Bug Report: ecosystem-security-connectors should explicitly close its JAX-RS Clients / FISH-7621

[kalgon]

Brief Summary

OAuth2AuthenticationMechanism opens a javax.ws.rs.client.Client but never closes it afterwards.

The javadoc of Client states:

Clients are heavy-weight objects that manage the client-side communication infrastructure. Initialization as well as disposal of a Client instance may be a rather expensive operation. It is therefore advised to construct only a small number of Client instances in the application. Client instances must be [properly closed] before being disposed to avoid leaking resources.

Using the standalone implementation of OIDC connector on JBoss/Wildfly gives the following warning:

[org.jboss.resteasy.client.jaxrs.i18n] (Finalizer) RESTEASY004687: Closing a class org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine instance for you. Please close clients yourself.

Expected Outcome

OAuth2AuthenticationMechanism should close Clients.

Current Outcome

OAuth2AuthenticationMechanism does not close Clients.

Reproducer

TBD

Operating System

Windows 10

JDK Version

Temurin 11.0.19.7

Ecosystem Tool

Security Connectors

[kalinchan]

Hi @kalgon,

I will raise this issue to engineering under FISH-7621.