idp-war-3.4.4.war in Maven Repo is bad

[Dan McLaughlin]

Hey Scott,

Understood, but unfortunately someone published the idp-war artifact
to Shibboleth's Public Maven repository, and we used it.  We use the
idp-war as a dependency as part of our automated IDP application
deployment using Maven and we pull in the war as part of our build so
we can add our dependencies for our custom attribute resolver
extension.  I've worked around it for now by adding the missing
dependencies in our Maven build, so this isn't a show stopper by any
means, however I still think it should eventually be corrected on your
end because it's wrong from a Maven perspective.  The missing jar's
really are runtime dependencies for the idp-war to function if you
want to use the new UnboundIDProvider in 3.4.4  and they should be
defined as such in the idp-war pom.

The problem stems from the fact that someone added what are valid
runtime dependencies for the idp-war to the idp-distribution and then
they used a plugin to extract the runtime dependencies into the war as
part of the idp-distribution build. They actually did it for the
logging runtime dependencies and add the ldaptive dependencies into
that same plugin execution.  The current approach is contrary to
everything Maven is about, all dependencies should be defined in the
module that depends on them, not copied in using a plugin...you might
as well move back to Ant if you're going to do that.

On a side note the step to add idp.ldaptive.provider =
org.ldaptive.provider.unboundid.UnboundIDProvider to the
ldap.properties in 3.4.4 doesn't just work as the release notes would
lead you to believe.  I haven't had a chance to debug it yet, but in
short we start getting errors similar to what you'd get if you had an
invalid attribute-resolver.xml.  Remove the property and everything
works fine.

I've attached a patch that will fix the idp-war.

--

Thanks,

Dan McLaughlin
Technology Consortium, LLC
dmclaughlin at tech-consortium.com
mobile: 512.633.8086
http://www.tech-consortium.com

NOTICE: This e-mail message and all attachments transmitted with it
are for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is strictly prohibited. The contents of
this e-mail are confidential and may be subject to work product
privileges. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.

On Wed, Jun 12, 2019 at 2:37 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > Today is your lucky day, I happen to know Maven very well.  I'll send you a
> > patch file that will fix it.
>
> Nothing to fix, that artifact is not for anybody else's use.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Moved_Runtime_dependencies_for_idp-war_out_of_idp-distribution_and_into_idp-war_where_they.patch
Type: application/octet-stream
Size: 6150 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20190612/76827c32/attachment-0001.obj>