Adding security websphere.javaee.security jar to Liberty Server classpath

Question

I am attempting to use a third party application to instrument Liberty Server 18.0 and attempting to add a library to the liberty server classpath on Linux. The library is called: "com.ibm.websphere.javaee.security.1.0_1.0.21.jar" and it is under the "/wlp/dev/api/sec" of the Liberty Server.

In my defaultServer directory I have tried several things including in my jvm.options file:

-Dorg.osgi.framework.bootdelegation=META-INF.services,com.singularity.*,com.ibm.*
-Djava.security.policy=/opt/wlp/usr/servers/defaultServer/server.policy
-Xbootclasspath/p:/opt/wlp/dev/api/spec
-javaagent:/opt/myserveragent/javaagent.jar

I've validated that my server is taking that classpath argument but it seems to have no affect. I've also attempted to add this folder also to my server.xml

<library id="agent">
  <fileset dir="/opt/wlp/dev/api/spec" includes="*.jar" scanInterval="5s" />
</library>

In desperation I've also tried to simply copy the jars from the /dev/api/sec/ folder to the /wlp/lib directory which appears to be the default folder where all the main liberty classes are loaded from..

Whenever I run:

lsof -p xxxx

I can see that it is never loaded. How do I add this jar to my defaultServer classpath so my third party library can use it?

If you enable the appSecurity-3.0 feature in server.xml, that will expose the com.ibm.websphere.javaee.security.1.0_* lib to your application classloader. Would that be sufficient? — Andy Guibert
If you specify a directory for -Xbootclasspath then it expects the class files to be rooted in that directory, it doesn't add the jar files in that directory to the classpath, so you haven't actually added it to the classpath. I'm a little nervous about the approach because it changes the class space model and you could end up with ClassCastExceptions. — Alasdair
also, if you stick with the -Xbootclasspath route, use -Xbootclasspath/a (append) rather than -Xbootclasspath/p (prepend) because the /p option is removed in JDK 9+ and is only needed if you're overriding JDK classes (which you aren't) — Andy Guibert
I've tried to adding all the "appSecurity-x-x-x" bundles and also the "localConnector-1.0" feature. My agent is trying to pull the JMX metrics for "Websphere" but I continually get an error saying: "ERROR JMXTransientOperationsHandler - Error trying to lookup clz - java.lang.ClassNotFoundException: com.ibm.ws.security.core.SecurityContext". I've also removed -Xbootclasspath settings and still getting this error.. — Kevin

Kevin Kevin · Accepted Answer · 2018-08-10T22:02:18

The best way to do this is to add it to the jvm.options file of your server instance:

-Xbootclasspath/p:/opt/wlp/lib/com.ibm.websphere.security_1.1.21.jar

However; as both Andy and Alasdair mentioned in the comments it seems to affect the admin-Center feature. So not recommended!!

Adding security websphere.javaee.security jar to Liberty Server classpath

1 Answers