Migrate to spring boot 4 by gdgenchev · Pull Request #3805 · cloudfoundry/uaa

gdgenchev · 2026-04-01T12:59:10Z

I have worked on researching the spring boot 4 migration of uaa.

Run open-rewrite recipe for Spring Boot 3 -> Spring Boot 4 without Jackson 2 -> 3
Fix some issues with AI in incremental commits
- Needs thorough reviewing commit by commit
- I have removed the fips and used non-fips just so that I can reach other issues that can be fixed. (commit 30. dec5452 - migrate bc to non-fips to just check..) - this is hard blocker

Current State:

Build is successful
Only 12 unit tests related to SAML fail
UAA starts and on login I see authentication success log
For some reason I cannot run the ITs on my MAC. Could be related to the migration or not

Conclusions:

Jackson:

Jackcson 2 -> 3 cannot be done before Spring Boot 4 migration, because they changed the packages and there are spring libs that statically depend on those packages, so upgrade is needed
Open-rewrite recipe is buggy and does not resolve all migration issues in jackson 2 -> 3.
- Moderne ran the full boot migration recipe over uaa here: https://github.com/timtebeek/uaa/tree/feature/migrate-to-spring-boot-4-0
- I have discussed with colleagues familiar with Migrations topic and it turned out that our guess that Jackson 3 is not needed for Spring Boot 4 is correct. There is this compatibility dependency that can be used: spring-boot-jackson2. I was given a recipe that does the spring migration without Jackson and this is the one that I have used as a base. I was suggested to do Spring Boot 4 without Jackson, as it causes too many issues (though, as we can see the spring migration itself also does..). So, it turns out Jackson 2 -> 3 could be done in isolation after spring boot 4 migration

OpenSAML 5:

OpenSAML 5 support is added from Spring Security 6.4.x: Update to OpenSAML 5 spring-projects/spring-security#11658 (though, OpenSAML 4 is used by default and you need some extra config to enable OpenSAML 5), cfuaa currently is on 6.5.9, so technically it could be possible to upgrade it in isolation, but when I tried, it still had incompatibility issues (though I am not sure if they were spring related or open saml bc-fips related)
OpenSAML 4 is not FIPS compliant. UAA has excluded bc non fips and added bc-fips instead and it somehow works, but nowhere OpenSAML states that it is FIPS compliant.
- https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1159627167/FIPS - official statement from opensaml owner regarding FIPS
If we go for Spring Boot 4, we need to upgrade to OpenSAML 5, as OpenSAML 4 support is completely removed
- https://docs.spring.io/spring-security/reference/whats-new.html#_saml_2_0 - official statement from Spring.
- If bc libs are kept as they are, ClassNotFoundExceptions appear due to the exclusion of the non fips library. It seems from one point OpenSAML guys started heavily depending on bc non fips and it is not so easy to remove and replace with bc-fips

Migration to boot 4 currently seems to be a dead end due to Open SAML 5 FIPS compliance.

#Bonus research:

Java 25:
bcgit/bc-java#1287 (comment) - from this it seems that FIPS certification can take up to 14 months, at least this is how long it has taken before. This is actually very good information, as previously we just didn't know and could not set any expectations.

strehle · 2026-04-06T14:01:53Z

thanks for this PR, we need to solve OpenSAML first and therefore started with: #3811

strehle · 2026-04-18T09:59:06Z

@gdgenchev ok, with spring update you need opensaml5 and therefore rebase this and also pull changes from #3840 for testing. with this your SAML erros should disappear

gdgenchev · 2026-04-29T07:57:34Z

Current Progress:

I picked saml 5 update.

I did spring boot 4 migration without open rewrite from scratch, incrementally, so that I can isolate changes that are compatible with current Spring Boot 3. All such have been proposed as PRs. Maybe we can also try with open rewrite after those are merged.

I reached a point where all unit tests pass and 35 ITs failed. But apidoc pipeline failed with Jackson issues, as I tried keeping Jackson 2... As effort was too high to make it work with Jackson 2, I just decided to try to migrate the whole project to Jackson 3 and it seems it worked nicely. Unit tests still pass, apidoc passes, but we have 90 failing ITs and I see some stacktraces related to jackson. Will check.

gdgenchev · 2026-05-05T19:45:41Z

Current progress:

Unit tests pass locally, but fail with OOM in pipeline - seems to be infrastructure issue maybe?

Integration tests pass except 2 possibly flaky saml tests that I am not sure if they actually work locally:

org.cloudfoundry.identity.uaa.integration.feature.SamlLoginIT.idpInitiatedLogout
org.cloudfoundry.identity.uaa.integration.feature.SamlLoginIT.singleLogout_ShouldRedirectToLoggedOutPageIfConfigured

Not sure if this is actual regression.

strehle · 2026-05-07T12:30:37Z

@gdgenchev I think all blockers are removed for you right now and after rebase from dev. you should get closer to a final PR

gdgenchev · 2026-05-12T21:54:09Z

Current progress:

Branch is rebased on develop
Unit tests pass locally, but fail due to OutOfMemory in pipeline - seems to be infrastructure issue that needs to be addressed for this PR?
The 2 failing SAML ITs that worked in isolation, but failed when run together with all tests in SamlLLoginIT, now pass

This is now ready for review.

This version is support BC fips. Higher versions pull directly classes from non fips package. At least a version that could work together with spring security 7.x and then boot 4.x # Conflicts: # build.gradle # dependencies.gradle # server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSamlDecryptionUtils.java # server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSamlVerificationUtils.java # server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/Saml2BearerGrantAuthenticationConverter.java # server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlMetadataEndpoint.java # server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/UaaInResponseToHandlingResponseValidator.java # server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/SamlMetadataEndpointKeyRotationTests.java # server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/TestCustomOpenSamlObjects.java

# Conflicts: # server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/TestCustomOpenSamlObjects.java

Spring Boot 4 moved DependsOnDatabaseInitialization to a separate spring-boot-sql module. Added this dependency to the server module where it's needed. Related to Spring Boot 4 migration.

Spring Security 7 moved vote classes (AuthenticatedVoter, RoleVoter, UnanimousBased) to a separate spring-security-access module that is not automatically included. Added explicit dependency. Related to Spring Boot 4 migration.

Spring Boot 4 moved autoconfigure classes to technology-specific modules: - org.springframework.boot.autoconfigure.jdbc → org.springframework.boot.jdbc.autoconfigure - org.springframework.boot.autoconfigure.transaction → org.springframework.boot.transaction.autoconfigure Updated DatabaseConfiguration imports. Related to Spring Boot 4 migration.

Spring Boot 4 reorganized autoconfigure packages. - Removed unused WebMvcAutoConfiguration import from WebConfig - Updated test annotation to use new autoconfigure package locations Related to Spring Boot 4 migration. # Conflicts: # server/src/main/java/org/cloudfoundry/identity/uaa/web/WebConfig.java

Replace deprecated HttpComponentsClientHttpRequestFactory.setConnectTimeout() with ConnectionConfig.setConnectTimeout() on PoolingHttpClientConnectionManager. The connection timeout is now configured at the connection manager level using the recommended ConnectionConfig.Builder API.

Spring Framework 7 replaced HttpHeaders.containsKey() with containsHeader(). This updates all occurrences in OAuth2 token handling code and test utilities. Related to Spring Boot 4 migration.

…ng 7 Spring 7 removed MediaType.sortByQualityValue() and QUALITY_VALUE_COMPARATOR that were deprecated in Spring 6. Copy the sorting logic into a new MediaTypeComparators utility class to preserve content negotiation behavior that respects client quality value preferences from Accept headers. https://github.com/spring-projects/spring-framework/blob/9f431e2eac1b6d8d5ca385d0cc367bac94dd37e7/spring-web/src/main/java/org/springframework/http/MediaType.java#L927-L965 # Conflicts: # server/src/main/java/org/cloudfoundry/identity/uaa/oauth/provider/error/DefaultOAuth2ExceptionRenderer.java # server/src/main/java/org/cloudfoundry/identity/uaa/web/ConvertingExceptionView.java

- Rename MediaTypeComparators to MediaTypeUtils for better semantics - Add sortByQualityValue() utility method to handle immutable lists - Fix usages to create mutable copies before sorting - Remove unnecessary if-else in ConvertingExceptionView - Add comprehensive unit tests including parameterized tests # Conflicts: # server/src/main/java/org/cloudfoundry/identity/uaa/util/MediaTypeUtils.java # server/src/test/java/org/cloudfoundry/identity/uaa/util/MediaTypeUtilsTest.java

Replace getAssertingPartyDetails() with getAssertingPartyMetadata() Replace withRelyingPartyRegistration() with mutate() Replace assertingPartyDetails() with assertingPartyMetadata() in builder Replace RelyingPartyRegistration.AssertingPartyMetadata with AssertingPartyMetadata

Replace check() method with authorize() in production code and tests Update parameter and return types to use AuthorizationResult Add jspecify nullable annotations

This method was removed in Spring Framework 6.0 without replacement. The default model is now always ignored on redirect. This requires changes to some controllers where model.addAttribute() was used that now won't be delegated. We need to use redirectAttributes.addAttribute(). # Conflicts: # server/src/main/java/org/cloudfoundry/identity/uaa/web/WebConfig.java # Conflicts: # server/src/main/java/org/cloudfoundry/identity/uaa/login/LoginInfoEndpoint.java # server/src/test/java/org/cloudfoundry/identity/uaa/login/LoginInfoEndpointTests.java

Spring Boot 4 reorganized web server factory classes into dedicated modules: - ConfigurableServletWebServerFactory: org.springframework.boot.web.servlet.server → org.springframework.boot.web.server.servlet - TomcatServletWebServerFactory: org.springframework.boot.web.embedded.tomcat → org.springframework.boot.tomcat.servlet - ErrorPage: org.springframework.boot.web.server → org.springframework.boot.web.error - addAdditionalTomcatConnectors() → addAdditionalConnectors() Updated production code and tests in uaa module.

strehle

@duanemay we should discuss when we want merge, but I think in general we now have a running PR

Copilot

Pull request overview

This PR migrates UAA toward Spring Boot 4 / Spring Framework 7 / Spring Security 7 compatibility, including Jackson 3 API updates, OpenSAML 5 API updates, and related test expectation changes.

Changes:

Updates dependency versions and Spring Boot package/API usages.
Migrates many Jackson usages from com.fasterxml.jackson.databind/core to tools.jackson.*.
Adjusts tests and helpers for Spring Security, MockMvc redirect behavior, HTTP headers, SAML APIs, and RestTemplate JSON conversion.

Reviewed changes

Copilot reviewed 196 out of 197 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`build.gradle`	Adjusts global dependency excludes and test JVM settings.
`gradle/libs.versions.toml`	Updates Spring Boot/SpringDoc/Jackson/Spring dependency coordinates.
`statsd/build.gradle`	Updates Tomcat runtime dependency usage.
`server/build.gradle`	Adds Boot 4-related server dependencies.
`server/src/main/resources/spring-mvc.properties`	Removes legacy MVC/Jackson property file.
`server/src/main/java/org/cloudfoundry/identity/uaa/impl/config/JacksonMapperCustomizer.java`	Adds shared Jackson 3 mapper/message-converter configuration.
`server/src/main/java/org/cloudfoundry/identity/uaa/web/WebConfig.java`	Removes legacy property source wiring.
`server/src/main/java/org/cloudfoundry/identity/uaa/web/AuthorizationManagersUtils.java`	Updates authorization manager API usage.
`server/src/main/java/org/cloudfoundry/identity/uaa/web/SelfCheckAuthorizationManager.java`	Updates authorization manager method signatures.
`server/src/main/java/org/cloudfoundry/identity/uaa/security/web/SecurityFilterChainPostProcessor.java`	Handles Tomcat invalid-parameter exceptions as JSON 400 responses.
`server/src/main/java/org/cloudfoundry/identity/uaa/authentication/EmptyPasswordAwareEncoder.java`	Adds empty-client-secret password matching wrapper.
`server/src/main/java/org/cloudfoundry/identity/uaa/authentication/ClientDetailsAuthenticationProvider.java`	Wraps client password encoder for empty secrets.
`server/src/main/java/org/cloudfoundry/identity/uaa/authentication/UaaAuthentication*.java`	Migrates custom Jackson serializer/deserializer annotations/APIs.
`server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/*`	Updates OpenSAML/Spring Security SAML registration APIs.
`server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/*`	Migrates Jackson imports and metadata parsing.
`server/src/main/java/org/cloudfoundry/identity/uaa/oauth/*/.java`	Updates Jackson imports, HTTP header APIs, and auth publisher wiring.
`server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/*/.java`	Migrates Jackson APIs in rate-limiting JSON handling.
`server/src/main/java/org/cloudfoundry/identity/uaa/db/beans/DatabaseConfiguration.java`	Updates Boot auto-configuration package names.
`server/src/main/java/org/cloudfoundry/identity/uaa/account/*.java`	Migrates Jackson `TypeReference` imports.
`server/src/main/java/org/cloudfoundry/identity/uaa/invitations/*.java`	Migrates Jackson `TypeReference` imports.
`server/src/main/java/org/cloudfoundry/identity/uaa/client/*.java`	Migrates Jackson annotation/import usage.
`server/src/test/java/**`	Updates unit tests for Spring Security/Jackson/SAML/HTTP API changes.
`model/src/main/java/**`	Migrates model serialization/deserialization to Jackson 3 APIs.
`model/src/test/java/**`	Updates model JSON tests for Jackson 3 behavior.
`metrics-data/src/main/java/org/cloudfoundry/identity/uaa/util/JsonUtils.java`	Migrates JSON utility to Jackson 3 mapper APIs.
`metrics-data/src/test/java/**`	Updates JSON utility and metrics tests for Jackson 3.
`statsd-lib/src/test/java/org/cloudfoundry/identity/statsd/integration/IntegrationTestUtils.java`	Updates HTTP header API usage.
`uaa/src/test/java/**`	Updates MockMvc/integration tests for Jackson 3, redirects, status codes, SAML/OIDC helpers, and Boot 4 test APIs.

Comments suppressed due to low confidence (2)

uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/zones/IdentityZoneEndpointsMockMvcTests.java:1640

This no-token client request should continue to return 401 Unauthorized. A 403 response is appropriate after authentication succeeds but authorization fails; for missing credentials the OAuth entry point should challenge the caller instead.
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/zones/IdentityZoneEndpointsMockMvcZonePathTests.java:1648
This no-token client request should continue to return 401 Unauthorized. A 403 response is appropriate after authentication succeeds but authorization fails; for missing credentials the OAuth entry point should challenge the caller instead.

The previous fall-through accepted any stored value whose contents after an optional {prefix} were empty, including a raw "" database value or unsupported prefixes like {plaintext} or a malformed {bcrypt} with no hash. Restrict the empty-password match to a valid bcrypt hash of the empty string and the explicit {noop} legacy marker.

Pull the {noop} legacy marker and the bcrypt hash prefixes into named constants so the allow-list is readable at a glance.

Copilot

Pull request overview

Copilot reviewed 197 out of 198 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 197 out of 198 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 196 out of 197 changed files in this pull request and generated 1 comment.

cf-foundation-community-automation Bot added this to Foundational Infrastructure Working Group Apr 1, 2026

cf-foundation-community-automation Bot moved this to Inbox in Foundational Infrastructure Working Group Apr 1, 2026

strehle linked an issue Apr 6, 2026 that may be closed by this pull request

Migrate to spring boot 4 #3812

Closed

gdgenchev force-pushed the migrate-to-spring-boot-4 branch from 5e94f36 to f142b62 Compare April 18, 2026 22:20

gdgenchev force-pushed the migrate-to-spring-boot-4 branch 2 times, most recently from 2e4a063 to 51d132e Compare April 28, 2026 11:41

gdgenchev force-pushed the migrate-to-spring-boot-4 branch from 8fde87c to 19fd5d4 Compare May 4, 2026 19:34

gdgenchev force-pushed the migrate-to-spring-boot-4 branch from 47b9dd5 to 58e3a95 Compare May 12, 2026 20:46

gdgenchev marked this pull request as ready for review May 12, 2026 21:28

strehle and others added 15 commits May 18, 2026 12:19

rebase back to spring security

99ec576

cleanup

074b1df

# Conflicts: # server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/TestCustomOpenSamlObjects.java

Add spring-boot-sql dependency for Spring Boot 4

b8adba4

Spring Boot 4 moved DependsOnDatabaseInitialization to a separate spring-boot-sql module. Added this dependency to the server module where it's needed. Related to Spring Boot 4 migration.

Migrate HttpHeaders.containsKey to containsHeader for Spring 7

45b0dfd

Spring Framework 7 replaced HttpHeaders.containsKey() with containsHeader(). This updates all occurrences in OAuth2 token handling code and test utilities. Related to Spring Boot 4 migration.

Migrate Authorization Manager API to Spring Security 7

4eb1c16

Replace check() method with authorize() in production code and tests Update parameter and return types to use AuthorizationResult Add jspecify nullable annotations

Merge branch 'develop' into migrate-to-spring-boot-4

ab9308a

strehle requested a review from Copilot May 19, 2026 11:07

strehle previously approved these changes May 19, 2026

View reviewed changes

github-project-automation Bot moved this from Inbox to Pending Merge | Prioritized in Foundational Infrastructure Working Group May 19, 2026

Copilot started reviewing on behalf of strehle May 19, 2026 11:08 View session

strehle requested a review from a team May 19, 2026 11:08

Copilot AI reviewed May 19, 2026

View reviewed changes

review: revert 4b4bdd5 and change config

aabc902

gdgenchev dismissed strehle’s stale review via aabc902 May 19, 2026 11:29

gdgenchev added 2 commits May 19, 2026 14:37

refactor: extract EmptyPasswordAwareEncoder constants

1170160

Pull the {noop} legacy marker and the bcrypt hash prefixes into named constants so the allow-list is readable at a glance.

gdgenchev force-pushed the migrate-to-spring-boot-4 branch from 57540ca to 1170160 Compare May 19, 2026 11:41

strehle requested a review from Copilot May 19, 2026 12:54

Copilot started reviewing on behalf of strehle May 19, 2026 12:55 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread server/src/main/java/org/cloudfoundry/identity/uaa/user/UaaAuthority.java Outdated

Comment thread ...er/src/main/java/org/cloudfoundry/identity/uaa/authentication/EmptyPasswordAwareEncoder.java Outdated

Comment thread gradle/libs.versions.toml

strehle requested a review from Copilot May 19, 2026 15:47

Copilot started reviewing on behalf of strehle May 19, 2026 15:48 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

gdgenchev added 2 commits May 19, 2026 22:16

review: align fallback text with caught JacksonException

e9f9d78

review: remove redundant @JsonCreator from UaaAuthority constructor

ecb05e2

strehle requested a review from Copilot May 19, 2026 19:24

Copilot started reviewing on behalf of strehle May 19, 2026 19:25 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread model/src/main/java/org/cloudfoundry/identity/uaa/zone/ClientSecretPolicy.java

review: only strip {bcrypt} prefix in EmptyPasswordAwareEncoder

d97ca2a

strehle requested review from duanemay and fhanik May 20, 2026 05:10

strehle approved these changes May 22, 2026

View reviewed changes

duanemay approved these changes May 28, 2026

View reviewed changes

strehle merged commit 4117e2e into cloudfoundry:develop May 28, 2026
27 checks passed

github-project-automation Bot moved this from Pending Merge | Prioritized to Done in Foundational Infrastructure Working Group May 28, 2026

Conversation

gdgenchev commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

strehle commented Apr 6, 2026

Uh oh!

strehle commented Apr 18, 2026

Uh oh!

gdgenchev commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gdgenchev commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

strehle commented May 7, 2026

Uh oh!

gdgenchev commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

strehle left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gdgenchev commented Apr 1, 2026 •

edited

Loading

gdgenchev commented Apr 29, 2026 •

edited

Loading

gdgenchev commented May 5, 2026 •

edited

Loading

gdgenchev commented May 12, 2026 •

edited

Loading