Apache TomEE 10.3.0 Release Notes

The MP-JWT filter is only registered for applications using @LoginConfig(authMethod = "MP-JWT"). Other authentication methods no longer trigger JWT processing (breaking).

@RolesAllowed constraints are resolved per resource class. Methods inherited by several resource classes no longer merge their roles, and an empty @RolesAllowed({}) now denies all callers (breaking).

The caller identity is restored when the filter chain throws, so it cannot leak into a later request on a pooled thread.

A negative mp.jwt.verify.clock.skew now fails the deployment instead of silently disabling the token expiry check (breaking).

The LDAP identity store escapes caller names in search filters and DNs, and no longer attempts a bind with an empty password (anonymous bind) (breaking).

SQLLoginModule rejects users with a NULL stored password. SQLLoginModule and PropertiesLoginModule compare passwords in constant time and report a single generic failure message (breaking).

TomEEPbkdf2PasswordHash validates the algorithm and iteration count of stored hashes and rejects weak parameters (breaking).

The Tomcat user identity store verifies passwords through the CredentialHandler of the matching UserDatabaseRealm, so digested passwords in tomcat-users.xml work as expected (breaking).

A caller principal is no longer granted a role just because its name matches the role name (breaking).

Remember-me tokens are removed from the RememberMeIdentityStore on logout.

OpenID Connect state and nonce values are generated with SecureRandom, and state is compared in constant time.

Using the Static3DES password cipher logs a warning that it only obfuscates passwords.

EJB method permissions (@RolesAllowed, @DenyAll) are evaluated through the installed JACC policy on all JDKs again. TomEE 10.2.0 skipped this check on Java 21 and newer (breaking).

Internal EJBs such as the Deployer always require the tomee-admin or openejb-admin role, and TomEE no longer creates a default tomee/tomee admin user (breaking).

Fixed a StackOverflowError in the JACC PolicyConfigurationFactory.

Security constraints generated for JAX-WS endpoints protect all HTTP methods instead of only GET and POST (breaking).

EJB web services packaged in a WAR now enforce the auth-method configured in openejb-jar.xml (breaking).

The WS-Security caller identity is cleared after each JAX-WS request, including on faults.

The default JAX-RS mapper for EJBException no longer returns the exception message to the client (breaking).

RouterValve validates forward targets: it refuses WEB-INF/META-INF targets and honors the webapp’s security constraints (breaking).

Remote lookups of DataSources over EJBd are disabled by default (breaking).

ejbds clients verify that the server certificate matches the host name (breaking).

Clients configured for a secure transport ignore failover locations and refuse redirects that downgrade to a plain transport (breaking).

only_from is authoritative for server services: localhost is no longer admitted implicitly (breaking).

The Derby network server honors its bind setting (default 127.0.0.1) (breaking).

Stop requests on the standalone admin port require a shared secret (breaking).

Primary keys of stateful and managed beans are random UUID values.

Stateful and managed beans are passivated to a private, owner-only directory instead of the shared temp directory (breaking).

RAFPassivater keeps its file in a private temp directory and reads back the data it wrote correctly.

Session ids that would resolve outside the passivation directory are rejected.

Internal temp directories are created atomically with owner-only permissions.

Archive extraction (WAR/EAR deployment, provisioning and tomee-maven-plugin) rejects entries that escape the target directory.

XML parsing of Maven metadata and settings.xml used for mvn: provisioning disables DTDs and external entities.

tomee-maven-plugin warns when it sends credentials over plain HTTP to a non-local host.

The LiveReload connector of tomee-embedded-maven-plugin binds to localhost and checks the WebSocket Origin header (breaking).

The quickSession option of the Maven, Gradle and embedded tooling defaults to false, so session ids are always generated with SecureRandom (breaking).

The Debian packages keep the configuration read-only for the apachetomee service group (breaking).

The systemd service example in the documentation runs TomEE as a dedicated user.

Webapp jars skipped by the built-in scan exclusion list are now logged, so annotations that are silently ignored become visible.

The optional log4j 1.x API dependency (EOL log4j 1.2.17) is replaced by reload4j.