spring-ws-security OSGi dependencies hard to come by

[David Arnold]

I'm trying to use the spring-ws-security library 2.0.0.RELEASE (which has a good set of OSGi headers, thanks for that) on Eclipse Virgo 2.1.0.RELEASE. I'm running into problems resolving the non-optional com.sun imported packages (and their dependencies). After realizing that the xwss.dev.java.net site appears to be unmaintained, I searched around and found a download for Metro 2.0 that has the packages, but they depend on some com.ibm.security.util packages. I've read, anecdotally, that these are just part of Glassfish v3 - which I won't be using.

I've tested successfully (outside OSGi) using wss4j interceptors, and I'm not using XWSS. Is there any way around the dependency? I really don't want to continue my trip down the quasi-proprietary rabbit hole, especially since Oracle's purchase of Sun.

[David Arnold]

I managed to get around XWSS issues by hand-editing the spring-ws-security.jar manifest to make the XWSS packages resolution:="optional".

Then it wanted to resolve package dependencies on Spring Security [2.0.0, 3.0.0). Those versions of Spring Security are based on Spring 2.5. Spring WS 2.0.0.RELEASE itself wants Spring 3.0.5, no lesser. So I updated the version deps by hand to point at Spring Security [3.0.0, 4.0.0).

Now I've hit the real wall. The spring-ws-security jar file is a bundle. The spring-ws-core jar file is NOT. The core MANIFEST.MF is pretty simplistic.

Upshot, Spring WS 2.0.0.RELEASE does not support OSGi deployments.

[David Arnold]

Turns out the incomplete MANIFEST.MF in spring-ws-core 2.0.0.RELEASE is a packaging error. The milestone version on Maven Central has a complete one, the release does not. Hope that gets fixed some day. Copying the milestone manifest and editing the version wiring by hand makes it work.