Downloads JARs from 3rd party repo