pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project
	xmlns="http://maven.apache.org/POM/4.0.0"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<groupId>org.semoss</groupId>
	<artifactId>monolith</artifactId>
	<version>${ci.version}</version>
	<packaging>war</packaging>
	<name>Monolith</name>
	<description>SEMOSS Monolith</description>
	<url>http://semoss.org/</url>
	<licenses>
		<license>
			<name>The Apache License, Version 2.0</name>
			<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
		</license>
	</licenses>
	<developers>
		<developer>
			<name>Group Mailbox</name>
			<email>semoss@semoss.org</email>
			<organization>SEMOSS</organization>
			<organizationUrl>http://semoss.org/</organizationUrl>
		</developer>
	</developers>
	<scm>
		<connection>scm:git:git://github.com/SEMOSS/Monolith.git</connection>
		<developerConnection>scm:git:ssh://github.com:SEMOSS/Monolith.git</developerConnection>
		<url>https://github.com/SEMOSS/Monolith</url>
	</scm>
	<properties>
		<ci.version>0.0.1-SNAPSHOT</ci.version>
		<project.build.sourceEncoding>cp1252</project.build.sourceEncoding>
		<project.reporting.outputEncoding>cp1252</project.reporting.outputEncoding>
		<maven.build.timestamp.format>yyyy-MM-dd HH:mm:ss</maven.build.timestamp.format>
		<build.date>${maven.build.timestamp}</build.date>
		<!-- Shared by the dev and deploy profiles, which configure the same plugin. -->
		<maven.war.plugin.version>3.4.0</maven.war.plugin.version>
		<!-- Multi-artifact families that must move together. Each version below is
		     shared by two or more declared dependencies; bump the property, not the
		     individual <version> elements. -->
		<resteasy.version>7.0.4.Final</resteasy.version>
		<jakarta.websocket.version>2.2.0</jakarta.websocket.version>
		<!-- Pins that Semoss/pom.xml also carries at the same value. Its
		     dependencyManagement is not inherited here, so each pom needs its own
		     copy and the two have to be bumped together. -->
		<!-- Version 1.85 addresses vulnerabilities inherited through SSHJ. -->
		<bc.jdk18on.version>1.85</bc.jdk18on.version>
		<netty.version>4.1.137.Final</netty.version>
		<jackson3.version>3.1.5</jackson3.version>
		<!-- BouncyCastle FIPS, consumed only by the fips profile below. Keep in sync
		     with the properties of the same name in Semoss/pom.xml and the
		     BC_*_VERSION build args in Semoss/docker/Dockerfile.tomcat. -->
		<bc.fips.version>2.1.3</bc.fips.version>
		<bcpkix.fips.version>2.1.12</bcpkix.fips.version>
		<bctls.fips.version>2.1.24</bctls.fips.version>
		<bcutil.fips.version>2.1.7</bcutil.fips.version>
		<!-- Must match the sshj version in Semoss/pom.xml. dependencyManagement
		     applies it to the normal transitive dependency, while the fips profile
		     re-declares sshj to strip its non-FIPS BouncyCastle transitives. -->
		<sshj.version>0.41.0</sshj.version>
	</properties>
	<!-- LEGACY
	<distributionManagement><snapshotRepository><id>ossrh</id><url>https://oss.sonatype.org/content/repositories/snapshots</url></snapshotRepository><repository><id>ossrh</id><url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url></repository></distributionManagement>
	-->
	<reporting>
		<plugins>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-project-info-reports-plugin</artifactId>
				<version>3.4.5</version>
				<reportSets>
					<reportSet>
						<reports>
							<report>index</report>
							<report>summary</report>
							<report>dependency-info</report>
							<report>dependencies</report>
							<report>dependency-convergence</report>
						</reports>
					</reportSet>
				</reportSets>
			</plugin>
		</plugins>
	</reporting>
	<build>
		<sourceDirectory>src</sourceDirectory>
		<plugins>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>3.14.0</version>
				<configuration>
					<source>21</source>
					<target>21</target>
					<encoding>cp1252</encoding>
				</configuration>
			</plugin>
			<plugin>
				<groupId>com.mycila</groupId>
				<artifactId>license-maven-plugin</artifactId>
				<version>4.3</version>
				<configuration>
					<header>src/license/header.txt</header>
					<properties>
						<year>2015</year>
						<owner>Defense Health Agency (DHA)</owner>
					</properties>
					<includes>
						<include>**/*.java</include>
					</includes>
					<headerDefinitions>
						<headerDefinition>src/license/header-style.xml</headerDefinition>
					</headerDefinitions>
					<mapping>
						<java>javadoc_style</java>
					</mapping>
					<useDefaultMapping>true</useDefaultMapping>
					<strictCheck>true</strictCheck>
				</configuration>
				<executions>
					<execution>
						<id>format-headers</id>
						<phase>process-sources</phase>
						<goals>
							<goal>format</goal>
						</goals>
					</execution>
					<execution>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<version>3.6.1</version>
				<executions>
					<execution>
						<id>no-duplicate-declared-dependencies</id>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<banDuplicatePomDependencyVersions/>
								<!-- <dependencyConvergence/> -->
							</rules>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-dependency-plugin</artifactId>
				<version>3.6.0</version>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-antrun-plugin</artifactId>
				<version>3.1.0</version>
				<executions>
					<execution>
						<phase>process-resources</phase>
						<goals>
							<goal>run</goal>
						</goals>
						<configuration>
							<target>
								<mkdir dir="${project.build.outputDirectory}/META-INF/maven/${project.groupId}/${project.artifactId}"/>
								<tstamp>
									<format property="build.timestamp.utc" pattern="yyyy-MM-dd HH:mm:ss z" timezone="UTC" />
								</tstamp>
								<propertyfile file="${project.build.outputDirectory}/META-INF/maven/${project.groupId}/${project.artifactId}/pom.properties">
									<entry key="groupId" value="${project.groupId}" />
									<entry key="artifactId" value="${project.artifactId}" />
									<entry key="version" value="${project.version}" />
									<entry key="ci.version" value="${project.version}" />
									<entry key="build.date" value="${build.timestamp.utc}" />
								</propertyfile>
							</target>
						</configuration>
					</execution>
					<!-- this is so log4j can pick up the plugins working in eclipse -->
					<execution>
						<id>copy-semoss-resources</id>
						<phase>process-resources</phase>
						<goals>
							<goal>run</goal>
						</goals>
						<configuration>
							<target>
								<mkdir dir="${project.build.outputDirectory}/META-INF/org/apache/logging/log4j/core/config/plugins"/>
								<copy file="../Semoss/src/main/resources/META-INF/org/apache/logging/log4j/core/config/plugins/Log4j2Plugins.dat"
			                          todir="${project.build.outputDirectory}/META-INF/org/apache/logging/log4j/core/config/plugins"
			                          overwrite="true"
			                          failonerror="false"/>
							</target>
						</configuration>
					</execution>
				</executions>
			</plugin>
		</plugins>
	</build>
	<profiles>
		<profile>
			<id>dev</id>
			<activation>
				<activeByDefault>true</activeByDefault>
			</activation>
			<build>
				<plugins>
					<!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-war-plugin -->
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-war-plugin</artifactId>
						<version>${maven.war.plugin.version}</version>
						<configuration>
							<webXml>WebContent/WEB-INF/web.xml</webXml>
							<failOnMissingWebXml>true</failOnMissingWebXml>
							<attachClasses>true</attachClasses>
							<warSourceDirectory>${basedir}/WebContent</warSourceDirectory>
							<warSourceIncludes>
								accountLocked/**,
								error/**,
								login/**,
								logout/**,
								noUserFail/**,
								saml2/**,
								samlLogin/**,
								samlSPLogin/**,
								sessionCounterFail/**,
								setAdmin/**,
								share/**,
								startUpFail/**,
							</warSourceIncludes>
						</configuration>
					</plugin>
				</plugins>
			</build>
		</profile>
		<profile>
			<id>deploy</id>
			<!-- note that this only works for jdk [1.8,) -->
			<!-- however, the following would enable this profile, -->
			<!-- and we want to stick with dev unless -P deploy is given
			explicitly -->
			<!--activation><jdk>[1.8,)</jdk></activation-->
			<!-- disabling javadoc lint - ideally should clean up javadocs -->
			<!-- see https://stackoverflow.com/a/16743137/9612364 -->
			<properties>
				<javadoc.opts>-Xdoclint:none</javadoc.opts>
			</properties>
			<build>
				<plugins>
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-war-plugin</artifactId>
						<version>${maven.war.plugin.version}</version>
						<configuration>
							<webXml>WebContent/WEB-INF/web.xml</webXml>
							<failOnMissingWebXml>true</failOnMissingWebXml>
							<attachClasses>true</attachClasses>
							<warSourceDirectory>${basedir}/WebContent</warSourceDirectory>
							<warSourceIncludes>
								accountLocked/**,
								error/**,
								login/**,
								logout/**,
								noUserFail/**,
								saml2/**,
								samlLogin/**,
								samlSPLogin/**,
								sessionCounterFail/**,
								setAdmin/**,
								share/**,
								startUpFail/**,
							</warSourceIncludes>
							<packagingExcludes>
								%regex[WEB-INF/lib/(?!semoss-${ci.version}).*.jar]
							</packagingExcludes>
						</configuration>
					</plugin>
					<plugin>
						<artifactId>maven-assembly-plugin</artifactId>
						<version>2.5.3</version>
						<executions>
							<!-- Both tarballs come from ONE build. The docker workflows build
							     the standard and -fips images from the same SEMOSS_VERSION, so
							     both classifiers must exist under that version. libraries-fips
							     differs only by excluding BouncyCastle, which it does by
							     filename rather than by Maven scope so no second build or
							     profile toggle is needed. -->
							<execution>
								<id>create-archive</id>
								<phase>package</phase>
								<goals>
									<goal>single</goal>
								</goals>
								<configuration>
									<descriptor>libraries.xml</descriptor>
								</configuration>
							</execution>
							<execution>
								<id>create-archive-fips</id>
								<phase>package</phase>
								<goals>
									<goal>single</goal>
								</goals>
								<configuration>
									<descriptor>libraries-fips.xml</descriptor>
								</configuration>
							</execution>
						</executions>
					</plugin>
					<!-- LEGACY
					<plugin><groupId>org.sonatype.plugins</groupId><artifactId>nexus-staging-maven-plugin</artifactId><version>1.6.7</version><extensions>true</extensions><configuration><serverId>ossrh</serverId><nexusUrl>https://oss.sonatype.org/</nexusUrl><autoReleaseAfterClose>false</autoReleaseAfterClose></configuration></plugin>
					-->
					<!-- LEGACY
					<plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-gpg-plugin</artifactId><version>1.5</version><executions><execution><id>sign-artifacts</id><phase>verify</phase><goals><goal>sign</goal></goals><configuration><gpgArguments><arg>loopback</arg></gpgArguments></configuration></execution></executions></plugin>
					-->

					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-gpg-plugin</artifactId>
						<version>3.2.8</version>
						<executions>
							<execution>
								<id>sign-artifacts</id>
								<phase>verify</phase>
								<goals>
									<goal>sign</goal>
								</goals>
								<configuration>
									<bestPractices>true</bestPractices>
									<executable>gpg</executable>
									<gpgArguments>
										<arg>--pinentry-mode</arg>
										<arg>loopback</arg>
									</gpgArguments>
								</configuration>
							</execution>
						</executions>
					</plugin>

					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-source-plugin</artifactId>
						<executions>
							<execution>
								<id>attach-sources</id>
								<goals>
									<goal>jar</goal>
								</goals>
							</execution>
						</executions>
					</plugin>
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-javadoc-plugin</artifactId>
						<version>2.9.1</version>
						<executions>
							<execution>
								<id>attach-javadocs</id>
								<goals>
									<goal>jar</goal>
								</goals>
								<!-- disabling javadoc lint - ideally should
								clean up javadocs -->
								<configuration>
									<additionalparam>${javadoc.opts}</additionalparam>
								</configuration>
							</execution>
						</executions>
					</plugin>
					<plugin>
						<groupId>org.sonatype.central</groupId>
						<artifactId>central-publishing-maven-plugin</artifactId>
						<version>0.8.0</version>
						<extensions>true</extensions>
						<configuration>
							<publishingServerId>central</publishingServerId>
						</configuration>
					</plugin>
				</plugins>
			</build>
		</profile>
		<profile>
			<!-- Build the war for a FIPS 140-3 deployment: keep the BouncyCastle jars
			     out of WEB-INF/lib so the container's copies on the system classloader
			     (${JAVA_HOME}/lib/fips) are the only ones present.
			     These are declared directly rather than relying on semoss's scope,
			     because transitive scope is read from the published semoss pom (which
			     resolves bc.fips.scope to compile) and only a direct declaration
			     overrides it.
			     Note dev is activeByDefault, and Maven drops activeByDefault as soon
			     as any other profile is named, so pass it alongside: -P dev,fips
			     locally or -P deploy,fips for a release build. -->
			<id>fips</id>
			<dependencies>
				<dependency>
					<groupId>org.bouncycastle</groupId>
					<artifactId>bc-fips</artifactId>
					<version>${bc.fips.version}</version>
					<scope>provided</scope>
				</dependency>
				<dependency>
					<groupId>org.bouncycastle</groupId>
					<artifactId>bcpkix-fips</artifactId>
					<version>${bcpkix.fips.version}</version>
					<scope>provided</scope>
				</dependency>
				<!-- Not referenced at compile time - the JSSE provider is loaded from
				     java.security at runtime. Declared so dependency scanners and the
				     module inventory see it. -->
				<dependency>
					<groupId>org.bouncycastle</groupId>
					<artifactId>bctls-fips</artifactId>
					<version>${bctls.fips.version}</version>
					<scope>provided</scope>
				</dependency>
				<dependency>
					<groupId>org.bouncycastle</groupId>
					<artifactId>bcutil-fips</artifactId>
					<version>${bcutil.fips.version}</version>
					<scope>provided</scope>
				</dependency>
				<!-- sshj pulls the non-FIPS bcprov/bcpkix/bcutil-jdk18on at runtime
				     scope. Those would land in WEB-INF/lib beside the container's
				     bc-fips on the system classloader, with both owning the
				     org.bouncycastle.* namespace across two classloaders.
				     Re-declared here only so the exclusion applies - a direct
				     declaration at depth 1 overrides the transitive one from semoss.
				     sshj itself stays at compile scope, so it is still packaged and
				     SFTPStorageEngine still loads.
				     This exclusion controls packaging, not SSH algorithm negotiation.
				     SFTPStorageEngine.createSshConfig() explicitly restricts algorithms
				     when the runtime requests FIPS and requires BCFIPS in approved-only
				     mode. Standard mode retains SSHJ defaults. See
				     Semoss/docker/SSHJ-FIPS.md for the inventory and policy exclusions.
				     Password authentication still processes the server's public key.
				     The wildcard also excludes future org.bouncycastle artifacts
				     introduced through this SSHJ dependency. -->
				<dependency>
					<groupId>com.hierynomus</groupId>
					<artifactId>sshj</artifactId>
					<version>${sshj.version}</version>
					<exclusions>
						<exclusion>
							<groupId>org.bouncycastle</groupId>
							<artifactId>*</artifactId>
						</exclusion>
					</exclusions>
				</dependency>
			</dependencies>
		</profile>
	</profiles>
	<repositories>
		<repository>
			<id>repo1</id>
			<name>Maven Repository Switchboard</name>
			<layout>default</layout>
			<url>https://repo.maven.apache.org/maven2</url>
			<snapshots>
				<enabled>false</enabled>
			</snapshots>
		</repository>
		<repository>
			<name>Central Portal Snapshots</name>
			<id>central-portal-snapshots</id>
			<url>https://central.sonatype.com/repository/maven-snapshots/</url>
			<releases>
				<enabled>false</enabled>
			</releases>
			<snapshots>
				<enabled>true</enabled>
			</snapshots>
		</repository>
		<repository>
			<id>3rdPartyJARs</id>
			<name>Maven repository</name>
			<url>https://maven.semoss.org/repository/3rdPartyJARs</url>
			<releases>
				<enabled>true</enabled>
			</releases>
			<snapshots>
				<enabled>true</enabled>
			</snapshots>
		</repository>
	</repositories>
	<dependencyManagement>
		<dependencies>
			<!-- Override the SSHJ version inherited through Semoss so Monolith does not
			     depend on which Semoss snapshot is installed when this branch is built. -->
			<dependency>
				<groupId>com.hierynomus</groupId>
				<artifactId>sshj</artifactId>
				<version>${sshj.version}</version>
			</dependency>
			<!-- Converge the non-FIPS BouncyCastle that sshj brings in. Version 1.85
			     addresses the vulnerabilities inherited through SSHJ and ensures the
			     non-FIPS war ships one consistent BouncyCastle release.
			     dependencyManagement is not inherited from the semoss pom, so this
			     has to be repeated here even though Semoss/pom.xml pins the same
			     versions. Only affects non-FIPS builds; the fips profile below
			     excludes these entirely. -->
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bcprov-jdk18on</artifactId>
				<version>${bc.jdk18on.version}</version>
			</dependency>
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bcpkix-jdk18on</artifactId>
				<version>${bc.jdk18on.version}</version>
			</dependency>
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bcutil-jdk18on</artifactId>
				<version>${bc.jdk18on.version}</version>
			</dependency>
			<!-- Converge the FIPS BouncyCastle that reaches the non-FIPS war. Two
			     separate paths feed it: bcpkix-fips from semoss, whose artifacts
			     declare each other with open ranges (bcpkix-fips wants bcutil-fips
			     [2.1.7,2.2.0), bcutil-fips wants bc-fips [2.1.0,2.2.0)), and
			     opendj-core via openam-shared, which pins an older bctls-fips. -->
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bc-fips</artifactId>
				<version>${bc.fips.version}</version>
			</dependency>
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bcpkix-fips</artifactId>
				<version>${bcpkix.fips.version}</version>
			</dependency>
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bctls-fips</artifactId>
				<version>${bctls.fips.version}</version>
			</dependency>
			<dependency>
				<groupId>org.bouncycastle</groupId>
				<artifactId>bcutil-fips</artifactId>
				<version>${bcutil.fips.version}</version>
			</dependency>
			<dependency>
				<groupId>io.grpc</groupId>
				<artifactId>grpc-bom</artifactId>
				<version>1.79.0</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
			<!-- Converge annotations-only jar: grpc 1.79 pulls 1.26, google-cloud pulls 1.24 -->
			<dependency>
				<groupId>org.codehaus.mojo</groupId>
				<artifactId>animal-sniffer-annotations</artifactId>
				<version>1.26</version>
			</dependency>
			<dependency>
				<groupId>io.netty</groupId>
				<artifactId>netty-bom</artifactId>
				<version>${netty.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
			<dependency>
				<groupId>tools.jackson.core</groupId>
				<artifactId>jackson-core</artifactId>
				<version>${jackson3.version}</version>
			</dependency>
			<dependency>
				<groupId>tools.jackson.core</groupId>
				<artifactId>jackson-databind</artifactId>
				<version>${jackson3.version}</version>
			</dependency>
			<dependency>
				<groupId>tools.jackson.dataformat</groupId>
				<artifactId>jackson-dataformat-yaml</artifactId>
				<version>${jackson3.version}</version>
			</dependency>
		</dependencies>
	</dependencyManagement>
	<dependencies>
		<dependency>
			<groupId>org.semoss</groupId>
			<artifactId>semoss</artifactId>
			<version>${ci.version}</version>
			<classifier>shaded-dependencies</classifier>
		</dependency>
		<!-- https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-catalina -->
		<!-- this is the primary tomcat specific jar -->
		<dependency>
			<groupId>org.apache.tomcat</groupId>
			<artifactId>tomcat-catalina</artifactId>
			<version>11.0.24</version>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/jakarta.servlet/jakarta.servlet-api -->
		<dependency>
		    <groupId>jakarta.servlet</groupId>
		    <artifactId>jakarta.servlet-api</artifactId>
		    <version>6.1.0</version>
		    <scope>provided</scope>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/org.a2aproject.sdk/a2a-java-sdk-spec -->
		<dependency>
		    <groupId>org.a2aproject.sdk</groupId>
		    <artifactId>a2a-java-sdk-spec</artifactId>
		    <version>1.1.0.Final</version>
		    <exclusions>
		    	<exclusion>
		    		<groupId>org.slf4j</groupId>
		    		<artifactId>*</artifactId>
		    	</exclusion>
		    	<exclusion>
		    		<groupId>com.google.code.gson</groupId>
		    		<artifactId>gson</artifactId>
		    	</exclusion>
		    </exclusions>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/jakarta.websocket/jakarta.websocket-api -->
		<dependency>
		    <groupId>jakarta.websocket</groupId>
		    <artifactId>jakarta.websocket-api</artifactId>
		    <version>${jakarta.websocket.version}</version>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/jakarta.websocket/jakarta.websocket-client-api -->
		<dependency>
		    <groupId>jakarta.websocket</groupId>
		    <artifactId>jakarta.websocket-client-api</artifactId>
		    <version>${jakarta.websocket.version}</version>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/jakarta.activation/jakarta.activation-api -->
		<dependency>
			<groupId>jakarta.activation</groupId>
			<artifactId>jakarta.activation-api</artifactId>
			<version>2.1.4</version>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/org.jboss.resteasy/resteasy-core -->
		<dependency>
			<groupId>org.jboss.resteasy</groupId>
			<artifactId>resteasy-core</artifactId>
			<version>${resteasy.version}</version>
			<exclusions>
				<exclusion>
					<groupId>org.reactivestreams</groupId>
					<artifactId>reactive-streams</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.ow2.asm</groupId>
					<artifactId>asm</artifactId>
				</exclusion>
				<exclusion>
					<groupId>jakarta.activation</groupId>
					<artifactId>jakarta.activation-api</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.jboss.logging</groupId>
					<artifactId>jboss-logging</artifactId>
				</exclusion>
			</exclusions>
		</dependency>
		<!-- Source: https://mvnrepository.com/artifact/org.jboss.resteasy/resteasy-jaxb-provider -->
		<dependency>
			<groupId>org.jboss.resteasy</groupId>
			<artifactId>resteasy-jaxb-provider</artifactId>
			<version>${resteasy.version}</version>
		</dependency>
		<!-- SAML ONE JAR --> 
		<!-- Source: https://mvnrepository.com/artifact/org.openidentityplatform.openam/openam-federation-library -->
		<dependency>
		    <groupId>org.openidentityplatform.openam</groupId>
		    <artifactId>openam-federation-library</artifactId>
		    <version>16.1.2</version>
			<exclusions>
				<exclusion>
					<groupId>com.google.guava</groupId>
					<artifactId>guava</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.json</groupId>
					<artifactId>json</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.owasp.esapi</groupId>
					<artifactId>esapi</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.eclipse.parsson</groupId>
					<artifactId>parsson</artifactId>
				</exclusion>
				<exclusion>
				    <groupId>org.slf4j</groupId>
				    <artifactId>*</artifactId>
				</exclusion>
				<exclusion>
					<groupId>org.openidentityplatform.commons.i18n-framework</groupId>
					<artifactId>slf4j</artifactId>
				</exclusion>
				<!-- this is due to broken openam build - they define this compile dependency that does not exist -->
				<exclusion>
				    <groupId>org.openidentityplatform.openam.jakarta</groupId>
				    <artifactId>jaxrpc-impl</artifactId>
				</exclusion>
			</exclusions>
		</dependency> 
		<!-- https://mvnrepository.com/artifact/com.mikesamuel/json-sanitizer -->
		<dependency>
			<groupId>com.mikesamuel</groupId>
			<artifactId>json-sanitizer</artifactId>
			<version>1.2.3</version>
		</dependency>
        <dependency>
			<groupId>org.eclipse.parsson</groupId>
			<artifactId>parsson</artifactId>
			<version>1.1.8</version>
		</dependency>
    </dependencies>
</project>