WebAPI 2.15.0 Docker Image

Developers
1

Hi there,

I just updated the WebAPI Docker Image to 2.15.0. I am using OpenID auth security. When I try to sign in I get the following log in the WebAPI. Can somebody confirm this behavior or have I missed something and should adjust my config?

Best regards,
Mirko

webapi.txt (11.7 KB)

2

The root of the error is this:

webapi_1  | Caused by: java.lang.NoSuchMethodError: org.pac4j.oidc.client.OidcClient.getCodeVerifierSessionAttributeName()Ljava/lang/String;
webapi_1  | 	at org.pac4j.oidc.redirect.OidcRedirectionActionBuilder.addStateAndNonceParameters(OidcRedirectionActionBuilder.java:112) ~[pac4j-oidc-4.5.5.jar!/:?]

NoSuchMethodError is caused by compiled code looking for this method but the runtime doesn’t have it available. Very odd, but I did some searching and uncovered some things…

I ran the maven dependency tree command to get the set of dependencies loaded, and specifically i’m looking for where pac4j core comes in:

+- io.buji:buji-pac4j:jar:5.0.1:compile
|  \- org.pac4j:pac4j-core:jar:4.0.1:compile

We want the 4.5 version of pac4j, but that version of buji-pack4j seems to want to use 4.0. I think this is what is causing the error.

It looks like this commit that updated dependencies via a dependabot update caused the pac4j library to bump to 4.5, but there’s an underlying dependency on another security depenedency called ‘shiro’ that wants it to be 4.0. Therefore, we should push a hotfix that will rever this dependency back to 4.0.

Apologies for that, let me produce a hotfix and release.

3

I’ve created the branch pac4j-hotfix-4.0 that I was hoping you would be able to build the docker container from before I make a formal release with this change. Could you try it in your own environment?

4

Hi @Chris_Knoll,

sorry for the delay. Just tried it out and I can confirm that the fix solves my problem :+1:

1 Like