Merge pull request #1096 from nakomis/bump-cxf-version

Bumps cxf versions
diff --git a/karaf/features/src/main/feature/feature.xml b/karaf/features/src/main/feature/feature.xml
index 6c1b088..eafcfa9 100644
--- a/karaf/features/src/main/feature/feature.xml
+++ b/karaf/features/src/main/feature/feature.xml
@@ -202,7 +202,7 @@
         <feature>brooklyn-camp-brooklyn</feature>
         <feature>brooklyn-camp-base</feature>
 
-        <feature>cxf-jaxrs</feature>
+        <feature>cxf-jaxrs-with-optional-dependencies</feature>
         <bundle dependency="true">mvn:org.apache.cxf/cxf-rt-rs-security-cors/${cxf.version}</bundle>
         <bundle dependency="true">mvn:org.apache.cxf/cxf-rt-frontend-jaxrs/${cxf.version}</bundle>
         <bundle dependency="true">mvn:org.apache.cxf.karaf/cxf-karaf-commands/${cxf.version}</bundle>
@@ -218,6 +218,14 @@
         </config>
     </feature>
 
+    <feature name="cxf-jaxrs-with-optional-dependencies" version="${project.version}" description="cxf-jaxrs with optional dependencies">
+        <feature>cxf-jaxrs</feature>
+        
+        <!-- otherwise causes jackson-jaxrs-json-provider to be rewired when this optional dep is installed -->
+        <bundle dependency="true" start-level="35">mvn:com.fasterxml.jackson.module/jackson-module-jaxb-annotations/${fasterxml.jackson.version}</bundle>
+    </feature>
+
+
     <feature name="brooklyn-rest-resources" version="${project.version}" description="Brooklyn REST Resources">
         <feature>brooklyn-rest-resources-prereqs</feature>
         <bundle>mvn:org.apache.brooklyn/brooklyn-rest-resources/${project.version}</bundle>
diff --git a/pom.xml b/pom.xml
index 4acfc42..761a032 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
     under the License.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
     <modelVersion>4.0.0</modelVersion>
     <parent>
@@ -73,13 +73,13 @@
     </mailingLists>
 
     <repositories>
-      <repository>
-          <id>jclouds-snapshots</id>
-        <url>https://repository.apache.org/content/repositories/snapshots</url>
-        <snapshots>
-            <enabled>true</enabled>
-        </snapshots>
-      </repository>
+        <repository>
+            <id>jclouds-snapshots</id>
+            <url>https://repository.apache.org/content/repositories/snapshots</url>
+            <snapshots>
+                <enabled>true</enabled>
+            </snapshots>
+        </repository>
     </repositories>
 
     <properties>
@@ -122,16 +122,16 @@
         <xpp3.servicemix.version>1.1.4c_7</xpp3.servicemix.version>
         <kxml2.servicemix.version>2.3.0_3</kxml2.servicemix.version>
         <!-- double-check downstream projects before changing jackson version -->
-        <fasterxml.jackson.version>2.10.1</fasterxml.jackson.version> <!-- 2.9.9 matches cxf-jackson (from cxf-jaxrs), but 2.10 has better yaml support -->
-        <cxf.version>3.3.2</cxf.version>
-        <httpcomponents.httpclient.version>4.5.8</httpcomponents.httpclient.version> <!-- To match cxf-http-async -->
-        <httpcomponents.httpcore.version>4.4.11</httpcomponents.httpcore.version> <!-- To match cxf-http-async -->
+        <fasterxml.jackson.version>2.10.1</fasterxml.jackson.version>
+        <cxf.version>3.3.5</cxf.version>
+        <httpcomponents.httpclient.version>4.5.10</httpcomponents.httpclient.version> <!-- To match cxf-http-async -->
+        <httpcomponents.httpcore.version>4.4.12</httpcomponents.httpcore.version> <!-- To match cxf-http-async -->
         <!-- @deprecated since 0.11 -->
-        <httpclient.version>4.5.8</httpclient.version> <!-- kept for compatibility in 0.11.0-SNAPSHOT, remove after -->
+        <httpclient.version>4.5.10</httpclient.version> <!-- kept for compatibility in 0.11.0-SNAPSHOT, remove after -->
         <commons-lang3.version>3.3.2</commons-lang3.version>
         <groovy.version>2.4.15</groovy.version> <!-- Version 2.4.7 supported by https://github.com/groovy/groovy-eclipse/wiki/Groovy-Eclipse-2.9.1-Release-Notes; not sure what more recent will be -->
         <jsr305.version>2.0.1</jsr305.version>
-        <snakeyaml.version>1.25</snakeyaml.version> <!-- 1.24 matches cxf-jackson 3.3.2, but 1.25 has better yaml support -->
+        <snakeyaml.version>1.25</snakeyaml.version> <!-- 1.25 matches cxf-jackson 3.3.2 -->
         <!-- Next version of swagger requires changes to how path mapping and scanner injection are done. -->
         <swagger.version>1.5.6</swagger.version>
         <gson.version>2.5</gson.version>
@@ -161,20 +161,21 @@
         <aopalliance.version>1.0</aopalliance.version>
         <commons-configuration.version>1.7</commons-configuration.version>
         <commons-lang.version>2.4</commons-lang.version>
-        <jax-rs-api.version>2.1.1</jax-rs-api.version>
+        <jax-rs-api.version>2.1.1</jax-rs-api.version> <!-- differs from jclouds 2.1.2, which depends on v2.0.1 -->
         <maxmind.version>2.8.0-rc1</maxmind.version>
         <maxmind-db.version>1.2.1</maxmind-db.version>
-        <winrm4j.version>0.8.0</winrm4j.version>
+        <winrm4j.version>0.9.0</winrm4j.version> <!--  FIXME NO CHECK IN -->
         <felix-osgi-compendium.version>1.4.0</felix-osgi-compendium.version>
         <kubernetes-client.version>4.9.0</kubernetes-client.version>
 
         <!-- Dependencies shipped with vanilla karaf; update these when we update the karaf version -->
-        <karaf.version>4.2.7</karaf.version>
+        <karaf.version>4.2.8</karaf.version>
         <karaf.plugin.version>${karaf.version}</karaf.plugin.version>
-        <jetty.version>9.4.20.v20190813</jetty.version>
+        <jetty.version>9.4.22.v20191022</jetty.version>
         <commons-collections.version>3.2.2</commons-collections.version>
-        <pax-web.version>7.2.11</pax-web.version>
+        <pax-web.version>7.2.14</pax-web.version>
         <jaxb-api.version>2.3.2</jaxb-api.version>
+        <spifly.version>1.2.3</spifly.version> <!-- v1.2.3 from jetty feature; v1.2 from pax-jetty -->
 
         <!-- Transitive dependencies, declared explicitly to avoid version mismatch -->
         <jna.version>4.1.0</jna.version>
@@ -186,11 +187,10 @@
         <commons-logging.version>1.2</commons-logging.version>
         <jsonSmart.version>2.3</jsonSmart.version>
         <minidev.accessors-smart.version>1.2</minidev.accessors-smart.version>
-        <ow2.asm.version>5.2</ow2.asm.version> <!-- minidev.accessors-smart requires 5.x; aries-proxy:4.2.7 brings in 7.1 -->
+        <ow2.asm.version>5.2</ow2.asm.version> <!-- require 5.x from json-path -> json-smart -> accessors-smart; pax-web-core brings in 7.x -->
         <commons-beanutils.version>1.9.4</commons-beanutils.version>
         <javax.mail.version>1.4.7</javax.mail.version> <!-- version should align with 'jetty' feature -->
-        <cxf.javax.annotation-api.version>1.3.1</cxf.javax.annotation-api.version> <!-- cxf-specs feature v3.3.2 declares v1.3.1; jetty 9.4.20.v20190813 declares v1.3 -->
-        <spifly.version>1.2.2</spifly.version> <!-- v1.2.2 from jetty feature; v1.2 from pax-jetty -->
+        <cxf.javax.annotation-api.version>1.3.2</cxf.javax.annotation-api.version> <!-- cxf-specs feature v3.3.5 declares v1.3.2; jetty 9.4.22 declares v1.3 -->
 
         <!-- Test dependencies -->
         <testng.version>6.10</testng.version>
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
index 3be897c..8fc8a32 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
@@ -30,7 +30,9 @@
 import org.eclipse.jetty.http.HttpHeader;
 import org.eclipse.jetty.server.Handler;
 import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.SessionIdManager;
 import org.eclipse.jetty.server.handler.ContextHandler;
+import org.eclipse.jetty.server.session.DefaultSessionIdManager;
 import org.eclipse.jetty.server.session.Session;
 import org.eclipse.jetty.server.session.SessionHandler;
 import org.osgi.framework.BundleContext;
@@ -217,7 +219,17 @@
         private HttpSession findValidPreferredSession(HttpSession localSession, HttpServletRequest optionalRequest) {
             if (localSession instanceof Session) {
                 SessionHandler preferredHandler = getPreferredJettyHandler((Session)localSession, true, true);
-                HttpSession preferredSession = preferredHandler==null ? null : preferredHandler.getHttpSession(localSession.getId());
+
+                HttpSession preferredSession = null;
+                if (preferredHandler != null) {
+                    String extendedId= localSession.getId();
+                    SessionIdManager idManager = preferredHandler.getSessionIdManager();
+                    String id = idManager.getId(extendedId);
+                    preferredSession = preferredHandler.getSession(id);
+                    if (preferredSession != null && !((Session)preferredSession).getExtendedId().equals(extendedId))
+                        ((Session)preferredSession).setIdChanged(true);
+                }
+
                 if (log.isTraceEnabled()) {
                     log.trace("Preferred session for "+info(optionalRequest, localSession)+": "+
                         (preferredSession!=null ? info(preferredSession) : "none, willl make new session in "+info(preferredHandler)));