[BUG] Version problem of nimbus-jose-jwt in azure-keyvault-secrets-spring-boot-starter-2.1.7 #14898
Comments
ghost
added
needs-triage
|
A screenshot with the dependency tree The new com.nimbusds:nimbus-jose-jwt:9.0 version |
|
This solved my problem, as a workaround. 8.20 is last version that worked for us |
|
i just ran into the same issue. Your post helped. Thank you. For those using gradle, this worked for me >> |
|
Same for me, many thanks ! I had this exception: to my pom.xml file, fixed the issue. |
joshfree
added
azure-spring-keyvault
ghost
removed
the
needs-triage
|
Thanks for reporting this @mercer. @vcolin7 @jialindai can you please follow up? |
|
No problem, I'm looking into this. |
|
Usually when we see a I set up a small Key Vault Spring project and was able to run it without issue with version
Can you try running |
Please pin down all your dependency versions, even if I'm wrong about the root cause, as safety for future transient dependency changes. (for example all spring starters guarantee that all the jars you get work well together, they do extensive tests to prove this, so that we don't have to) Good luck 👍 |
joshfree
added
the
tracking-external-issue
|
Let's do two things here; Let's open an external bug on adal4j to fix their unbounded dependencies; and let's also update spring to ensure we don't float versions. @vcolin7 can you open up the adal bug please? @jialindai can you follow up on the sprint starter? |
|
The issue is being hit thru azurestack specific libraries as well |
|
Conclusion: Please add the following fragment in your pom to solve the problem. More details:
It's caused by After adding the following fragment in The
Links: |
|
@chenrujun I think we should keep this open until the offending dependency is pinned down either by Nimbus, ADAL4J or in the Spring Boot Starter for Key Vault. Even though the workaround is pretty useful, our libraries should work out of the box without requiring customers doing something like that. |
|
Hi, @vcolin7 . Thank you for your check. The root cause of this problem is oauth2-oidc-sdk used version ranges instead of explicit dependencies, The latest version of azure-keyvault-secrets-spring-boot-starter (2.3.5) already use oauth2-oidc-sdk-7.1.1:
So the problem does not exist if we use azure-keyvault-secrets-spring-boot-starter-2.3.5. Maybe we can close the issue now? |
|
@chenrujun The problem is that apparently the customer cannot use a newer version of the Spring Boot Starter because after @mercer is it possible for you to try making the upgrade to the latest Spring Boot Key Vault Starter version to see if things can be built with it? All functionality from Track 1 Key Vault clients (
The Spring Boot Key Vault Starter has leveraged these clients and, based on some tests I've run in a sample project, it seems you can go from version |
|
I'm afraid I can't go higher than |
|
I see :( In that case I would recommend going with the workaround mentioned earlier in this thread. A good thing to come out of this is that ADAL4J will make the switch to a newer version of //cc @chenrujun |
chenrujun
changed the title
Describe the bug
azure-keyvault-secrets-spring-boot-starter has latest com.nimbusds:nimbus-jose-jwt as a transitive dependency. Latest version, 9.0 released on September 6 is not backwards compatible.
Upgrade to 2.3.x is not an option for us, as you have breaking changes to api, for example com.microsoft.azure.keyvault.KeyVaultClient is gone.
Exception or Stack Trace
Steps to reproduce
Expected behavior
I expect azure-keyvault-secrets client to continue to authenticate to keyvault, given no code changes, no azure-keyvault-secrets version is changed, and, presumably, no api changes with azure keyvault went live on September 6.
Setup (please complete the following information):
Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report
The text was updated successfully, but these errors were encountered: