Exousia 3 on Tomcat 11

[pizzi80]

Hi

I'm upgrading from Tomcat 10.1 to Tomcat 11 but o got an NPE during startup:

Caused by: java.lang.NullPointerException: Cannot invoke "jakarta.security.auth.message.config.AuthConfigFactory.registerServerAuthModule(jakarta.security.auth.message.module.ServerAuthModule, Object)" because the return value of "jakarta.security.auth.message.config.AuthConfigFactory.getFactory()" is null
		at org.glassfish.soteria.servlet.SamRegistrationInstaller.onStartup(SamRegistrationInstaller.java:100)

I've found that I have to add the following conf to catalina opts, is it correct?

-Djakarta.security.jacc.PolicyConfigurationFactory.provider=org.glassfish.exousia.modules.def.DefaultPolicyConfigurationFactory -Djakarta.security.jacc.policy.provider=org.glassfish.exousia.modules.def.DefaultPolicy

this is the relevant part of my pom.xml:

<!-- Java Security API -->
<dependency>
    <groupId>jakarta.security.enterprise</groupId>
    <artifactId>jakarta.security.enterprise-api</artifactId>
    <version>4.0.0</version>
</dependency>

<!-- Soteria | Official release -->
<dependency>
    <groupId>jakarta.authorization</groupId>
    <artifactId>jakarta.authorization-api</artifactId>
    <version>3.0.0</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>org.glassfish.soteria</groupId>
    <artifactId>soteria</artifactId>
    <version>4.0.2</version>
</dependency>
<dependency>
    <groupId>com.nimbusds</groupId>
    <artifactId>nimbus-jose-jwt</artifactId>
    <version>10.4.2</version>
</dependency>

<!-- Jakarta Authentication API -->
<dependency>
    <groupId>jakarta.authentication</groupId>
    <artifactId>jakarta.authentication-api</artifactId>
    <version>3.1.0</version>
    <scope>provided</scope>
</dependency>

<!-- Exousia Official release -->
<dependency>
    <groupId>org.glassfish.exousia</groupId>
    <artifactId>exousia</artifactId>
    <version>3.0.1</version>
</dependency>
<dependency>
    <groupId>org.glassfish.exousia</groupId>
    <artifactId>exousia.spi.tomcat</artifactId>
    <version>3.0.1</version>
</dependency>

I've downloaded and placed the following API jars inside tomcat/lib:

• jakarta.authorization-api
• jakarta.authentication-api

as a side note:
the Soteria project definition is missing the nimbus-jose-jwt dependecy...
I had to understand which was and include it in my pom
It is an expected behaviour or it's better to open an issure to Soteria?

thanks!!