Jetty 11 integration

[moabu]

@yuriyz , @yurem , @pujavs , @jgomer2001 @nynymike @mbaser

We need to work on integrating jetty 11 to reduce the security vulnerabilities and also increase performance.

https://artifacthub.io/packages/helm/janssen-auth-server/janssen?modal=security-report

This requires some changes in the code . Take a look at this issue .

https://stackoverflow.com/a/66368511

[iromli]

Here's logs from auth-server running on Jetty 11:

jans/jetty/jans-auth/webapps/jans-auth/, jar:file:///opt/jans/jetty/jans-auth/webapps/jans-auth/WEB-INF/lib/bootsfaces-1.4.1.jar!/META-INF/resources, 
jar:file:///opt/jans/jetty/jans-auth/webapps/jans-auth/WEB-INF/lib/jans-auth-static-1.0.0-SNAPSHOT.jar!/META-INF/resources, jar:file:///opt/jans/jetty
/jans-auth/webapps/jans-auth/WEB-INF/lib/omnifaces-2.6.9.jar!/META-INF/resources, jar:file:///opt/jans/jetty/jans-auth/webapps/jans-auth/WEB-INF/lib/j
akarta.faces-2.3.14.jar!/META-INF/resources],UNAVAILABLE}{/opt/jans/jetty/jans-auth/webapps/jans-auth}
java.lang.NoClassDefFoundError: javax/servlet/ServletRequestListener
        at java.base/java.lang.ClassLoader.defineClass1(Native Method)
        at java.base/java.lang.ClassLoader.defineClass(Unknown Source)
        at java.base/java.security.SecureClassLoader.defineClass(Unknown Source)
        at java.base/java.net.URLClassLoader.defineClass(Unknown Source)
        at java.base/java.net.URLClassLoader$1.run(Unknown Source)
        at java.base/java.net.URLClassLoader$1.run(Unknown Source)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at java.base/java.net.URLClassLoader.findClass(Unknown Source)
        at org.eclipse.jetty.webapp.WebAppClassLoader.foundClass(WebAppClassLoader.java:594)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadAsResource(WebAppClassLoader.java:567)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:502)
        at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
        at org.eclipse.jetty.server.handler.ContextHandler$Context.addListener(ContextHandler.java:2475)
        at org.eclipse.jetty.servlet.ServletContextHandler$Context.addListener(ServletContextHandler.java:1502)
        at org.apache.jasper.servlet.JasperInitializer.onStartup(JasperInitializer.java:92)
        at org.eclipse.jetty.servlet.ServletContainerInitializerHolder.doStart(ServletContainerInitializerHolder.java:148)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
        at org.eclipse.jetty.servlet.ServletContextHandler$ServletContainerInitializerStarter.doStart(ServletContextHandler.java:1660)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:369)
        at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1305)
  at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:896)
        at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:306)
        at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:533)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:40)
        at org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:183)
        at org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:516)
        at org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:151)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:186)
        at org.eclipse.jetty.deploy.providers.WebAppProvider.fileAdded(WebAppProvider.java:462)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:58)
        at org.eclipse.jetty.util.Scanner$DiscreteListener.pathAdded(Scanner.java:282)
        at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:836)
        at org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:802)
        at org.eclipse.jetty.util.Scanner.scan(Scanner.java:709)
        at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:597)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:158)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:605)
        at org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:246)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.server.Server.start(Server.java:469)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
        at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:89)
        at org.eclipse.jetty.server.Server.doStart(Server.java:414)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.xml.XmlConfiguration.lambda$main$4(XmlConfiguration.java:1872)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1810)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.eclipse.jetty.start.Main.invokeMain(Main.java:228)
        at org.eclipse.jetty.start.Main.start(Main.java:513)
        at org.eclipse.jetty.start.Main.main(Main.java:75)
Caused by: 
java.lang.ClassNotFoundException: javax.servlet.ServletRequestListener
        at java.base/java.net.URLClassLoader.findClass(Unknown Source)
        at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
        at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:511)
        at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
        at java.base/java.lang.ClassLoader.defineClass1(Native Method)
        at java.base/java.lang.ClassLoader.defineClass(Unknown Source)
        at java.base/java.security.SecureClassLoader.defineClass(Unknown Source)
        at java.base/java.net.URLClassLoader.defineClass(Unknown Source)
        at java.base/java.net.URLClassLoader$1.run(Unknown Source)
        at java.base/java.net.URLClassLoader$1.run(Unknown Source)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at java.base/java.net.URLClassLoader.findClass(Unknown Source)
        at org.eclipse.jetty.webapp.WebAppClassLoader.foundClass(WebAppClassLoader.java:594)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadAsResource(WebAppClassLoader.java:567)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:502)
        at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
at org.eclipse.jetty.server.handler.ContextHandler$Context.addListener(ContextHandler.java:2475)
        at org.eclipse.jetty.servlet.ServletContextHandler$Context.addListener(ServletContextHandler.java:1502)
        at org.apache.jasper.servlet.JasperInitializer.onStartup(JasperInitializer.java:92)
        at org.eclipse.jetty.servlet.ServletContainerInitializerHolder.doStart(ServletContainerInitializerHolder.java:148)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
        at org.eclipse.jetty.servlet.ServletContextHandler$ServletContainerInitializerStarter.doStart(ServletContextHandler.java:1660)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:369)
        at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1305)
        at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:896)
        at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:306)
        at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:533)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:40)
        at org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:183)
        at org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:516)
        at org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:151)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:186)
        at org.eclipse.jetty.deploy.providers.WebAppProvider.fileAdded(WebAppProvider.java:462)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:58)
        at org.eclipse.jetty.util.Scanner$DiscreteListener.pathAdded(Scanner.java:282)
        at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:836)
        at org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:802)
        at org.eclipse.jetty.util.Scanner.scan(Scanner.java:709)
        at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:597)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
        at org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:158)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:605)
        at org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:246)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:171)
        at org.eclipse.jetty.server.Server.start(Server.java:469)
        at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
        at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:89)
        at org.eclipse.jetty.server.Server.doStart(Server.java:414)
        at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:93)
        at org.eclipse.jetty.xml.XmlConfiguration.lambda$main$4(XmlConfiguration.java:1872)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1810)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.eclipse.jetty.start.Main.invokeMain(Main.java:228)
        at org.eclipse.jetty.start.Main.start(Main.java:513)
        at org.eclipse.jetty.start.Main.main(Main.java:75)

[jgomer2001]

jans and gluu install supports jetty-11

main issue is to find working mix of libs

We can upgrade:

• weld 5 (it's cdi 3.0) which works with jakarta
• resteasy 6? (Jakarta RESTful Web Services 3.0)

[pujavs]

Upgrading Jans Jetty projects to Jetty 11

Jetty 11 is major change as a result of the move from Java EE to Jakarta EE as part of the transfer of Java EE to the Eclipse Foundation, the primary package for all implemented APIs has changed from javax.* to jakarta.*.
This will almost certainly require code changes to enable applications to migrate to Jetty 11.x and later
Details can be found here

Analysis:
A) lib upgrade required

1. jetty
2. jakarta.servlet-api
3. weld

B) Finding:

1. Exiting code with jetty upgrade to 11.0.8 & weld 4.0.3.Final gives java.lang.ClassNotFoundException: javax.servlet.ServletRequestListener Logs: 2022_03_01.jetty.log
2. With jetty upgrade to 11.0.8, weld 4.0.3.Final & jakarta.servlet-api 4.0.4 gives org.xml.sax.SAXParseException; lineNumber: 8; columnNumber: 26; Attribute value "webAppCtx" of type ID must be unique within the document. Logs: 2022_03_02.jetty.log
3. With jetty upgrade to 11.0.8, weld 4.0.3.Final & jakarta.servlet-api 5.0.0 we get compile error due to namespace change from javax to jakarta from jakarta.servlet-api 5.0.0 onwards
   Logs: compile_error.log

[moabu]

We are tracking changes in https://github.com/JanssenProject/jans/tree/jans-jetty-upgrade

[yuriyz]

I propose to move to stable 4.0.3.Final. In this case we will get namespace updated and can move to newer jetty. Switching to next Weld would be easier and we don't become beta testers of Weld 5.x release candidate.

[yuriyz]

Important is to target particular Weld and resteasy version so we don't mess classpath. During this migration we should discover all places where we don't rely on jans-bom.

[pujavs]

Jetty_Upgrade_Details.xlsx: Jetty_Upgrade_Details.xlsx

List of lib to be replaced due to transition from Java EE to Jakarta

[moabu]

Getting there... https://github.com/JanssenProject/jans/tree/jans-jetty-upgrade

We should be able to get this in quickly

[moabu]

building docker images and scanning....

[moabu]

jetty 11 made it to our main branch!