Preloader image

Apache TomEE 11.0.0-M2 Release Notes

This is the second milestone release of TomEE 11 targeting Jakarta EE 11 and MicroProfile 7.1.

Besides the fixes tracked in Jira, this milestone contains a large security hardening effort. We reviewed large parts of the code base and tightened the defaults of authentication, authorization, remote EJB, web services, passivation and build tooling. The Jakarta Authorization 3.0 implementation is now complete. This milestone also removes several legacy modules (openejb-hessian, openejb-ssh, openejb-common-cli, tomee-webaccess and the standalone HTTP server of openejb-http), moves the Maven and Gradle plugins to current build tool APIs, and upgrades Tomcat to 11.0.27 along with many other dependencies.

Several of these changes are not backwards compatible. Please read the TomEE 11.0.0-M2 Migration Guide before upgrading from TomEE 11.0.0-M1 or TomEE 10.

Thanks to everyone who contributed code to make this happen.

We would like to highlight and give a shout-out to all our volunteers who have been doing the hard work for EE11, which is also being done in all our upstream dependencies such as Tomcat, OWB, CXF, MyFaces, etc.

Notable changes:

  • Security hardening across the server, summarized below

  • Jakarta Authorization 3.0 is fully implemented, and EJB method permissions are enforced on all JDKs

  • TomEE Plume ships the modular EclipseLink JPA artifact instead of the eclipselink uber jar

  • OpenJPA is still on its TomEE 10 level - the JPA 3.2 PR is not yet included

Please note that we do not pass the full Jakarta EE TCK, nor do we have a fully functional TCK setup at the moment. However, our own full build is green.

Please also note the 11.0.0-M2 release is a milestone release intended for evaluation purposes and should not be used in production.

Security Hardening

The following changes were made without dedicated Jira issues. Items marked (breaking) are covered in the migration guide.

MicroProfile JWT

  • The MP-JWT filter is only registered for applications using @LoginConfig(authMethod = "MP-JWT"). Other authentication methods no longer trigger JWT processing (breaking).

  • @RolesAllowed constraints are resolved per resource class. Methods inherited by several resource classes no longer merge their roles, and an empty @RolesAllowed({}) now denies all callers (breaking).

  • The caller identity is restored when the filter chain throws, so it cannot leak into a later request on a pooled thread.

  • A negative mp.jwt.verify.clock.skew now fails the deployment instead of silently disabling the token expiry check (breaking).

Authentication and Identity Stores

  • The LDAP identity store escapes caller names in search filters and DNs, and no longer attempts a bind with an empty password (anonymous bind) (breaking).

  • SQLLoginModule rejects users with a NULL stored password. SQLLoginModule and PropertiesLoginModule compare passwords in constant time and report a single generic failure message (breaking).

  • TomEEPbkdf2PasswordHash validates the algorithm and iteration count of stored hashes and rejects weak parameters (breaking).

  • The Tomcat user identity store verifies passwords through the CredentialHandler of the matching UserDatabaseRealm, so digested passwords in tomcat-users.xml work as expected (breaking).

  • A caller principal is no longer granted a role just because its name matches the role name (breaking).

  • Remember-me tokens are removed from the RememberMeIdentityStore on logout.

  • OpenID Connect state and nonce values are generated with SecureRandom, and state is compared in constant time.

  • Using the Static3DES password cipher logs a warning that it only obfuscates passwords.

Authorization

  • The Jakarta Authorization 3.0 implementation is complete. EJB method permissions are evaluated through jakarta.security.jacc.PolicyFactory on all JDKs (11.0.0-M1 skipped this check on Java 21 and newer), the ** role is supported, and web constraints are installed as JACC permissions for every deployment path (breaking).

  • Internal EJBs such as the Deployer always require the tomee-admin or openejb-admin role, and TomEE no longer creates a default tomee/tomee admin user (breaking).

Web Services, JAX-RS and Routing

  • Security constraints generated for JAX-WS endpoints protect all HTTP methods instead of only GET and POST (breaking).

  • EJB web services packaged in a WAR now enforce the auth-method configured in openejb-jar.xml (breaking).

  • The WS-Security caller identity is cleared after each JAX-WS request, including on faults.

  • The default JAX-RS mapper for EJBException no longer returns the exception message to the client (breaking).

  • RouterValve validates forward targets: it refuses WEB-INF/META-INF targets and honors the webapp’s security constraints (breaking).

Remote EJB and Server Services

  • Remote lookups of DataSources over EJBd are disabled by default (breaking).

  • ejbds clients verify that the server certificate matches the host name (breaking).

  • Clients configured for a secure transport ignore failover locations and refuse redirects that downgrade to a plain transport (breaking).

  • only_from is authoritative for server services: localhost is no longer admitted implicitly (breaking).

  • The Derby network server honors its bind setting (default 127.0.0.1) (breaking).

  • Stop requests on the standalone admin port require a shared secret (breaking).

  • Primary keys of stateful and managed beans are random UUID values.

Filesystem and Passivation

  • Stateful and managed beans are passivated to a private, owner-only directory instead of the shared temp directory (breaking).

  • RAFPassivater keeps its file in a private temp directory and reads back the data it wrote correctly.

  • Session ids that would resolve outside the passivation directory are rejected.

  • Internal temp directories are created atomically with owner-only permissions.

  • Archive extraction (WAR/EAR deployment, provisioning and tomee-maven-plugin) rejects entries that escape the target directory.

  • XML parsing of Maven metadata and settings.xml used for mvn: provisioning disables DTDs and external entities.

Jakarta Data

  • Dynamic Sort properties must be attribute names or dotted attribute paths (breaking).

Build Tooling and Packaging

  • tomee-maven-plugin warns when it sends credentials over plain HTTP to a non-local host.

  • The LiveReload connector of tomee-embedded-maven-plugin binds to localhost and checks the WebSocket Origin header (breaking).

  • The quickSession option of the Maven, Gradle and embedded tooling defaults to false, so session ids are always generated with SecureRandom (breaking).

  • The Debian packages keep the configuration read-only for the apachetomee service group (breaking).

  • The systemd service example in the documentation runs TomEE as a dedicated user.

  • Webapp jars skipped by the built-in scan exclusion list are now logged, so annotations that are silently ignored become visible.

  • The optional log4j 1.x API dependency (EOL log4j 1.2.17) is replaced by reload4j.

Bug

  • TOMEE-2044 threadPool-queue (in ServicePool) from ejbd-Service is never processed

  • TOMEE-2764 Path not appended when using UriBuilder.fromUri().path() with file scheme

  • TOMEE-2970 JaxRS Server Sent events implementation leaves lots of warning logs

  • TOMEE-3726 Queue is visible in JNDI Tree (java://id-resource)

  • TOMEE-3782 cdi-request-scope example not working

  • TOMEE-4011 Multi-threaded Deployment of multiple war-files runs in TomEERuntimeException

  • TOMEE-4029 Use of JWKS forces kid to be present in JWTs

  • TOMEE-4240 The implementation for mail.mime.parameters.strict parameter is missing in jakarta/mail/internet/ParameterList.java class of geronimo-mail_2.1_spec-1.0.0-M1.jar in TomEE 9.1.0

  • TOMEE-4438 Disable releases for apache-snapshot repo

  • TOMEE-4547 MultipartMessage not build correctly with Jakarta.mail / Interferes with Geronimo-mail

  • TOMEE-4589 openejb reports an error in web.xml which is wrong

  • TOMEE-4620 Misspelled field accesToken in OIDC TokenResponse prevents interoperability with custom JSON providers (Jackson)

  • TOMEE-4631 arquillian-tomee-remote: static "registered" latch breaks container re-registration on a second Arquillian Manager (e.g. failsafe rerunFailingTestsCount)

  • TOMEE-4642 Deployment fails when a war lists a servlet or filter class it does not package

  • TOMEE-4651 TomEE does not register jakarta.tags.* TLD URIs, breaking all Jakarta Tags 3.0

  • TOMEE-4655 A failed CDI/EJB deployment leaks its deployment ID into later apps

  • TOMEE-4657 Bean Validation XML config fails on stock Plume: MOXy beats JAXB RI in ServiceLoader

  • TOMEE-4674 Using otel.config.file in TomEE fails

  • TOMEE-4682 SecurityContext.authenticate() does not persist the session (bypasses HttpServletRequest.authenticate())

  • TOMEE-4699 ThreadContext constructor is not thread-safe, causing loss of submitted tasks.

  • TOMEE-4703 ApplicationThreadContextProvider stores a live ThreadContext reference instead of an immutable snapshot

  • TOMEE-4704 CUTask.invoke() does not safely propagate errors to ManagedTask

  • TOMEE-4708 OpenID definition EL expressions are evaluated on a shared ELProcessor and fail under concurrent requests (regression of TOMEE-4595)

  • TOMEE-4711 Jakarta Data repositories fail when called from a @Transactional CDI method

  • TOMEE-4712 MDB endpoints are activated before the application’s other EJBs are started

  • TOMEE-4714 TomEEEmbeddedExtension (JUnit 5) can not start the container again after it was closed

  • TOMEE-4715 TomEE embedded application runner does not inject @Resource into the @Application descriptor

  • TOMEE-4716 MicroProfile Health endpoints are not deployed when the webapp declares a JAX-RS Application subclass

  • TOMEE-4727 Jakarta Data repository fails when called from an AFTER_SUCCESS transactional observer

  • TOMEE-4728 MicroProfile Health endpoint runs the providers of a declared JAX-RS application

  • TOMEE-4729 MP-JWT security state is not restored for asynchronous requests

  • TOMEE-4730 MP-JWT ignores class-level security annotations of a resource superclass

  • TOMEE-4731 TxThreadContextRestorer fails with NPE when managed threads end after the container shut down

Improvement

  • TOMEE-1619 Add exception message to Alerts

  • TOMEE-3234 Update Examples to use Server / API Boms

  • TOMEE-4662 Speed up annotation processing during WAR deploy

  • TOMEE-4709 Track git revision in version info

  • TOMEE-4710 Don’t patch catalina.jar just to print TomEE Version

Task

Documentation

  • TOMEE-3738 Replace Hibernate Validator with BVal for "Bean Validation TCK"

  • TOMEE-4673 Remove "About the 'tomee' webapp" since Tomee drop-in webapp was removed in TOMEE-3724

Dependency upgrade