This is an automated email from the ASF dual-hosted git repository. jungm pushed a commit to branch ee11 in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit 9748783bd827ec3d514448ea93fed46d86fed658 Author: Markus Jung <[email protected]> AuthorDate: Sat Jul 18 23:18:24 2026 +0200 Register the Authentication spi provider under Tomcat's app-context naming The spi module registered its test AuthConfigProvider under GlassFish app-context-ids (server /spitests_servlet_web), but Tomcat derives the JASPIC app-context-id as getVirtualServerName() + " " + contextPath (Catalina/localhost /spitests_servlet_web), so no provider matched and the server-side SAM never ran, failing every ServletProfileSPITest assertion. Rewrite the HttpServlet app-context-ids in spi/common/ProviderConfiguration.xml and pin the matching logical.hostname.servlet for the client-side assertions (jakartaee/authentication#220). ServletProfileSPITest now passes 56 of its 57 assertions; only CheckMsgInfoKey stays excluded, a TCK challenge (jakartaee/authentication#219) that hard-codes a Jakarta Authorization requirement the Web Profile does not mandate. --- KNOWN_ISSUES.md | 20 +++++-- runner-standalone/README.md | 2 +- runner-standalone/authentication/pom.xml | 14 +++++ .../src/test/resources/tomee-remote-profile.xml | 2 +- runner-standalone/exclusions/authentication.txt | 67 ++++------------------ 5 files changed, 42 insertions(+), 63 deletions(-) diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md index b4832d3..ef31bff 100644 --- a/KNOWN_ISSUES.md +++ b/KNOWN_ISSUES.md @@ -38,7 +38,7 @@ Detail lives next to each runner: | jsonb | 295 tests, 1 F + 1 E | 2 tests | 2 Johnzon 2.1.0 gaps | | debugging | passes (4 SMAPs validated) | — | — | | security | 132 tests, 5 F + 2 E; signature test passes | 7 tests | TomEE Jakarta Security | -| authentication | 105 tests, 50 F; signature test passes | 50 methods (spi) | Tomcat AuthConfigFactory SPI | +| authentication | 106 tests, 1 F; signature test passes | 1 method (spi `CheckMsgInfoKey`) | TCK challenge #219 (hard-codes a JACC requirement) | | websocket | 737 tests, 3 E | 3 methods | Client container advertises permessage-deflate in the negotiated extension lists | | faces (modern modules) | 263 tests on record, 9 F + 30 E | 39 tests | TomEE faces-config parsing + Mojarra integration | | faces-old (JavaTest) | 5,391 tests, all pass (recorded run: 5 F from a foreign server answering :8080 mid-run; pass on re-run) | — | — (standalone mode, no exclusions) | @@ -142,9 +142,21 @@ Need triage/fixes in the upstream projects TomEE ships. not implemented; assorted observer/interceptor edge cases. Drives the [cdi.txt](runner-standalone/exclusions/cdi.txt) and most of the [cdi-ee.txt](runner-standalone/exclusions/cdi-ee.txt) lists. -2. **Tomcat Jakarta Authentication SPI** — `ServletProfileSPITest` fails 50 - of 57 AuthConfigFactory/ServerAuthConfig conformance assertions. - [authentication.txt](runner-standalone/exclusions/authentication.txt). +2. **Jakarta Authentication SPI (`ServletProfileSPITest`)** — the runner + registers the TCK's test `AuthConfigProvider` under Tomcat's JASPIC + app-context naming (`Catalina/localhost /spitests_servlet_web`, the value + `getVirtualServerName() + " " + contextPath` yields), so Tomcat's + `AuthConfigFactory` hands the request to the test SAM and 56 of the 57 + servlet-profile SPI assertions pass against Tomcat's implementation. The + patch rewrites the GlassFish-style `server /...` app-context-ids in + `spi/common/ProviderConfiguration.xml` and sets the matching + `logical.hostname.servlet` for the client-side assertions + (jakartaee/authentication#220). The one exclusion, + `ServletProfileSPITest#CheckMsgInfoKey`, is a TCK challenge + (jakartaee/authentication#219): it hard-codes a Jakarta Authorization + (JACC) requirement — it expects the HttpServlet `MessageInfo` to carry the + `jakarta.security.jacc.PolicyContext` key — which the Web Profile does not + mandate. [authentication.txt](runner-standalone/exclusions/authentication.txt). 3. **Johnzon/CXF integration** — CDI injection into `@JsonbTypeDeserializer` fields, JSON-P scalar writers, Bean Validation interceptors, and CDI resource-class handling in the REST stack diff --git a/runner-standalone/README.md b/runner-standalone/README.md index df31c52..40b898e 100644 --- a/runner-standalone/README.md +++ b/runner-standalone/README.md @@ -59,7 +59,7 @@ derived from; with the default exclusions applied these suites run green. | Validation 3.1 | EFTL zip (installed as `jakarta.validation:validation-tck-tests:3.1.1`) | `validation` | **Runs: 1,049 tests, 0 failures, no exclusions; the mandatory API signature test runs and passes** against the `jakarta.validation` packages the Plume distribution ships. Needs AssertJ 3.7.0 pinned (the published TCK jar is compiled against its covariant signatures) and the JAXB RI pinned as `jakarta.xml.bind.JAXBContextFactory` in the server JVM (Plume ships both MOXy and the RI; [...] | WebSocket 2.2 | EFTL zip (installed as `jakarta.tck:websocket-tck-spec-tests:2.2.0`) | `websocket` | **Runs: 737 tests, 0 failures, 3 errors** (2026-07-18) against Tomcat's WebSocket implementation, driven through the `tomcat-websocket` client container; the signature test passes. The negative-deployment classes run and pass: an invalid server endpoint aborts the whole webapp deployment as the spec requires, and the runner's Arquillian extension (`NegativeDeploymentToleranceObserver`) [...] | Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...] -| Authentication 3.1 | Source reactor zip 3.1.2 | `authentication` (Maven module) | **Runs: 12 Web Profile modules plus the signature test; green with the reviewed exclusions (all 13 invoker projects pass, 0 failures, verified end-to-end 2026-07-18)**. The spi module's 50 excluded assertions are Tomcat AuthConfigFactory SPI conformance gaps — product results to triage. The signature test passes against `org.apache.tomcat:tomcat-jaspic-api` (the distribution's `lib/jaspic-api.jar`), with [...] +| Authentication 3.1 | Source reactor zip 3.1.2 | `authentication` (Maven module) | **Runs: 12 Web Profile modules plus the signature test; green with the reviewed exclusions (all 13 invoker projects pass, 0 failures, verified end-to-end 2026-07-18)**. The spi module registers the TCK's test `AuthConfigProvider` under Tomcat's JASPIC app-context naming (`Catalina/localhost /spitests_servlet_web`), so `ServletProfileSPITest` runs against Tomcat's `AuthConfigFactory` and passes 56 of its 5 [...] | Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules — 263 tests on record, 9 failures + 30 errors** (2026-07-18) on Plume's Mojarra. The dominant product finding: TomEE's faces-config.xml unmarshaller rejects the `xsi:schemaLocation` attribute used by Faces 4.1 descriptors, failing those deployments (the 31 class exclusions in `exclusions/faces.txt`). The `faces-signaturetest` module runs in the same invoker pass and passes against the Moja [...] | Faces 4.1 (legacy old-tck) | Source reactor zip 4.1.2 (old-tck built from bundled sources) | `faces-old` (Maven module) | **Passes 5,391/5,391 (standalone mode, no exclusions)** (2026-07-18). The recorded full run shows 5 failures in `htmloutcometargetbutton`, all from a foreign server answering port 8080 mid-run; they pass on re-run against TomEE. The JavaTest half deploys through the TCK's own `tomcat` handler (WAR copy into `webapps/`) against a TomEE instance the runner provisions [...] | JSON Processing 2.1 | `jakarta.json:jakarta.json-tck-*:2.1.1` (Maven Central; byte-identical to the EFTL zip pinned in `environment/versions.env`) | `jsonp` | **Passes 197/197** (2026-07-18) against Apache Johnzon 2.1.0, the JSON-P provider bundled in the TomEE Plume snapshot: 179 functional + signature tests and 18 pluggability tests. The signature test checks the `jakarta.json` packages of the distribution's `jakartaee-api` jar | diff --git a/runner-standalone/authentication/pom.xml b/runner-standalone/authentication/pom.xml index fb87111..cfde2ce 100644 --- a/runner-standalone/authentication/pom.xml +++ b/runner-standalone/authentication/pom.xml @@ -96,6 +96,20 @@ does not exist during the parent-only install. --> <replace file="${authentication.tck.dir}/pom.xml" token="<phase>verify</phase>" value="<phase>none</phase>"/> + <!-- The spi module registers its test AuthConfigProvider under + GlassFish app-context-ids ("server /spitests_servlet_web"). + Tomcat derives the JASPIC app-context-id from + getVirtualServerName() + " " + contextPath, i.e. + "Catalina/localhost /spitests_servlet_web", so no provider + matches and the server-side SAM never runs. Rewrite the + HttpServlet registrations to Tomcat's naming (see + jakartaee/authentication#220). logical.hostname.servlet in + the tomee-remote profile carries the matching client-side + value. --> + <replace file="${authentication.tck.dir}/spi/common/ProviderConfiguration.xml" + token="server /spitests_servlet_web" + value="Catalina/localhost /spitests_servlet_web"/> + <!-- Anchor the Maven wrapper's multi-module root inside the extracted TCK so its internal path properties resolve against the TCK, not this repository. --> diff --git a/runner-standalone/authentication/src/test/resources/tomee-remote-profile.xml b/runner-standalone/authentication/src/test/resources/tomee-remote-profile.xml index e56ec3c..7b59965 100644 --- a/runner-standalone/authentication/src/test/resources/tomee-remote-profile.xml +++ b/runner-standalone/authentication/src/test/resources/tomee-remote-profile.xml @@ -88,7 +88,7 @@ <log.file.name.test>authentication-tck-test.log</log.file.name.test> <log.file.name.webapp>authentication-tck-webapp.log</log.file.name.webapp> <log.file.location>${authentication.tck.logs}</log.file.location> - <logical.hostname.servlet>server</logical.hostname.servlet> + <logical.hostname.servlet>Catalina/localhost</logical.hostname.servlet> <tomee.catalina_opts>-Dj2eelogin.name=j2ee -Dj2eelogin.password=j2ee -Dprovider.configuration.file=${authentication.tck.dir}/spi/common/ProviderConfiguration.xml -Dvendor.authconfig.factory=org.apache.catalina.authenticator.jaspic.AuthConfigFactoryImpl -Dlog.file.location=${authentication.tck.logs} -Dlog.file.name.webapp=authentication-tck-webapp.log</tomee.catalina_opts> <tomee.properties>openejb.environment.default=true</tomee.properties> </systemPropertyVariables> diff --git a/runner-standalone/exclusions/authentication.txt b/runner-standalone/exclusions/authentication.txt index 2a8685d..511fa43 100644 --- a/runner-standalone/exclusions/authentication.txt +++ b/runner-standalone/exclusions/authentication.txt @@ -1,64 +1,17 @@ # Jakarta Authentication 3.1 TCK source reactor (3.1.2) driven by the Maven -# invoker against TomEE, Java 21, 2026-07-18: 12 Web Profile modules, 105 -# tests. Eleven modules pass cleanly; the spi module's ServletProfileSPITest -# fails 50 of its 57 SPI conformance assertions against Tomcat's -# AuthConfigFactory/ServerAuthConfig implementation (missing per-message -# callbacks, wrong message-info keys, absent module-chain behavior). -# These are product results against Tomcat's Jakarta Authentication SPI. -# The 7 passing assertions stay enabled. +# invoker against TomEE, Java 21: 12 Web Profile modules plus the signature +# test, 106 tests. The spi module registers its test AuthConfigProvider under +# Tomcat's app-context naming (Catalina/localhost /spitests_servlet_web), so +# the server-side SAM runs and ServletProfileSPITest passes 56 of its 57 +# assertions. The single remaining exclusion is a TCK challenge. # # Format: maven-surefire/failsafe excludesFile patterns; the runner passes # this file to every TCK module through the invoker as # -Dsurefire.excludesFile/-Dfailsafe.excludesFile. -# ServletProfileSPITest: 50 of 57 executed methods fail -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFDetachListener -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFGetFactory -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFGetRegistrationContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFGetRegistrationIDs -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFInMemoryNotifyOnUnReg -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFInMemoryPrecedenceRules -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFInMemoryRegisterOnlyOneACP -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFPersistentNotifyOnUnReg -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFPersistentPrecedenceRules -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFPersistentRegisterOnlyOneACP -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFRemoveRegistration -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFRemoveRegistrationWithBadId -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFSwitchFactorys -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#ACFUnregisterACP -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#AuthConfigFactoryRegistration -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckACFVerifyPersistence -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckACPConfigObjAppContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckACPContextObjAppContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckAuthContextId -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckCallbackSupport -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckMPRCallsGetAuthContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckMessageInfo +# ServletProfileSPITest#CheckMsgInfoKey hard-codes a Jakarta Authorization +# (JACC) requirement: it asserts the HttpServlet MessageInfo carries the +# jakarta.security.jacc.PolicyContext key. The Web Profile does not require +# Jakarta Authorization, so the key is absent on TomEE. Open TCK challenge +# jakartaee/authentication#219. **/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckMsgInfoKey -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckRegistrationContextId -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckSecureRespForMandatoryAuth -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckSecureRespForOptionalAuth -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckServletAppContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckValidateReqAlwaysCalled -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckValidateReqAuthException -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckforNonNullAuthContext -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#CheckforNonNullCallback -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#VerifyClientSubjects -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#VerifyMessageInfoObjects -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#VerifyRequestDispatchedProperly -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#VerifySAContextVerifyReqIsCalled -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#checkSACValidateRequestWithVaryingAccess -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testACFComesFromSecFile -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testAuthenAfterLogout -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testAuthenIsUserInRole -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testAuthenResultsOnHttpServlet -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testGPCGetAuthType -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testGPCGetRemoteUser -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testGPCGetUserPrincipal -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testGPCIsUserInRole -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testGPCWithNoRequiredAuth -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testRemoteUserCorrespondsToPrin -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testRequestWrapper -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testResponseWrapper -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#testSecRespCalledAfterSvcInvoc -**/ee/jakarta/tck/authentication/test/basic/ServletProfileSPITest.java#verifyRuntimeCallOrder
