Repository navigation
Conversation
- Import the openicf 2.1.0-SNAPSHOT BOM instead of 2.0.4. - RepoJobStore: drop the unused jobKey local (code scanning #974) and make TriggerComparator static, as it never uses the enclosing instance (#975). - populateAsManagedUser.js: drop the unused propertyMapping (#967). - TemporalConstraintsFormView.js: drop the unused constraint (#966).
vharseko
added
dependencies
maximthomas
approved these changes
Oct 13, 2026
6 tasks done
vharseko
added a commit
to OpenIdentityPlatform/OpenICF
that referenced
this pull request
Oct 19, 2026
…sses (#191) ## Summary #134 replaced `Class.newInstance()` with `ReflectionUtil.newInstance()`, which goes through `MethodHandles.Lookup.findConstructor`. That changed how a connector configuration class with a missing dependency fails: - **before:** `Class.newInstance()` threw `NoClassDefFoundError`. The `catch (Exception)` in `createDefaultAPIConfiguration` let it through, and `LocalConnectorInfoManagerImpl` (`catch (NoClassDefFoundError)`, likewise the OSGi managers) skipped that connector and logged an error; - **now:** `findConstructor` reports the same `NoClassDefFoundError` as `IllegalAccessException: no such constructor`. That is an `Exception`, so it is wrapped in a `ConnectorException` that nobody catches, and the whole bundle scan fails. Found through OpenIdentityPlatform/OpenIDM#259 (bump to openicf 2.1.0-SNAPSHOT): `ScriptedCRESTConfiguration` in `groovy-connector` refers to `httpasyncclient`, which is not on the OpenIDM test classpath, and `ConnectorInfoProviderServiceTest.beforeTest` fails with `LocalManager initialisation failed`; 126 tests of the module are skipped. ``` Caused by: ConnectorException: java.lang.IllegalAccessException: no such constructor: org.forgerock.openicf.connectors.scriptedcrest.ScriptedCRESTConfiguration.<init>()v at LocalConnectorInfoManagerImpl.createDefaultAPIConfiguration(LocalConnectorInfoManagerImpl.java:339) Caused by: java.lang.NoClassDefFoundError: org/apache/http/nio/client/HttpAsyncClient ``` ## Fix `ReflectionUtil.newInstance` rethrows the `LinkageError` cause of the `findConstructor` failure, except for the `NoSuchMethodError` and `IllegalAccessError` that come with a missing or inaccessible constructor (those are still reported as `NoSuchMethodException` / `IllegalAccessException`). This brings back the `Class.newInstance()` behaviour for every caller, including the OSGi info managers. One case stays different: a link failure that is itself an `IllegalAccessError` (a dependency that cannot access its superclass) cannot be told from an inaccessible constructor, so it is still reported as `IllegalAccessException`. `Class.newInstance()` threw the raw `IllegalAccessError`. The managers catch neither, so the scan fails in both cases. ## Test plan - [x] New `ReflectionUtilTests.newInstanceThrowsLinkageErrorOfClassWithMissingDependency`: a class loader that cannot load one dependency, so the class fails to link. Before the fix the test fails with the same `IllegalAccessException: no such constructor` - [x] New `ReflectionUtilTests.newInstanceFailsOnInaccessibleConstructor`: a private constructor seen through `publicLookup()` still fails with `IllegalAccessException`, not with a raw `IllegalAccessError` - [x] New `ReflectionUtilTests.newInstanceFailsOnInaccessibleClass`: a package-private class seen through `publicLookup()`, which `findConstructor` reports without a cause, still fails with `IllegalAccessException`, not with a `NullPointerException` - [x] New `LocalConnectorInfoManagerTests.testSkipsConnectorWithUnlinkableConfiguration`: a bundle with two connectors, the configuration class of one refers to a class missing from the bundle; the scan lists the other connector. Without the fix it fails with the `IllegalAccessException: no such constructor` from OpenIDM#259; without the `catch (NoClassDefFoundError)` in `LocalConnectorInfoManagerImpl` it fails with the `NoClassDefFoundError`. The test closes the bundle class loader before it deletes the temp jar, which Windows cannot delete while it is open - [x] `connector-framework`: 205/205 pass (incl. `newInstanceFailsWithoutNoArgConstructor`, which still gets `NoSuchMethodException`); `connector-framework-internal`: 525 run, 0 failures, 2 skipped (`testConfigurationUpdate` of the remote manager tests) - [x] End to end: with this `connector-framework` installed locally, OpenIDM `openidm-provisioner-openicf` on openicf 2.1.0-SNAPSHOT passes 138/138 (same as on 2.0.4; without the fix `beforeTest` fails)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Code scanning triage of the open alerts on
master.Dependencies
openicf2.1.0-SNAPSHOT BOM instead of 2.0.4.Note: the current 2.1.0-SNAPSHOT still pins opendj 5.1.2 → commons 3.1.2 (jackson 2.18.6, bcprov 1.84), and
xml-connector2.1.0-SNAPSHOT still bundleslib/xercesImpl-2.6.2.jar. The Trivy alerts on those artifacts close once the fixed versions land upstream in the OpenICF snapshot.CodeQL note-level findings
java/local-variable-is-never-readRepoJobStorejobKeylocal.java/non-static-nested-classRepoJobStoreTriggerComparatorisstatic; it never uses the enclosing instance.js/unused-local-variablepopulateAsManagedUser.jspropertyMapping.js/unused-local-variableTemporalConstraintsFormView.jsconstraint.Dismissed as false positives (5):
java/sensitive-log(MappedTableHandler,PostgreSQLMappedTableHandler): they log SQL templates that contain only placeholders. This is the same statement as the previously dismissed Admin-Password cannot be changed via self-service ui #10 and Does not work with OpenJDK 11 #12.js/unused-local-variable(router-authz.js): the helpers are called by name from thecustomAuthzexpressions inaccess.js.Test plan
openidm-quartz-fragmentbuilt with-amagainst openicf 2.1.0-SNAPSHOT; tests 8/8 passnode --checkon both edited JS files