Darran Lofthouse

https://issues.redhat.com/browse/WFCORE-5466

[31.x] [WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build.

1

Although we have no releases planned from the 31.x branch I am proposing we add the plugin there now as well so we can see how 31.x compares to ongoing...

https://issues.redhat.com/browse/WFLY-14735

https://issues.redhat.com/browse/WFCORE-5532

Security / Wrapped - Propagation

10

I am just submitting this as a draft to begin with for discussion. Trying to support context propagation in WildFly one of the issues we encounter is needing to wrap...

java.security.Provider contention

5

I have just been performing some profiling with SmallRye JWT within WildFly, the test has been pretty primitive hitting the server hard with simple HTTP requests containing a JWT token....

This is to port the changes from https://github.com/eclipse-ee4j/soteria/issues/327 to the 3.0 branch.

In WildFly this leads to WARN messages such as: ``` 15:20:20,039 WARN [org.jboss.resteasy.client.jaxrs.i18n] (Cleaner-0) RESTEASY004687: Closing a class org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine$CleanupAction instance for you. Please close clients yourself. 15:20:20,040 WARN [org.jboss.resteasy.client.jaxrs.i18n] (Cleaner-0)...

Adjust SecurityContextImpl to use ServiceLoader discovery for CallerDetailsResolver and ResourceAccessResolver

5

The server implementation may wish to be a complete implementation but at the very least it will be desirable to provide custom implementations of CallerDetailsResolver and ResourceAccessResolver.

The OpenID Connect implementation and related beans are eagerly loaded even when not required.

2

It would be better to review how much needs to be eagerly loaded and how much can be deferred until deemed necessary for the deployment. Although identified due to the...