Update target JDK to 17 and move to JakartaEE 10 (Pax Web 11)

.github/workflows/build.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        java: [ '8', '11', '17', '21', '24' ]
+        java: [ '17', '21', '24' ]
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
       fail-fast: false
     steps:

.github/workflows/deploy.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Java for publishing to Maven Central Repository OSS
         uses: actions/setup-java@v4
         with:
-          java-version: '8'
+          java-version: '17'
           distribution: 'temurin'
           server-id: ossrh
           server-username: MAVEN_USERNAME

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Java for publishing to Maven Central Repository OSS
         uses: actions/setup-java@v4
         with:
-          java-version: '8'
+          java-version: '17'
           distribution: 'temurin'
           server-id: ossrh
           server-username: MAVEN_USERNAME

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version                            | Java Versions Support | EE         | Supported                                     |
+|------------------------------------|-----------------------|------------|-----------------------------------------------|
+| Open Identity Platform OpenIDM 7.x | 17 and later          | Jakarta EE | :white_check_mark:                            |
+| Open Identity Platform OpenIDM 6.x | 8 and later           | Java EE    | :white_check_mark:                            |
+| Open Identity Platform OpenIDM 5.x | 8 and later           | Java EE    | :white_check_mark:                            |
+| ForgeRock OpenIDM 5.x              | 8 and later           | Java EE    | :x: upgrade to Open Identity Platform OpenIDM |
+| ForgeRock OpenIDM 4.x              | 1.7, 8 and later      | Java EE    | :x: upgrade to Open Identity Platform OpenIDM |
+
+## Reporting a Vulnerability
+
+Please create issue https://github.com/OpenIdentityPlatform/OpenIDM/issues/new?template=Bug_report.md

custom-scripted-connector-bundler/pom.xml

@@ -29,12 +29,12 @@
     <parent>
         <groupId>org.openidentityplatform.openidm</groupId>
         <artifactId>openidm-project</artifactId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
 
     <groupId>org.openidentityplatform.openidm.tools</groupId>
     <artifactId>custom-scripted-connector-bundler</artifactId>
-    <version>6.3.1-SNAPSHOT</version>
+    <version>7.0.0-SNAPSHOT</version>
     <name>OpenIDM Custom Scripted Groovy Connector Bundler</name>
     <description>This is a tool to bundle the Groovy connector using configured bundle name and configuration
         parameters without the user needing to write connector code manually (aside from the Groovy scripts).
@@ -94,13 +94,7 @@
         <dependency>
             <groupId>com.github.jknack</groupId>
             <artifactId>handlebars</artifactId>
-            <version>2.0.0</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.mozilla</groupId>
-                    <artifactId>rhino</artifactId>
-                </exclusion>
-            </exclusions>
+            <version>4.4.0</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>

openidm-api-servlet/pom.xml

@@ -13,14 +13,14 @@
   ~ information: "Portions copyright [year] [name of copyright owner]".
   ~
   ~ Copyright 2013-2016 ForgeRock AS.
-  ~ Portions Copyrighted 2024 3A Systems LLC.
+  ~ Portions Copyrighted 2024-2025 3A Systems LLC.
   -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <parent>
         <groupId>org.openidentityplatform.openidm</groupId>
         <artifactId>openidm-project</artifactId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
     <artifactId>openidm-api-servlet</artifactId>
     <packaging>bundle</packaging>
@@ -94,8 +94,8 @@
 
         <!-- Provided Dependencies -->
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
             <scope>provided</scope>
         </dependency>
 

openidm-api-servlet/src/main/java/org/forgerock/openidm/servlet/internal/ErrorServletComponent.java

@@ -12,21 +12,21 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
- * Portions Copyrighted 2024 3A Systems LLC.
+ * Portions Copyrighted 2024-2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.servlet.internal;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import java.io.IOException;
 import java.util.Dictionary;
 import java.util.Hashtable;
 
-import org.eclipse.jetty.servlet.ErrorPageErrorHandler;
+import org.eclipse.jetty.ee10.servlet.ErrorPageErrorHandler;
 import org.forgerock.openidm.jetty.JettyErrorHandler;
 import org.forgerock.openidm.servletregistration.ServletRegistration;
 import org.ops4j.pax.web.service.WebContainer;
@@ -36,7 +36,7 @@
 import org.osgi.service.component.annotations.ConfigurationPolicy;
 import org.osgi.service.component.annotations.Deactivate;
 import org.osgi.service.component.annotations.Reference;
-import org.osgi.service.http.NamespaceException;
+import org.ops4j.pax.web.service.http.NamespaceException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -81,14 +81,14 @@ protected void doGet(final HttpServletRequest request, final HttpServletResponse
         logger.info("Registered servlet at {}", ERROR_SERVLET_ALIAS);
 
         httpService.registerErrorPage(ErrorPageErrorHandler.GLOBAL_ERROR_PAGE, ERROR_SERVLET_ALIAS,
-                httpService.getDefaultSharedHttpContext());
+                servletRegistration.getContext());
     }
 
     @Deactivate
     protected synchronized void deactivate(ComponentContext context) {
         servletRegistration.unregisterServlet(errorServlet);
         httpService.unregisterErrorPage(ErrorPageErrorHandler.GLOBAL_ERROR_PAGE,
-                httpService.getDefaultSharedHttpContext());
+                servletRegistration.getContext());
     }
 
 }

openidm-api-servlet/src/main/java/org/forgerock/openidm/servlet/internal/ServletComponent.java

@@ -12,7 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2016 ForgeRock AS.
- * Portions Copyrighted 2024 3A Systems LLC.
+ * Portions Copyrighted 2024-2025 3A Systems LLC.
  */
 package org.forgerock.openidm.servlet.internal;
 
@@ -27,8 +27,8 @@
 import java.util.concurrent.CopyOnWriteArrayList;
 
 import javax.script.ScriptException;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
 
 import org.forgerock.http.ApiProducer;
 import org.forgerock.http.DescribedHttpApplication;
@@ -64,7 +64,7 @@
 import org.osgi.service.event.Event;
 import org.osgi.service.event.EventHandler;
 import org.osgi.service.event.propertytypes.EventTopics;
-import org.osgi.service.http.NamespaceException;
+import org.ops4j.pax.web.service.http.NamespaceException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 

openidm-audit/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>org.openidentityplatform.openidm</groupId>
         <artifactId>openidm-project</artifactId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
     <artifactId>openidm-audit</artifactId>
     <packaging>bundle</packaging>

openidm-audit/src/main/java/org/forgerock/openidm/audit/impl/RepositoryAuditEventHandler.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions copyright 2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.audit.impl;
@@ -21,7 +22,7 @@
 import static org.forgerock.json.resource.Requests.newReadRequest;
 import static org.forgerock.util.promise.Promises.newResultPromise;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 import org.forgerock.audit.Audit;
 import org.forgerock.audit.AuditingContext;

openidm-audit/src/main/java/org/forgerock/openidm/audit/impl/RouterAuditEventHandler.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions copyright 2025 3A Systems LLC.
  */
 package org.forgerock.openidm.audit.impl;
 
@@ -23,7 +24,7 @@
 import static org.forgerock.util.promise.Promises.newResultPromise;
 import static org.forgerock.util.query.QueryFilter.equalTo;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.List;
 

openidm-authnfilter/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>org.openidentityplatform.openidm</groupId>
         <artifactId>openidm-project</artifactId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
     <artifactId>openidm-authnfilter</artifactId>
     <name>OpenIDM Authentication Filter</name>
@@ -71,7 +71,7 @@
         <!-- Third party dependencies -->
         <dependency>
             <groupId>org.ops4j.pax.web</groupId>
-            <artifactId>pax-web-jetty-bundle</artifactId>
+            <artifactId>pax-web-jetty</artifactId>
         </dependency>
 
         <!-- Forgerock commons dependencies -->

openidm-authnfilter/src/main/java/org/forgerock/openidm/auth/AuthenticationService.java

@@ -12,7 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2016 ForgeRock AS
- * Portions Copyrighted 2024 3A Systems LLC.
+ * Portions copyright 2024-2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.auth;
@@ -27,7 +27,7 @@
 import static org.forgerock.openidm.auth.modules.IDMAuthModuleWrapper.*;
 import static org.forgerock.openidm.idp.impl.IdentityProviderService.withoutClientSecret;
 
-import javax.inject.Provider;
+import jakarta.inject.Provider;
 import java.io.UnsupportedEncodingException;
 import java.security.Key;
 import java.util.ArrayList;

openidm-authnfilter/src/main/java/org/forgerock/openidm/auth/AuthenticatorFactory.java

@@ -12,11 +12,12 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2015 ForgeRock AS.
+ * Portions copyright 2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.auth;
 
-import javax.inject.Provider;
+import jakarta.inject.Provider;
 
 import com.google.common.base.Function;
 import org.forgerock.json.JsonValue;

openidm-authnfilter/src/main/java/org/forgerock/openidm/auth/PassthroughAuthenticator.java

@@ -12,13 +12,14 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2015 ForgeRock AS.
+ * Portions copyright 2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.auth;
 
 import static org.forgerock.util.Reject.checkNotNull;
 
-import javax.inject.Provider;
+import jakarta.inject.Provider;
 
 import org.forgerock.json.resource.ActionResponse;
 import org.forgerock.json.resource.ConnectionFactory;

openidm-authnfilter/src/main/java/org/forgerock/openidm/auth/ResourceQueryAuthenticator.java

@@ -12,13 +12,14 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2011-2015 ForgeRock AS.
+ * Portions copyright 2024-2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.auth;
 
 import static org.forgerock.json.resource.ResourceException.newResourceException;
 
-import org.eclipse.jetty.jaas.spi.UserInfo;
+import org.eclipse.jetty.security.UserPrincipal;
 import org.eclipse.jetty.util.security.Password;
 import org.forgerock.json.crypto.JsonCryptoException;
 import org.forgerock.json.resource.ConnectionFactory;
@@ -35,7 +36,7 @@
 
 import java.util.HashSet;
 import java.util.Set;
-import javax.inject.Provider;
+import jakarta.inject.Provider;
 
 /**
  * Authenticator class which performs authentication against managed/internal user tables using a queryId to fetch
@@ -111,11 +112,11 @@ public AuthenticatorResult authenticate(String username, String password, Contex
                     throw new InternalServerErrorException(jce.getMessage(), jce);
                 }
             } else {
-                final UserInfo userInfo = getRepoUserInfo(username, resource);
+                final UserPrincipal userInfo = getRepoUserInfo(username, resource);
                 if (userInfo == null) {
                     // getResource already logged why
                     return AuthenticatorResult.FAILED;
-                } else if (userInfo.checkCredential(password)) {
+                } else if (userInfo.authenticate(password)) {
                     logger.debug("Authentication succeeded for {}", username);
                     return AuthenticatorResult.authenticationSuccess(resource);
                 }
@@ -159,7 +160,7 @@ private ResourceResponse getResource(String username, Context context) throws Re
         return result.iterator().next(); // the retrieved resource
     }
 
-    private UserInfo getRepoUserInfo(String username, ResourceResponse resource) throws ResourceException {
+    private UserPrincipal getRepoUserInfo(String username, ResourceResponse resource) throws ResourceException {
         final CryptoService cryptoService = cryptoServiceProvider.get();
         if (cryptoService == null) {
             throw new InternalServerErrorException("No CryptoService available");
@@ -171,6 +172,6 @@ private UserInfo getRepoUserInfo(String username, ResourceResponse resource) thr
         final String retrievedCred =
                 cryptoService.decryptIfNecessary(resource.getContent().get(userCredentialProperty)).asString();
 
-        return new UserInfo(username, new Password(retrievedCred), null);
+        return new UserPrincipal(username, new Password(retrievedCred));
     }
 }

openidm-authnfilter/src/main/java/org/forgerock/openidm/auth/modules/ClientCertAuthModule.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2014-2016 ForgeRock AS.
+ * Portions copyright 2025 3A Systems LLC.
  */
 
 package org.forgerock.openidm.auth.modules;
@@ -213,7 +214,7 @@ private boolean usernameMatchesPatterns(String username) {
     // This is currently Jetty specific
     private X509Certificate[] getClientCerts(Context context) {
         Map<String, Object> requestAttributes = context.asContext(AttributesContext.class).getAttributes();
-        Object checkCerts = requestAttributes.get("javax.servlet.request.X509Certificate");
+        Object checkCerts = requestAttributes.get("jakarta.servlet.request.X509Certificate");
         if (checkCerts instanceof X509Certificate[]) {
             return (X509Certificate[]) checkCerts;
         } else {

openidm-cluster/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <artifactId>openidm-project</artifactId>
         <groupId>org.openidentityplatform.openidm</groupId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
     <artifactId>openidm-cluster</artifactId>
     <packaging>bundle</packaging>

openidm-config/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>org.openidentityplatform.openidm</groupId>
         <artifactId>openidm-project</artifactId>
-        <version>6.3.1-SNAPSHOT</version>
+        <version>7.0.0-SNAPSHOT</version>
     </parent>
     <artifactId>openidm-config</artifactId>
     <packaging>bundle</packaging>