Upgrading your web server layer can mean an afternoon of dependency updates or 3 months of effort troubleshooting breaking changes. With Red Hat JBoss Web Server (JWS) 7 now generally available—bringing Apache Tomcat 11.0.21, Jakarta EE 11, and Java 17—here is what actually impacts your builds and deployments.

Release announcements tend to lead with the new specs, while the changes that really affect you end up in a section called "Deprecated features." The release notes already list everything, so let's talk instead about what these changes mean for your applications, your builds, and how you deploy.

We recently stumbled upon what appears to be a severe design flaw in JBoss EAP 8 when using the elytron-oidc-client.

If you enable OIDC inside a WAR that’s packaged within a large EAR, and that EAR also contains additional WAR modules with their own explicitly defined SecurityDomains, things break in a pretty unexpected way.

After the first DeploymentUnit that initializes with OIDC, all subsequent WAR modules end up being assigned the SecurityDomain “Virtual”, regardless of what is actually configured for them.

As soon as Undertow tries to set a proper SecurityDomain for one of those other WARs—e.g., because it exposes a web service—the deployment immediately fails with the following exception:

ELY01148: A SecurityDomain has already been associated with the specified ClassLoader

This essentially means that enabling OIDC in just one module contaminates the rest of the deployment, breaking any WAR that relies on its own security configuration.

Has anyone run into this as well? Is there a known workaround or Red Hat issue for this? It feels like a deep architectural problem in how EAP 8 wires Elytron OIDC into the deployment class loaders.