Migrate to Wildfly 26.1.3.Final#3508
Open
lbschanno wants to merge 38 commits into
Open
Conversation
Migrate Datawave to Wildfly 26.1.3.Final. Additionally, migrate Datawave's security APIs to leverage Wildfly's Elytron framework instead of Picketbox. Closes #2747
alerman
reviewed
Apr 14, 2026
alerman
reviewed
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrate Datawave to use Wildfly 26.1.3.Final. Additionally, migrate Datawave's security APIs to leverage Wildfly's Elytron security framework instead of Picketbox. Wildfly 26 was chosen due to being Java 17 compatible, but also compatible with Jakarta EE 8 to minimize migration concerns.
Structural Changes
A number of commonly-used security classes were relocated to a new project: /commons/security (datawave-commons-security). This project is used by the Datawave webservices and microservices. An overview can be found in the datawave-commons-security README.
The project /webservices/security was converted to a parent project and now has three sub-projects. An overview of the projects can be found in the datawave-ws-security-parent README.
Migration from Picketbox to Elytron
Wildfly dropped support for Picketbox as of Wildfly 25. As a result, we are required to migrate our security solutions to leverage Elytron. The bulk of the new classes that replace the old Picketbox APIs live in webservices/security/datawave-ws-security-elytron-module, and the README there goes into detail about the custom Elytron components implemented there.
JBOSS/Wildfly Modules
Custom Elytron components are required to be deployed within separate Wildfly modules. This means they cannot be packaged with the Datawave EAR deployment. As a result, a number of libraries commonly used between the Datawave Elytron module and the Datawave EAR deployment also had to be moved to their own JBOSS modules to manage classloader conflicts. More details in the datawave-ws-deploy-application README.
Request Start and Login Time Headers
Wildfly does not expose methods in the HttpServerRequest for adding request headers like we previously could in the old DatawaveAuthenticationMechanism class. To add these headers now, a ServletExtension is now used to modify the incoming request before and after it hits the authentication handlers.
datawave.security.servlet.HeaderEnrichmentServletExtension: This adds handlers to modify the incoming request.datawave.security.servlet.RequestStartTimeHeaderHandler: Adds theX-Internal-RequestStartTimeNanosheader.datawave.security.servlet.RequestLoginTimeHeaderHandler: Adds theX-Internal-RequestLoginTimeMillisheader.DnUtils and ProxiedEntityUtils
The classes
datawave.security.util.ProxiedEntityUtils,datawave.security.util.DnUtils, anddatawave.microservice.security.util.DnUtilswere combined into a single class:datawave.security.util.DnUtilsin the datawave-commons-security project since they all referenced each other interchangeably.Additionally, DnUtils was refactored to not require any external configuration. Instead, when loading a subject DN pattern and NPE OU list, it can be done with the class
datawave.security.util.DnProperties, which can be created via a constructor, or a default instance can be loaded from a properties file/system properties, and supplied to the DNUtils methods as needed.Additional changes of note:
The use of several classes needed to be replaced to be compatible with Jakarta EE 8:
Several dependencies needed to be updated to be compatible with Jakarta EE 8 and Wildfly 26:
CI Workflow Notes
Deployed the following RC versions of certain dependencies to allow the microservices CI workflows to pass:
Closes #2747