Unable to use non-shaded client with `AuthenticationToken`

[austek]

When using the non-shaded pulsar client enabling AuthenticationToken causes

An attempt was made to call a method that does not exist. The attempt was made from the following location:

    org.springframework.boot.autoconfigure.pulsar.PulsarPropertiesMapper.getAuthenticationParamsJson(PulsarPropertiesMapper.java:90)

The following method did not exist:

    'org.apache.pulsar.shade.com.fasterxml.jackson.databind.ObjectMapper org.apache.pulsar.common.util.ObjectMapperFactory.create()'

The calling method's class, org.springframework.boot.autoconfigure.pulsar.PulsarPropertiesMapper, was loaded from the following location:

A sample project with the problem

[onobc]

Thanks for the report @austek ,

While the ObjectMapperFactory is not shaded, it does indeed look like the returned ObjectMapper is in fact a shaded variant.
This issue is actually in Spring Boot at this point but I will submit a PR to that project under this ticket.

[onobc]

@austek we do recommend using the shaded pulsar client w/ Spring Boot as the Pulsar client uses earlier versions of 3rd party libs that are also used by Spring Boot. You may run into classpath version mismatches. Regardless, I am going to submit a fix for this issue.

[austek]

@austek we do recommend using the shaded pulsar client w/ Spring Boot as the Pulsar client uses earlier versions of 3rd party libs that are also used by Spring Boot. You may run into classpath version mismatches. Regardless, I am going to submit a fix for this issue.

I understand the recommendation, however security scans picked up CVEs which needs to be addressed and with shaded dependencies that's not really easy

[onobc]

I understand @austek , it sounds like you are using the unshaded so that you can override the vulnerable dependencies.

Did you file an issue w/ Pulsar on the affected libs? If not, please let me know which ones in particular and I will file an issue and get a fix into Pulsar.

Thanks

[onobc]

@austek the fix has been merged into Spring Boot 3.2.x branch and will be available in Spring Boot 3.2.3 on 2024-11-22.