[CXF-5423] Callbackhandlers and other resources aren't found if configured in blueprint config due to classloading issues

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.7
• Fix Version/s: 2.6.12, 2.7.9, 3.0.0-milestone2
• Component/s: JAX-RS Security

Environment

OSGi (Karaf)

• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Marc Giger
• Created: 26/Nov/13 14:58
• Updated: 11/Jul/14 12:50
• Resolved: 17/Dec/13 17:37

Description

Hi,

While playing around with JAX-RS security in OSGi (following the guide at http://cxf.apache.org/docs/jax-rs-saml.html) I found that if I configure the ws-security.* props directly in blueprint none of the configured resources are found. A little debugging showed that the wrong classloader is used to load the Callbackhandlers and property files. Note this works fine for the jaxrs service but not for the jaxrs client.

Blueprint config:

<jaxrs:client id="bookStoreServiceClient"
address="http://localhost:8040/services/bookStoreService"
serviceClass="com.mycompany.demoRestServiceCommon.service.BookStore"
inheritHeaders="true">
<jaxrs:outInterceptors>
<ref component-id="samlHeaderOutInterceptor"/>
</jaxrs:outInterceptors>
<jaxrs:properties>
<entry key="ws-security.callback-handler"
value="com.mycompany.demoRestServiceConsumer.PasswordCallbackHandler"/>
<entry key="ws-security.saml-callback-handler"
value="com.mycompany.demoRestServiceConsumer.SamlCallbackHandler"/>
<entry key="ws-security.signature.username" value="client"/>
<entry key="ws-security.signature.properties" value="clientKeystore.properties"/>
</jaxrs:properties>
</jaxrs:client>

<bean id="samlHeaderOutInterceptor" class="com.mycompany.demoRestServiceConsumer.SamlOutInterceptor"/>

I've overridden the SAMLHeaderOutInterceptor to show the problem and what needs to be done somewhere to fix it:

public class SamlOutInterceptor extends SamlHeaderOutInterceptor {

@Override
public void handleMessage(Message message) throws Fault {
ClassLoader classLoader = message.getExchange().getBus().getExtension(ClassLoader.class);
ClassLoader tccl = Thread.currentThread().getContextClassLoader();
try {
if (classLoader != null)

{ Thread.currentThread().setContextClassLoader(classLoader); }

I've implemented a hack
super.handleMessage(message);
} finally {
//restore original classloader
if (classLoader != null)

{ Thread.currentThread().setContextClassLoader(tccl); }

}
}
}