I assume that the properties set on the service are init-params to org.apache.cxf.transport.servlet.ServletController. Some frameworks, pax-web-extender-whiteboard in my case, require one of the following for init parameters
- init-params are prefixed with init. OR
- There's a property init-prefix on the service specifying the prefix. This property may be blank
With the service as it stands no parameters are set on the servlet by pax-web-extender-whiteboard. They are skipped at this if-statement: https://github.com/ops4j/org.ops4j.pax.web/blob/master/pax-web-extender-whiteboard/src/main/java/org/ops4j/pax/web/extender/whiteboard/internal/tracker/ServletTracker.java#L180-L182
This makes it impossible to secure the servlet.