Error creating bean with name 'xsuaaTokenFlows'

[priyasampath2020]

Ask the Question

Hello Team,

We are facing the below error while we upgrade the version of sdk-bom from v5.27.0 to v5.30.0.

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'xsuaaTokenFlows' defined in class path resource [com/sap/cloud/security/xsuaa/autoconfiguration/XsuaaTokenFlowAutoConfiguration.class]: Failed to instantiate [com.sap.cloud.security.xsuaa.tokenflows.XsuaaTokenFlows]: Factory method 'xsuaaTokenFlows' threw exception with message: com/sap/cloud/security/xsuaa/client/XsuaaOAuth2TokenService.

This is because the version of spring-xsuaa getting upgraded by the sdk-bom

Also, attached the complete dependency tree when using sdk-bom v5.27.0 and the upgraded v5.30.0 for reference. pom.xml

old_v5.27.0.txt

new_v5.30.0.txt

We came across this link which talks about the migration. But since we are using spring version 3.x and not migrating now to Spring 4.x. We have included a dependency of token-client-spring-3 library based on link. Is this the right way to resolve the error. Please confirm.

[Jonas-Isr]

Hi @priyasampath2020,

thanks for reaching out. This is an issue regarding migrating the security library. We are not the maintainers of that library. I would thus ask you to get support from the security library colleagues.

Best,
Jonas

[priyasampath2020]

Hi @Jonas-Isr ,

We have analyzed this issue further and see that security library colleagues cannot help here. Here are our findings:

Firstly, we need to upgrade sdk-bom to fix the below OSC issue
com.sap.irp@2608.0.0:pkg:maven/com.sap/irp@2608.0.0?type=jar > com.sap.irp@2608.0.0:pkg:maven/com.sap.cloud.sdk.datamodel/openapi-core@5.27.0?type=jar > com.sap.irp@2608.0.0:pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.6?type=jar

1. When tried to upgrade the sdk-bom with versions 5.30.0 and 5.29.0 and we saw that the bom is making use for security library java-bom of version 4.0.x. Since we are using Spring 3.x, our current handlings are breaking.

sdk-bom-5.30.0 uses the below version of java-bom

sdk-bom-5.29.0 uses the below version of java-bom

2. Similarly, we also tried sdk-bom 5.28.0. But we see that the java-bom version used is incompatible with the security-patched-spring-boot-dependencies 3.5.14-sap-01

_> sdk-bom-5.28.0 uses the below version of java-bom

security-patched-spring-boot-dependencies 3.5.14-sap-01 uses the below version of java-bom
_

So, inorder to avoid these conflicts can you please release a compatible version of sdk-bom on top of v5.27.0 which uses java-bom@3.6.10 and httpclient5@5.6.1(to fix the OSC issue). Kindly release a patch version as we are closer to breach the SLA.

Thanks,
Priyadarshini Sampath

[newtork]

Since we are using Spring 3.x, our current handlings are breaking.

Have you considered upgrading from this outdated library? It's end-of-life in 6 weeks.
Therefore we will not offer additional legacy compatibility.

Of course, you're free to use regular maven dependency management to override dependency versions. That may still be your workaround.

[newtork]

We're closing this issue due to inactivity.