[OpenNMS/opennms] 6c445a: NMS-20102: Migrate all mail sending/reading from J...
Marshall Massengill via opennms-cvs <[email protected]>
| Newsgroups | gmane.network.opennms.cvs |
|---|---|
| Message-ID | <OpenNMS/opennms/push/refs/heads/release-36.x/[email protected]> |
Branch: refs/heads/release-36.x
Home: https://github.com/OpenNMS/opennms
Commit: 6c445ae6c327120986085fa07be7141036575d4e
https://github.com/OpenNMS/opennms/commit/6c445ae6c327120986085fa07be7141036575d4e
Author: Marshall Massengill <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
M container/features/pom.xml
M container/features/src/main/resources/features-core.xml
M container/features/src/main/resources/features.xml
M container/karaf/src/main/filtered-resources/etc/custom.properties
A dependencies/angus-mail-shaded/pom.xml
M dependencies/cxf/pom.xml
R dependencies/javamail/pom.xml
R dependencies/javamail/src/license/THIRD-PARTY.properties
M dependencies/jaxb/pom.xml
M dependencies/pom.xml
M docs/modules/operation/pages/deep-dive/admin/configuration/token-authentication.adoc
M docs/modules/operation/pages/deep-dive/meta-data.adoc
M docs/modules/operation/pages/deep-dive/notifications/configuration.adoc
M docs/modules/reference/pages/daemons/daemon-config-files/notifd.adoc
M docs/modules/reference/pages/service-assurance/monitors/MailTransportMonitor.adoc
M docs/modules/releasenotes/pages/whatsnew.adoc
M features/poller/monitors/core/pom.xml
M features/poller/monitors/core/src/main/java/org/opennms/netmgt/poller/monitors/MailTransportMonitor.java
M features/wsman/pom.xml
M opennms-ackd/pom.xml
M opennms-ackd/src/main/java/org/opennms/netmgt/ackd/readers/MailAckProcessor.java
M opennms-ackd/src/test/java/org/opennms/netmgt/ackd/readers/JavaMailAckReaderIT.java
M opennms-base-assembly/pom.xml
M opennms-base-assembly/src/main/filtered/bin/newts-repository-converter
M opennms-base-assembly/src/main/filtered/etc/examples/javamail-configuration.properties
M opennms-base-assembly/src/main/filtered/etc/javamail-configuration.properties
M opennms-base-assembly/src/main/filtered/etc/javamail-configuration.xml
A opennms-config/src/main/java/org/opennms/netmgt/config/tokenauth/TokenScope.java
M opennms-config/src/main/resources/META-INF/opennms/applicationContext-token-auth.xml
A opennms-config/src/test/java/org/opennms/netmgt/config/tokenauth/TokenScopeTest.java
M opennms-enterprise-reporting/opennms-reportd/pom.xml
M opennms-enterprise-reporting/opennms-reportd/src/main/java/org/opennms/netmgt/reporting/service/JavaMailDeliveryService.java
M opennms-javamail/opennms-javamail-api/pom.xml
M opennms-javamail/opennms-javamail-api/src/main/java/org/opennms/javamail/JavaMailer.java
M opennms-javamail/opennms-javamail-api/src/main/java/org/opennms/javamail/JavaMailer2.java
M opennms-javamail/opennms-javamail-api/src/main/java/org/opennms/javamail/JavaMailerConfig.java
M opennms-javamail/opennms-javamail-api/src/main/java/org/opennms/javamail/JavaReadMailer.java
M opennms-javamail/opennms-javamail-api/src/main/java/org/opennms/javamail/JavaSendMailer.java
A opennms-javamail/opennms-javamail-api/src/test/java/org/opennms/javamail/JavaMailerConfigTokenTest.java
M opennms-javamail/opennms-javamail-api/src/test/java/org/opennms/javamail/JavaMailerTest.java
A opennms-javamail/opennms-javamail-api/src/test/java/org/opennms/javamail/JavaMailerWireTest.java
M opennms-javamail/opennms-javamail-api/src/test/java/org/opennms/javamail/JavaReadMailerTest.java
M opennms-javamail/opennms-javamail-api/src/test/java/org/opennms/javamail/JavaSendMailerTest.java
M opennms-services/pom.xml
M opennms-web-api/pom.xml
M opennms-web-api/src/main/java/org/opennms/web/svclayer/support/DefaultSchedulerService.java
M opennms-web-dependencies/pom.xml
M opennms-webapp-rest/pom.xml
M pom.xml
Log Message:
-----------
NMS-20102: Migrate all mail sending/reading from JavaMail 1.4.7 to Jakarta Mail 2.1 (Part of rework JavaMailNotificationStrategy) (#8701)
* NMS-20102: Jakarta Mail 2.1 build plumbing and MOXy javax.mail shim
Adds dependencyManagement for jakarta.mail-api 2.1.5, angus-mail 2.0.5,
angus-activation 2.0.3, and bumps jakarta.activation-api to 2.1.4 (the
jakarta-namespace line needed by angus; javax-namespace activation
classes continue to come from com.sun.activation:jakarta.activation
1.2.1, which opennms-webapp-rest now references directly).
EclipseLink MOXy 2.5.1 hard-references javax.mail.internet.MimeMultipart
from XMLBinaryDataHelper's initializer, so a javax.mail-namespace API
must stay on the classpath after the jakarta migration. jaxb-dependencies
switches from javax.mail:mail 1.4.7 to com.sun.mail:mailapi 1.6.7: API
classes only, no transport providers, and a distinct Maven GA so it
cannot collide with jakarta.mail-api 2.1.x under dependencyConvergence.
The Karaf javax.mail feature repoints to the jakarta.mail-api 1.6.7
bundle, matching the copy CXF's cxf-specs feature already installs.
* NMS-20102: Remove the jmta local-MTA transport
alt.dev.jmta:jmta:1.0 (2004) subclasses javax.mail.Transport and cannot
load under Jakarta Mail 2.x. The use-jmta attribute and the useJMTA
property remain accepted so existing configuration files keep loading;
JavaMailer now logs a one-time WARN and sends via the configured
transport instead. On the JavaSendMailer path use-jmta was already
inert: the transport always came from sendmail-protocol@transport,
which the schema restricts to smtp|smtps, so the removed "mta" branch
there was unreachable. Shipped defaults change to use-jmta="false".
Behavior change for installs that relied on the local MTA transport:
mail now goes over SMTP to the configured sendmail host (default
127.0.0.1:25) instead of through the in-process JMTA class.
* NMS-20102: Migrate mail code to Jakarta Mail 2.1 / Eclipse Angus
Renames javax.mail.* to jakarta.mail.* and javax.activation.* to
jakarta.activation.* across the mail senders/readers (opennms-javamail,
ackd, poller MailTransportMonitor, reportd, web-api) and their tests.
opennms-javamail-api now depends on jakarta.mail-api with angus-mail
and angus-activation as runtime providers, flowing transitively to all
consumers; direct importers declare jakarta.mail-api explicitly.
Spring 4.2.9's MimeMessageHelper is compiled against javax.mail, so
JavaSendMailer.buildMimeMessage() and reportd's JavaMailDeliveryService
build their MIME messages directly (same structure: single-part message
for sendmail, mixed multipart with a plain/HTML alternative and the
report attachment for reportd). This also drops opennms-javamail-api's
mandatory org.springframework.mail.javamail OSGi import.
Container: new jakarta.mail Karaf feature (API + Angus bundles at the
system start level); the opennms-javamail feature uses it; the
javax.mail feature remains for the MOXy shim consumers. custom.properties
exports the jakarta.mail/jakarta.activation packages from the flat
classpath. The wsman bundle marks jakarta.mail optional: it accidentally
embeds poller-monitors-core's whole org.opennms.netmgt.poller.monitors
package (split package with WsManMonitor), and the unused embedded
MailTransportMonitor copy is where its mail import comes from.
* NMS-20102: Ban javax.mail:mail and legacy mail spec jars
Inverts the enforcer rule that required javax.mail:mail: the banned list
now covers javax.mail:mail, com.sun.mail:javax.mail/jakarta.mail, the
merged org.eclipse.angus:jakarta.mail artifact (would duplicate the
API + angus-mail classes), and geronimo-javamail_1.4_spec, which reached
$OPENNMS_HOME/lib undeclared through abdera-parser/axiom and is now
excluded at its source in cxf-dependencies. com.sun.mail:mailapi remains
allowed as the MOXy shim.
Also fixes the newts-repository-converter activation-jar glob, which
matched nothing (lib/jdk9plus ships the servicemix activation-api jar,
not javax.activation-*.jar).
* NMS-20102: Wire JavaSendMailer's built properties into its Session
createProps() assembled <javamail-property> entries and the computed
mail.smtp.* keys, then returned the JVM-default session's properties
instead ("//get rid of this"), so none of it ever reached the Session;
configureProperties() additionally merged everything into a local
variable that went nowhere. The Session now receives the merged set:
javamail-configuration.properties (only when useJmProps=true, matching
the constructor contract), overlaid by <javamail-property> entries,
with computed keys filled in only where absent so user values win.
Session-property-driven features - mail.smtp.auth.mechanisms=XOAUTH2
in particular - become usable on the XML config path.
Applied property names are logged at INFO on session creation since
previously-inert <javamail-property> entries in existing configuration
files take effect on upgrade.
Also assigns the parent JavaMailer2 session, which reportd reads via
getSession() and previously received as null.
* NMS-20102: Resolve ${token:<name>} in mail credentials for XOAUTH2
Adds TokenScope, a mate Scope over the token-auth TokenProvider under
the "token" context, registered in the token-auth application context.
JavaMailerConfig now interpolates credentials against a FallbackScope
of the SCV scope and the token scope, each independently optional, so
${token:<name>} works wherever ${scv:...} already did: the
authenticateUser/authenticatePassword properties and the XML
user-auth fields (both resolved at connect time, so tokens are always
fresh via the token cache).
With Angus providing the XOAUTH2 SASL mechanism natively, OAuth2 SMTP
(Microsoft 365 client-credentials, Gmail) needs only configuration:
a token-auth definition for the provider's token endpoint, plus
authenticate=true, mail.smtp.auth.mechanisms=XOAUTH2, and
${token:<name>} as the password. No mail-code OAuth client required.
The token scope resolves per interpolation (no caching in the scope) -
covered by tests asserting fetch-per-call semantics.
* NMS-20102: Add wire-level mail tests (GreenMail + fake-SMTP XOAUTH2)
The mail code had no non-manual wire coverage: every send/receive test
was @Ignore'd against real servers. JavaMailerWireTest runs the actual
Angus SMTP/IMAP providers against an embedded GreenMail 2.x on dynamic
ports: plain send, authenticated send, JavaSendMailer end-to-end from a
SendmailConfig (locks in the createProps fix), and JavaReadMailer over
IMAP.
XOAUTH2 is asserted byte-level against a minimal in-test SMTP server,
since GreenMail doesn't implement that SASL mechanism: the client must
emit AUTH XOAUTH2 with base64("user=<u>\x01auth=Bearer <token>\x01\x01"),
which is the exact string Microsoft 365 and Gmail validate.
greenmail excludes org.eclipse.angus:jakarta.mail (the banned merged
API+impl jar); the split artifacts provide the same classes. The tests
set mail.smtp timeouts so protocol mismatches fail in seconds instead
of hanging the build.
* NMS-20102: Document XOAUTH2 mail authentication and migration notes
Adds a worked Microsoft 365 client-credentials example to the token
authentication page (token-auth block plus both the properties-file and
javamail-configuration.xml recipes), references the token context from
the notifd config-file table and the metadata DSL page, and comments the
XOAUTH2 pattern in the shipped javamail-configuration.properties.
Release notes cover the Jakarta Mail migration and its three upgrade
notes: checkserveridentity now defaults to true on SSL/TLS connections,
use-jmta is accepted but inert, and <javamail-property> entries take
effect on the sendmail path.
* NMS-20102: Apply adversarial-review findings
Code fixes:
- angus-mail on the flat classpath is replaced by angus-mail-shaded,
which strips META-INF/mailcap and META-INF/javamail(.default).providers.
Those javax-era resource names list jakarta-namespace classes, and the
javax.activation command map reads them from every jar: with
com.sun.activation as the javax impl, a text/plain DataHandler lookup
fails outright (reproduced), taking down unrelated javax consumers.
The jakarta runtime keeps working via META-INF/jakarta.mailcap and
ServiceLoader, both retained; Karaf features keep vanilla angus-mail
(bundle isolation makes the resources harmless there).
- reportd attachments carry their real MIME type again (PDF/CSV/XLS
registered on the data source); a bare FileDataSource labeled every
report application/octet-stream.
- JavaSendMailer only advertises mail.smtp(s).auth=true when a user-auth
is actually configured; use-authentication="true" without credentials
kept sending unauthenticated before the session properties became
real, and now warns instead of failing the connect.
- transport 'mta' (still possible via the unvalidated properties file)
maps to smtp with a warning instead of NoSuchProviderException; the
removed-JMTA warning is per-mailer instead of once per JVM.
- TokenScope resolves to empty (WARN) on token-provider failures so a
transient token-endpoint outage cannot abort mailer construction.
- JavaMailerConfig.getProperties is no longer synchronized: credential
interpolation may fetch an OAuth token over HTTP, and the class
monitor serialized every mail path in the JVM on that request.
- custom.properties additionally exports jakarta.activation.spi, so
angus-activation wires both packages to the same provider.
Tests: XOAUTH2 wire test now drives the full documented composition
(${token:name} in javamail-configuration.properties resolved through
the token scope to the Bearer token on the wire); new authenticated
JavaSendMailer wire test; fake SMTP thread is a daemon; JavaSendMailer
wire tests set mail timeouts via <javamail-property>; test scope/system
property state is restored after each class.
Docs: metadata page no longer suggests readmail-config credentials
interpolate (they do not); XOAUTH2 mechanism line documented as
required rather than advisory; M365 prerequisites include the mailbox
permission grant; release notes cover the provider-less javax.mail API
(third-party plugins) and MailTransportMonitor sendmail-test behavior;
MailTransportMonitor reference page marks use-jmta deprecated; shipped
and example properties files carry the XOAUTH2 recipe with a
duplicate-key note.
* NMS-20102: Address Copilot review feedback
JavaSendMailer.buildMimeMessage() parses the to address with
InternetAddress.parse(to, false), matching JavaMailer, so
comma-separated recipient lists in sendmail-message work; the previous
single-address constructor matched the old MimeMessageHelper behavior
but diverged from the rest of the module. Wire test now sends to two
recipients. Also drops the duplicated mail.smtp.quitwait defaulting
block (pre-existing) and restores the opennms.home system property
after each JavaMailerWireTest.
* NMS-20102: Keep the message body on streamed mail attachments
JavaMailer.buildMessage() has two attachment branches: the file branch
builds a multipart with the message text followed by the attachment,
while the stream branch (added in 1dfc6c9e481, 2010) added only the
attachment part. Callers that set an input stream therefore lost the
message text entirely -- DefaultReportWrapperService sets both, so every
emailed database report arrived as a bare PDF or CSV with no body.
The stream branch now adds the text part first, matching the file
branch. Covered by a GreenMail wire test asserting both parts and their
order; the test fails on the previous behavior with one part instead of
two.
Pre-existing on release-36.x and unrelated to the Jakarta migration,
folded in here since this is the mail rework.
* NMS-20102: Document mail server TLS certificate verification
Angus enforces certificate trust and host-name verification
independently, and mail.smtp.ssl.trust suppresses only the first --
including when set to "*", the conventional workaround for self-signed
certificates. Installations carrying it therefore still fail
host-name verification after the upgrade, which the release note did
not convey.
Adds a Mail server TLS section to the notification configuration page
covering both properties, the two distinct failure messages, and which
property applies to each; the release note is trimmed to the behavior
change and points there. Verified against a STARTTLS server presenting
a certificate for a different name.
* NMS-20102: Trim the Jakarta Mail release note
Condense the whatsnew entry to the changes an upgrader has to act on and
push the detail to the notifications and token-authentication pages.
Also drop the note about readmail-config not supporting metadata
expressions, which does not belong in the list of what does.
To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list
To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs