From 2c1caf9c6ad4a6d3dbd36e24522ffe20791c1de5 Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Tue, 8 Sep 2026 17:31:39 -0400
Subject: [PATCH] fix(deps): declare activemq-jaas explicitly (broker declares
 it as optional)

activemq-broker-5.16.8.pom declares activemq-jaas as <optional>true</optional>,
so Maven never pulls it in transitively. The org.apache.activemq.jaas.GroupPrincipal
class lives in activemq-jaas-5.16.8.jar (not in activemq-broker-5.16.8.jar),
so as soon as the SimpleAuthenticationPlugin(List<?>) constructor is exercised,
the JVM throws:

  NoClassDefFoundError: org/apache/activemq/jaas/GroupPrincipal

This was a latent issue under the T2.2 hardening (#166). The
<simpleAuthenticationPlugin anonymousAccessAllowed="false"/> block did not
call the List ctor (it constructed the plugin with the no-arg ctor, which
doesn't reference GroupPrincipal), so the missing class was never observed.
PR #215 changed the config to <users><authenticationUser .../></users>, which
forces the List ctor, which surfaces the missing class.

The WebUI module's pom declares dependencies on activemq-broker,
activemq-client, activemq-kahadb-store, activemq-spring, activemq-jms-pool
-- but not activemq-jaas. The root pom's dependencyManagement block is
missing activemq-jaas too. Maven respects <optional>true</optional> and
does not transitively include optional deps, so the jar is never resolved,
downloaded, or copied to WEB-INF/lib/.

Fix has two parts:
1. Add activemq-jaas to the root pom's dependencyManagement (with
   version pinned to ${activemq.version} to match the other 5.16.8
   entries).
2. Add activemq-jaas to WebUI/pom.xml as a runtime dependency.

activemq-jaas-5.16.8.jar is ~38KB; the runtime cost is negligible.

Refs #216

> Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.
---
 WebUI/pom.xml | 4 ++++
 pom.xml       | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/WebUI/pom.xml b/WebUI/pom.xml
index 187f289e2..8b33c3638 100644
--- a/WebUI/pom.xml
+++ b/WebUI/pom.xml
@@ -363,6 +363,10 @@
             <groupId>org.apache.activemq</groupId>
             <artifactId>activemq-jms-pool</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.apache.activemq</groupId>
+            <artifactId>activemq-jaas</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-core</artifactId>
diff --git a/pom.xml b/pom.xml
index fecdb90b8..c058e296c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -988,6 +988,11 @@
                 <artifactId>activemq-jms-pool</artifactId>
                 <version>${activemq.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.activemq</groupId>
+                <artifactId>activemq-jaas</artifactId>
+                <version>${activemq.version}</version>
+            </dependency>
             <dependency>
                 <groupId>commons-digester</groupId>
                 <artifactId>commons-digester</artifactId>