Dependencies exclusions ignored in jboss-deployment-structure.xml in 7.0.2.Final

[fabrizio.benedetti]

I'm trying to use latest release of Wss4j (1.6.3) and xmlsec (1.4.5) in a test war. I included all jars needed in WEB-INF/lib, but jboss seems to load his xmlsec module, 1.4.4.

My environment is:

- jdk1.7.0

- AS 7.0.2.Final

- standalone profile

Here is 'jar -tf webtest.war' output:

fabrizio@:~/test/webtest$ $JAVA_HOME/bin/jar -tf webtest.war

WEB-INF/

WEB-INF/jboss-deployment-structure.xml

WEB-INF/lib/

WEB-INF/lib/bcprov-jdk15-1.46.jar

WEB-INF/lib/joda-time-1.6.2.jar

WEB-INF/lib/opensaml-2.5.1-1.jar

WEB-INF/lib/openws-1.4.2-1.jar

WEB-INF/lib/wss4j-1.6.3.jar

WEB-INF/lib/xmlsec-1.4.5.jar

WEB-INF/lib/xmltooling-1.3.2-1.jar

WEB-INF/web.xml

classfinder.jsp

Here is jboss-deployment-structure.xml:

<jboss-deployment-structure>
    <ear-subdeployments-isolated>true</ear-subdeployments-isolated>
    <deployment>
        <exclusions>
            <module name="org.apache.santuario.xmlsec"/>
        </exclusions>
    </deployment>
</jboss-deployment-structure>

According to AS7 class loading, I expect that webapps loadsall jars in WEB-INF/lib, except dependencies declared in jboss-deployment-structure.xml. Though I added the exclusion of "org.apache.santuario.xmlsec" module, jboss loads xmlsec 1.4.4 and not 1.4.5.

The war has a jsp (classfinder.jsp) and this is the output of "org.apache.xml.security.Init" class:

Location: /home/fabrizio/jboss/jboss-7/nodo1/modules/org/apache/santuario/xmlsec/main/xmlsec-1.4.4.jar

ClassLoader: ModuleClassLoader for Module "org.apache.santuario.xmlsec:main" from local module loader @633589 (roots: /home/fabrizio/jboss/jboss-7/nodo1/modules)

In attchment webtest.war.

Any idea?

Regards

/Fabrizio

[ccob]

Not sure if this is of any use, but I upgraded the WSS4j module to 1.6.3 by replacing the jar in the module folder for org.apaches.ws.security module.  This seems to work.

Unfortunetly I need to downgrate to WSS4j 1.5.8 for me needs, but that doesn't work.

[fabrizio.benedetti]

Ok, upgrading wss4j module to 1.6.3 works, but my dubt is about jboss class loading.

The documentation states:

Deployments in AS7 are also modules, and do not have access to classes that are defined in jars in the application server unless an explicit dependency on those classes is defined.

...

Even though in AS7 modules are isolated by default, as part of the deployment process some dependencies on modules defined by the application server are set up for you automatically.

...

Automatic dependencies can be excluded through the use of jboss-deployment-structure.xml.

"org.apache.santuario.xmlsec" isn't part of the list of automatic dependencies. And even if it was, why is jboss-deployment-structure.xml ignored?

This issue happens only for xmlsec module, all other modules aren't loaded, unless an explicit dependency on those modules is defined, according to the documentation.

Does xmlsec follow a different path? And, if so, why?

Regards

/Fabrizio

[rlperry]

     I am having a similar issue with removing resteasy-jackson-provider.  I would like to use jettison's BadgerFish format and Jackson gets used instead because it is in the path.  I have checked my war to be sure I am not includeing it by accedient and infact set the Maven scope for all of my RESTEasy dependencies to provided and told JBoss to exclude every RESTEasy module I found at https://docs.jboss.org/author/display/AS7/Implicit+module+dependencies+for+deployments in order to break the application and prove to myself that exclusions do work.  Unfortunantly the application still work!!!  (...still using Jackson, of course )   

<jboss-deployment-structure>

  <!-- Make sub deployments isolated by default, so they cannot see each others classes without a Class-Path entry -->

  <ear-subdeployments-isolated>true</ear-subdeployments-isolated>

  <!-- This corresponds to the top level deployment. For a war this is the war's module, for an ear -->

  <!-- This is the top level ear module, which contains all the classes in the EAR's lib folder     -->

  <deployment>

    <!-- Exclusions allow you to prevent the server from automatically adding some dependencies     -->

    <exclusions>

  <module name="org.jboss.resteasy.resteasy-atom-provider"/>

  <module name="org.jboss.resteasy.resteasy-cdi"/>

  <module name="org.jboss.resteasy.resteasy-jaxrs"/>

  <module name="org.jboss.resteasy.resteasy-jaxb-provider"/>

  <module name="org.jboss.resteasy.resteasy-jackson-provider"/>

  <module name="org.jboss.resteasy.resteasy-jsapi"/>

  <module name="org.jboss.resteasy.resteasy-multipart-provider"/>

  <module name="org.jboss.resteasy.async-http-servlet-30"/>

    </exclusions>

  </deployment>

</jboss-deployment-structure>

     In this particular case I have a workaround in that I can just sprinkle @NoJackson everywhere in my Java code.  But, this leaves me feeling like either exclusions simply do not work or I simply have no idea on how to make them work.  I would love for whichever case to be resolved.

     I really like the direction of the new classloader and love how fast everything is starting and deploying.  Very nicely done.  But, I like it much better if I can tell JBoss to back off on which classes it is prodiving so I can gain control back when I need it.

     I would appreciate any help anyone can give me on this matter.

Thanks

Rob

[pstackle]

This may be a bit late to help you, but I ran into a similar issue as described in this thread: http://community.jboss.org/message/637818.

It ended up that the container's xmlsec library was loaded in because it was declared as a dependency of the javaee.api module, which IS an automatic dependency in a lot of cases.