Spring Web Services 4.1 Release Notes

Upgrading from Spring Web Services 4.0

Deprecations from Spring Web Services 2.0+

Classes, methods, and properties that were deprecated in Spring-WS 2.0 and later have been removed in this release. Please ensure that you aren’t calling deprecated methods before upgrading. This includes:

• Base classes for implement endpoints. This was deprecated in Spring-WS 2.0 in favor of the @Endpoint support.

• Support for Commons HttpClient v3

• Support for EhCache v2

OpenSAML requiring a dedicated Maven repository

The upgrade to Apache WSS4J v4 also upgrades the OpenSAML version. Unfortunately, recent versions of OpenSAML require an extra Maven Repository as they are not published on Maven Central.

Maven users should add the repository as follows:

<repositories>
    <repository>
        <id>shibboleth-releases</id>
        <url>https://build.shibboleth.net/nexus/content/repositories/releases</url>
    </repository>
</repositories>

Gradle users can add it as follows:

repositories {
    maven { url "https://build.shibboleth.net/nexus/content/repositories/releases" }
}

See Use of Maven Central for more details

WsConfigurer for MethodArgumentResolvers and MethodReturnValueHandlers

The callback to add MethodArgumentResolver and MethodReturnValueHandler instance has changed. Previously addArgumentResolvers and addReturnValueHandlers were invoked with an empty list. They are now invoked with the default argument resolvers and return value handlers, respectively.

This is backward compatible as custom instances were added after the default. However, clearing the list means defaults are removed as well.

Minimum Requirements Changes

None.

New and Noteworthy

Apache Axiom Support

With the release of a version compatible with Jakarta, the support of Apache Axiom has been restored.

WSS4J Improvements

Apache WSS4J has been upgraded to v4 whilst maintaining compatibility with v2 (or v3). The following has been updated:

• Support for providing an Attachment CallbackHandler to sign/encrypt SOAP attachments.

• Support for configuring the USE_SINGLE_CERTIFICATE option, which allows to use X509PKIPathv1 instead of X509v3.

• Support for certificate constraints of the subject DN.

Automatic module

All our jars ship with automatic module name entries in the manifests for module system compatibility. A split package between spring-ws-core and spring-ws-support has also been fixed as a result.

The module names are as follows:

• spring-xml: spring.xml

• spring-ws-core: spring.ws.core

• spring-ws-security: spring.ws.security

• spring-ws-support: spring.ws.support

• spring-ws-test: spring.ws.test

Order MethodArgumentResolvers and MethodReturnValueHandlers in WsConfigurer

MethodArgumentResolver and MethodReturnValueHandler instances can now be ordered according to the defaults. Adding an instance before the defaults makes sure that it is considered before the defaults.

Support for Configuring Arbitrary WSS4J Options

Wss4jSecurityInterceptor allows any WSS4J options to be specified on its internal handler, see setWsHandlerOption. This provides more flexibility in configuring the handler, without the need of adding more methods to Wss4jSecurityInterceptor.

More Flexible HTTP Message Sender

HttpComponents5MessageSender has now a companion class for when an HttpClient is provided as-is. Creating a SimpleHttpComponents5MessageSender with your custom client avoids the additional configuration options that HttpComponents5MessageSender provides.

The HttpClient can be configured using HttpComponents5ClientFactory that provides additional callbacks for advanced configuration. Once the factory is initialized with your customizations, you can create a WebServiceMessageSender by providing the factory to SimpleHttpComponents5MessageSender.

Here is an example configuring NTLM authentication whilst using the high-level customizations.

HttpComponents5ClientFactory factory = HttpComponents5ClientFactory.withDefaults();
factory.setConnectionTimeout(Duration.ofMillis(3000));
factory.addClientBuilderCustomizer(builder -> {
    BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
    credentialsProvider.setCredentials(new AuthScope(HOST_IP, HOST_PORT),
            new NTCredentials("user", "pass".toCharArray(), null, "domain"));
    builder.setDefaultCredentialsProvider(credentialsProvider);
    builder.setDefaultAuthSchemeRegistry(RegistryBuilder.<AuthSchemeFactory>create()
            .register(AuthSchemes.NTLM, new NTLMSchemeFactory())
            .build());
});
SimpleHttpComponents5MessageSender messageSender = new SimpleHttpComponents5MessageSender(factory);

Dependency Upgrades

Spring Web Services 4.1.0 moves to new versions of several Spring projects:

• Spring Framework 6.2.7

• Spring Security 6.5.0

Third-party dependencies have also been updated, some of the more noteworthy of which are the following:

• Angus Mail 2.0.3

• Apache WSS4J 4.0.0

Miscellaneous

Apart from the changes listed above, there have also been lots of minor tweaks and improvements including:

• The If-Modified-Since HTTP header is now taken into account for WSDL/Schema requests.

Deprecations in Spring Web Services 4.1.0

• WsConfigurerAdapter has been deprecated in favor of implementing the WsConfigurer interface, which now provides default methods.