Synchronise JAXB to Spring Boot

[OrangeDog]

This project depends on jaxb-api, jaxb-core and jaxb-impl.
Spring Boot manages the jaxb-api version (currently 2.3.1) but not the others.
This results in using the wrong implementation (currently 2.3.0.1) for the API.

[OrangeDog]

Unfortunately doing so then causes a NoClassDefFoundError (on JDK 11 at least).

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.sun.xml.bind</groupId>
      <artifactId>jaxb-impl</artifactId>
      <version>${javax-jaxb.version}</version>
    </dependency>
    <dependency>
      <groupId>com.sun.xml.bind</groupId>
      <artifactId>jaxb-core</artifactId>
      <version>${javax-jaxb.version}</version>
    </dependency>
  </dependencies>
</dependencyManagement>

Caused by: java.lang.NoClassDefFoundError: com/sun/istack/Pool$Impl
	at java.base/java.lang.ClassLoader.defineClass1(Native Method)
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1016)
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
	at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:802)
	at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:700)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:623)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
	at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:176)
	at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
	at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
	at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
	at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
	at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
	at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
	at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
	at org.springframework.security.oauth2.http.converter.jaxb.AbstractJaxbMessageConverter.<init>(AbstractJaxbMessageConverter.java:59)

With the current version on JDK 11 you instead get these warnings (javaee/jaxb-v2#1197)

WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:~/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0.1/jaxb-impl-2.3.0.1.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:~/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0.1/jaxb-impl-2.3.0.1.jar) to method java.lang.ClassLoader.resolveClass(java.lang.Class)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:~/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0.1/jaxb-impl-2.3.0.1.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)

[OrangeDog]

The correct solution appears to be switching to the EE4J implementation, managed by Boot.

<dependency>
  <groupId>org.springframework.security.oauth.boot</groupId>
  <artifactId>spring-security-oauth2-autoconfigure</artifactId>
  <version>${project.parent.version}</version>
  <exclusions>
    <exclusion>
      <groupId>com.sun.xml.bind</groupId>
      <artifactId>*</artifactId>
    </exclusion>
  </exclusions>
</dependency>
<dependency>
  <groupId>org.glassfish.jaxb</groupId>
  <artifactId>jaxb-runtime</artifactId>
  <scope>runtime</scope>
</dependency>

[jzheaux]

Thanks for the report, @OrangeDog, and for the extra research. I'll take a look.

[jzheaux]

@OrangeDog can you confirm that the latest SNAPSHOT-BUILD resolves your issue?

[OrangeDog]

@jzheaux 2.0.0.SNAPSHOT_BUILD is the only one I can see, and it doesn't have any JAXB dependencies at all. Thus you get

javax.xml.bind.JAXBException: Implementation of JAXB-API has not been found on module path or classpath.

[jzheaux]

@OrangeDog, it appears to be in Spring's snapshot repo: https://repo.spring.io/libs-snapshot/org/springframework/security/oauth/boot/spring-security-oauth2-autoconfigure/2.2.0.BUILD-SNAPSHOT/

[OrangeDog]

Ah, I was looking in http://repo.spring.io/snapshot
Yes, 2.2.0.BUILD-SNAPSHOT appears to work on JDK11, with the correct JAXB versions.

[OrangeDog]

Possible to backport this to 2.1?