Chapter 8. Apache CXF Issues
8.1. Apache CXF 3.1 Migration
Fuse 7.0 uses Apache CXF 3.1. This introduces some issues that you sould be aware of before migrating.
8.1.1. Main Changes
-
The JAX-WS/Simple frontend ServerFactoryBean will automatically call reset at the end of the
create()call. This allows resources to be cleaned up and garbage collected sooner. However, it also prevents multiple calls tocreate()from sharing the same ServerInfo/EndpointInfo objects, as they would in older versions. That sharing has caused many problems in the past due to sharing of properties, such as token caches, that are stored on those objects. The new behavior is more correct, but it is different from previous versions so care must be taken when upgrading. -
The Karaf
features.xmlfile for CXF 3.1 will no longer install spring or spring-dm when installing thecxffeature. If you require spring/spring-dm, you will need to install those features prior to installing the CXF feature.
8.1.2. Security changes
- The STS (Security Token Service) now issues tokens using the RSA-SHA256 signature algorithm by default, and the SHA-256 digest algorithm . Previously it used RSA-SHA1 and SHA-1 respectively.
-
Some security configuration tags have been renamed from
ws-security.*tosecurity.\*, as they are now shared with some of the JAX-RS stack. The old tags will continue to work as before however without any change. See the Security Configuration page for more information. - The SAML/XACML functionality previously available in the cxf-rt-security module is now in the cxf-rt-security-saml module. If you are explicitly specifying the SAML version in a SAML CallbackHandler, then this is changed in CXF 3.1 due to the migration to use OpenSAML 3.1. The version is now set on the SAMLCallback using a org.apache.wss4j.common.saml.bean.Version class. Previously there was a dependency on OpenSAML’s SAMLVersion class.
-
It is now possible to plug in custom
WS-SecurityPolicyvalidators if you wish to change the default validation logic for a particular policy.
8.1.3. New Features
-
The CXF JAX-WS code generator has a new option,
seiSuper, that can be used to specify additional super interfaces for the SEI. This makes the code nonportable to other JAX-WS containers. The primary use would be to add AutoCloseable to the interface to allow use of the clients in Java7 try with resource blocks. - New Metrics feature for collecting metrics about a CXF services. Codahale/DropWizard based collector included.
- New Throttling feature for easily throttling CXF services. Sample included that uses the Metrics component to help make the throttling decisions.
- New Logging feature for more advanced logging than the logging available in cxf-core
- New Metadata service for SAML SSO to allow you to publish SAML SSO metadata for your service provider.
The
cxffrontend to the JAX-WS code generator,-fe cxfnow generates code that is more Java7-friendly as the return type of thegetPort(…)calls is a sub-interface of the SEI that also implements AutoCloseable, BindingProvider, and Client. Code that used to look like:(AddNumbersPortType port = service.getAddNumbersPort(); ((BindingProvider)port).getRequestContext() .put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, address); port.addNumbers3(-1, 2); ((Closeable)port).close();can be replaced with:
try (AddNumbersPortTypeProxy port = service.getAddNumbersPort()) { port.getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, address); port.addNumbers3(-1, 2); }
8.1.4. Major Dependency Changes
- The Jetty based HTTP transport has been updated to support Jetty 9 as well as Jetty 8. However, support for Jetty 7 has been dropped.
- Due to the Jetty upgrade, support for running Jetty based endpoints in Karaf 2.3.x has been dropped.
- Support for using JAX-WS 2.1 based API jars has been removed. Java 7 (now required) includes JAX-WS 2.2 so this should not be an issue.
- WSS4J 2.1 is included, which in turn includes OpenSAML 3.0.
