openam saml libraries compatible with JDK21

[rohithjayak]

Hi,
We are trying to migrate our fedlet library to be compatible with JDK21.
Our current fedlet bundles the following openam libraries which are based on 14.x:

ls -lrt fedlet/fedlet/WEB-INF/lib/
total 41824
bsh-2.0b4.jar
mockito-all-1.10.19.jar
jcommander-1.48.jar
forgerock-guava-base-18.0.4.jar
forgerock-guava-annotations-18.0.4.jar
i18n-slf4j-1.4.2.jar
i18n-core-1.4.2.jar
validation-api-1.1.0.Final.jar
org.apache.servicemix.bundles.javax-inject-1_2.jar
activation-1.1.jar
javax.mail-1.5.1.jar
commons-lang-2.6.jar
forgerock-guice-core-1.1.0.jar
json-20090211.jar
jaxb-xjc-1.0.6.jar
jaxb-api-1.0.6.jar
jaxb1-impl-2.0.2.jar
guice-multibindings-3.0.jar
forgerock-guava-math-18.0.4.jar
forgerock-guava-collect-18.0.4.jar
xsdlib-20060615.jar
relaxngDatatype-20020414.jar
jaxp-api-1.4.2.jar
jaxb-libs-1.0.6.jar
javax.servlet-api-3.0.1.jar
java-ipv6-0.14.jar
isorelax-20030108.jar
guice-3.0-no_aop.jar
forgerock-guava-primitives-18.0.4.jar
forgerock-guava-concurrent-18.0.4.jar
forgerock-guava-cache-18.0.4.jar
xmlsec-1.5.6.jar
jaxrpc-api-1.1.jar
guice-assistedinject-3.0.jar
esapiport-2013-12-04.jar
testng-6.9.10.jar
swagger-models-1.5.9.jar
grizzly-framework-2.3.24.jar
assertj-core-2.4.1.jar
jcip-annotations-1.0-1.jar
joda-time-2.7.jar
jsr311-api-1.1.1.jar
opendj-core-4.0.0-M1.jar
opendj-grizzly-4.0.0-M1.jar
jaxrpc-impl-1.1.3_01-20160905.jar
forgerock-util-21.0.0-alpha-23.jar
chf-http-core-21.0.0-alpha-23.jar
api-descriptor-21.0.0-alpha-23.jar
json-resource-21.0.0-alpha-23.jar
security-21.0.0-alpha-23.jar
json-resource-http-21.0.0-alpha-23.jar
forgerock-audit-core-21.0.0-alpha-23.jar
openam-i18n-14.0.0-M6.jar
openam-xacml3-schema-14.0.0-M6.jar
openam-certs-14.0.0-M6.jar
openam-saml2-schema-14.0.0-M6.jar
openam-wsfederation-schema-14.0.0-M6.jar
openam-liberty-schema-14.0.0-M6.jar
openam-idpdiscovery-14.0.0-M6.jar
openam-audit-context-14.0.0-M6.jar
openam-shared-14.0.0-M6.jar
openam-audit-core-14.0.0-M6.jar
openam-ldap-utils-14.0.0-M6.jar
openam-federation-library-14.0.0-M6.jar
webservices-tools-2.1-b16.jar
webservices-extra-api-2003-09-04.jar
webservices-rt-2009-29-07.jar
webservices-extra-2008-03-12.jar
webservices-api-2009-14-01.jar
xalan-2.7.1.jar
xml-serializer-2.11.0.jar
xml-resolver-2.11.0.jar
xml-apis-2.11.0.jar
xercesImpl-2.11.0.jar
mail-1.4.5.jar
commons-logging-api-1.1.jar
commons-logging-1.1.3.jar

We tried creating a new fedlet with the below openam 16.x version libraries and removed the unnecessary/old version jars and upgraded the jars which were not compatible with JDK21:

openam-xacml3-schema-16.0.3.jar
openam-wsfederation-schema-16.0.3.jar
openam-shared-16.0.3.jar
openam-saml2-schema-16.0.3.jar
openam-liberty-schema-16.0.3.jar
openam-ldap-utils-16.0.3.jar
openam-idpdiscovery-16.0.3.jar
openam-i18n-16.0.3.jar
openam-federation-library-16.0.3.jar
openam-certs-16.0.3.jar
openam-audit-core-16.0.3.jar
openam-audit-context-16.0.3.jar

But even after doing this we see that while compiling one of the source files of our project there is a dependency on old version classes which is not getting bridged properly inspite of using upgraded jakarta and jaxb-runtime jars in our classpath. So, is there any specific step to be done inorder to ensure the javax dependency of the openam libraries can be automatically bridged to use the latest jakarta classes and make it compatible with JDK21?
Here is one minimal class path with which the source file is failing to compile with an error as follows:

    <path id="minimal.saml.classpath">
        <!-- 1. The required Jakarta implementations (MUST BE FIRST) -->
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/jakarta.xml.bind-api-4.0.2.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/jaxb-runtime-4.0.5.jar"/>

        <!-- 2. The specific library containing the IDPSSODescriptorElement class -->
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/openam-saml2-schema-16.0.3.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/openam-federation-library-16.0.3.jar"/>

        <!-- 3. opensaml and xmltooling are likely necessary for manager methods -->
        <pathelement path="${thirdparty}/release/java/jar/opensaml.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/xmltooling.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/openam-core-16.0.3.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/fedlet-core-16.0.3.jar"/>

        <!-- Logging library (org.apache.commons.logging) -->
        <pathelement path="${vos.common.jar}/commons-logging.jar"/>

        <!-- You may also need these if your project uses them implicitly -->
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/jaxen-1.1.6.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/log4j-1.2.17.jar"/>
    </path>

Error:

MetadataManager.java:188: error: cannot access Element
[javac] List sloLogoutURLs = idpDescriptor.getSingleLogoutService();
[javac] ^
[javac] class file for javax.xml.bind.Element not found

Could you please help with this?

Thanks

[maximthomas]

Hi @rohithjayak,
Try to use jaxb-api-2.3.1.jar and jaxb-runtime-3.0.2.jar instead of jakarta.xml.bind-api-4.0.2.jar and jaxb-runtime-4.0.5.jar

[rohithjayak]

Hi @maximthomas,
Thank you for the suggestion.
After adding these 2 jars: jaxb-api-2.3.1.jar and jaxb-runtime-3.0.2.jar and removing the jakarta.xml.bind-api-4.0.2.jar and jaxb-runtime-4.0.5.jar from the build.xml and also the lib path, I see this time complains about jakarta classes directly instead of javax as follows:

---

[javac] sso_sp/src/com/soc/cpi/sso/oauth/token/KeyManager.java:38: error: package jakarta.xml.bind does not exist
[javac] import jakarta.xml.bind.DatatypeConverter;
[javac]                        ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:10: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlAccessType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:11: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlAccessorType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:12: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlElement;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:13: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlRootElement;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:14: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:38: error: cannot find symbol
[javac] @XmlAccessorType(XmlAccessType.FIELD)
[javac]  ^
[javac]   symbol: class XmlAccessorType
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:39: error: cannot find symbol
[javac] @XmlType(name = "", propOrder = {
[javac]  ^
[javac]   symbol: class XmlType
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:44: error: cannot find symbol
[javac] @XmlRootElement(name = "SSOResult")
[javac]  ^
[javac]   symbol: class XmlRootElement
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:10: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlAccessType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:11: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlAccessorType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:12: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlElement;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:13: error: package jakarta.xml.bind.annotation does not exist
[javac] import jakarta.xml.bind.annotation.XmlType;
[javac]                                   ^
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:43: error: cannot find symbol
[javac] @XmlAccessorType(XmlAccessType.FIELD)
[javac]  ^
[javac]   symbol: class XmlAccessorType
[javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/Response.java:44: error: cannot find symbol
[javac] @XmlType(name = "Response", propOrder = {
[javac]  ^

---

Could you please help...

Thanks

[maximthomas]

Hi @rohithjayak ,
Please provide steps to repoduce the issue

[rohithjayak]

Hi @maximthomas ,
For simplicity lets consider the below few errors from one Java file(SSOResult.java) which is actually generated based on xsd target as follows:

FEW ERRORS:

	sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:10: error: package jakarta.xml.bind.annotation does not exist
    [javac] import jakarta.xml.bind.annotation.XmlAccessType;
    [javac]                                   ^
    [javac] sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:11: error: package jakarta.xml.bind.annotation does not exist
    [javac] import jakarta.xml.bind.annotation.XmlAccessorType;
    [javac]                                   ^


	sso_sp/src/com/soc/cpi/sso/saml/app/jaxb/response/SSOResult.java:47: error: cannot find symbol
    [javac]     @XmlElement(name = "ErrorCode")
    [javac]      ^

Here is the build.xml contents with the relevant targets:

<!-- ======================================================================================= -->
<!--            TARGET:     generatesources                                                  -->
<!-- ======================================================================================= -->

<!-- generate the classes based on xsd -->
<target name="xjc-prep" depends="copyjars">
    <taskdef name="xjc" classname="com.sun.tools.xjc.XJC2Task">
            <classpath>
            <pathelement path="${thirdparty}/release/java/jar/jakarta.xml.bind-api.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/codemodel.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/istack-commons-runtime.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/jakarta.activation-api.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/jaxb-core.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/jaxb-runtime-3.0.2.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/jaxb-xjc.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/relaxng-datatype.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/rngom.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/serializer.jar"/>
            <pathelement path="${thirdparty}/release/java/jar/xsom.jar"/>
        </classpath>
    </taskdef>
</target>


<target name="generatesources" description=""  depends="xjc-prep">
   <xjc schema="src/com/soc/cpi/sso/saml/app/conf/SSOReply.xsd"
            destdir="${src.dir}"
            package="com.soc.cpi.sso.saml.app.jaxb.response"
            extension="true">
            <depends file="src/com/soc/cpi/sso/saml/app/conf/SSOReply.xsd"/>
            <produces dir="${src.dir}"/>
   </xjc>
</target>


<!-- ======================================================================================= -->
<!--            TARGET:     unzipfedlet                                                      -->
<!-- ======================================================================================= -->

<target name="unzipfedlet" description="unwars the fedlet.war">
    <unzip src="${fedlet.dir}/fedlet.war" dest="${fedlet.dir}/fedlet"/>
</target>


<!-- ======================================================================================= -->
<!--            TARGET:     compile                                                          -->
<!-- ======================================================================================= -->

<target name="compile" depends="generatesources, unzipfedlet">
    <echo message="DEBUG: FEDLET is: ${fedlet.dir}/fedlet/WEB-INF/lib/"/>
    <mkdir dir="${classes.dir}"/>
    <echo message="RJ@::DEBUG: FEDLET is: ${fedlet.dir}/fedlet/WEB-INF/lib/"/>

    <javac srcdir="${src.dir}" destdir="${classes.dir}" debug="true">
        <classpath refid="build.classpath"/>
        <exclude name="com/soc/cpi/sso/saml/app/metadata/**/**"/>
    </javac>
    <copy todir="${web.inf.dir}/classes">
        <fileset dir="src/resources" />
    </copy>
</target>

And here is the build.classpath used by compile target which i have modified as per your suggestion to include jaxb-api-2.3.1.jar and jaxb-runtime-3.0.2.jar instead of jakarta.xml.bind-api-4.0.2.jar and jaxb-runtime-4.0.5.jar:

    <!-- ======================================================================================= -->
    <!--            CLASS PATH:     build.classpath                                              -->
    <!-- ======================================================================================= -->

    <path id="build.classpath">
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/jaxb-api-2.3.1.jar"/>
        <pathelement path="${fedlet.dir}/fedlet/WEB-INF/lib/jaxb-runtime-3.0.2.jar"/>
        <fileset dir="${fedlet.dir}/fedlet/WEB-INF/lib/">
            <include name="**/*.jar"/>
            <exclude name="xml-apis*.jar"/>
            <exclude name="xercesImpl*.jar"/>
            <exclude name="jaxb*.jar"/>
            <exclude name="jakarta.xml.bind-api*.jar"/>
            <exclude name="jaxb-runtime*.jar"/>
            <exclude name="jackson*.jar"/>
        </fileset>
        <fileset dir="${thirdparty}/release/java/xerces">
           <include name="xercesImpl.jar"/>
           <include name="xml-apis.jar"/>
        </fileset>
        <pathelement path="${thirdparty}/release/java/jar/opensaml.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/xmltooling.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/mimepull.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/jersey-multipart.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/json-smart.jar"/>
        <pathelement path="${thirdparty}/release/java/jar/nimbus-jose-jwt.jar"/>
        <pathelement path="${vos.common.jar}/commons-logging.jar"/>
        <pathelement path="${vos.common.jar}/Iproduct.jar"/>
        <pathelement path="${vos.common.jar}/GenericUtils.jar"/>

<!-- the following 5 jars are needed for assertion flow in oauth -->
        <pathelement path="${thirdparty}/release/java/jar/slf4j-log4j12-1.6.1.jar"/>

	...
	...

And here is the sample content of SSOResult.java which directly imports Jakarta.xml.bind:

//
// This file was generated by the Eclipse Implementation of JAXB, v4.0.5
// See https://eclipse-ee4j.github.io/jaxb-ri
// Any modifications to this file will be lost upon recompilation of the source schema.
//


package com.soc.cpi.sso.saml.app.jaxb.response;

import jakarta.xml.bind.annotation.XmlAccessType;
import jakarta.xml.bind.annotation.XmlAccessorType;
import jakarta.xml.bind.annotation.XmlElement;
import jakarta.xml.bind.annotation.XmlRootElement;
import jakarta.xml.bind.annotation.XmlType;

I suspect since we removed the jakarta.xml.bind api jar, it started to throw errors related to jakarta.xml.bind imports and since now we have added jaxb-api-2.3.1.jar and jaxb-runtime-3.0.2.jar, it is able to resolve the javax.xml.bind imports, so could you please let me know how do we migrate to JDK21 with the above combinations of source code?

Thanks

[maximthomas]

You should not use the jakarta namespace, OpenAM fedlet is still using javax.xml namespace and you should generate classes using this namespace.

Also, add the following libraries to your classpath:
javax.xml.bind:jaxb-api:2.3.1
com.sun.xml.bind:jaxb-core:2.3.0.1
com.sun.xml.bind:jaxb-impl:2.3.2

[Bisht-Mohit]

Hi @maximthomas
Based on my understanding, JDK 21 no longer provides built-in support for the legacy javax namespace. Therefore, if OpenAM 16.x has been verified to run on JDK 21, there must be some form of classpath shadowing, dependency shading, or other compatibility mechanism used to maintain support for javax-based APIs.

If such a workaround or compatibility layer has been implemented for the 16.x release, is it possible to apply the same approach to the 14.x version to make it compatible with JDK 21 as well?

Thanks.