JAX-RPC: serve the RPC/encoded endpoints without the RI and drop openam-jaxrpc-schema #1200

transform-jakarta/jaxrpc-parent exists because the JAX-RPC RI (com.sun.xml.rpc:jaxrpc-impl/jaxrpc-spi 1.1.3_01) has no Jakarta build: even the latest jaxrpc-impl 1.1.6 on Central still uses javax.servlet, javax.xml.soap and javax.activation. The build rewrites it with the Eclipse Transformer, and the result is excluded from Central publishing (pom.xml:234-244).

Only the server side uses the RI. Every caller — the remote SDK, the client SDK, the federation clients and server-to-server calls inside a site — goes through the hand-written com.sun.identity.shared.jaxrpc.SOAPClient. On the server, com.sun.xml.rpc.server.http.JAXRPCServlet and three subclasses (AssertionManagerServlet, FSAssertionManagerServlet, SecurityTokenManagerServlet) dispatch to Ties that wscompile generates at build time in openam-schema/openam-jaxrpc-schema (about 970 classes).

Seven of the eight endpoints in WEB-INF/jaxrpc-ri-runtime.xml are SOAP 1.1 RPC/encoded:

• /jaxrpc/SMSObjectIF, /jaxrpc/DirectoryManagerIF, /jaxrpc/EntityObjectIF, /jaxrpc/LibertyManagerIF
• /AssertionManagerServlet/AssertionManagerIF, /FSAssertionManagerServlet/FSAssertionManagerIF, /SecurityTokenManagerServlet/SecurityTokenManagerIF

No maintained SOAP stack supports RPC/encoded: Jakarta XML Web Services (Metro), Apache CXF and Apache Axis2 all reject it. A drop-in replacement therefore does not exist, and moving these endpoints to JAX-WS would break every deployed client.

The wire contract is narrow, though. SOAPClient sends only xsd:string, xsd:int, xsd:boolean, ns1:hashSet, ns1:linkedList and ns1:hashMap, and it parses responses by raw prefix (xsi:type="ns1:hashSet"). The proposal is to serve the seven endpoints from a small in-house SOAP-RPC codec, dispatcher and servlet in openam-shared, next to SOAPClient, that write exactly what the RI writes today, and then to delete openam-jaxrpc-schema.

Compatibility is pinned by golden responses recorded from the generated Ties before the RI is taken out of the path. The recordings cover every method and every declared fault of the seven interfaces, plus edge cases: collection runtime classes, null results, omitted arguments, escaping, a thrown subclass of a declared exception, and undeclared exceptions. The new code must reproduce them byte for byte, so the remote SDK, existing agents and mixed-version sites during a rolling upgrade keep working.

Intentional differences from the RI, none of them visible to SOAPClient:

• An undeclared exception no longer puts its class and message into faultstring (JAXRPC.TIE.04: Internal Server Error (... java.lang.IllegalStateException: ...)). It answers Internal Server Error; the client maps both to Exception("unknown-exception").
• ?WSDL on the encoded endpoints answers 404; no client reads those WSDLs. A plain GET still answers 200.
• A request the server cannot decode answers 500 with an env:Client fault instead of the RI's 400.

Out of scope: /identityservices/IdentityServices is document/literal and stays on the RI for now, so transform-jakarta/jaxrpc-parent remains in openam-core after this change. Moving it to Jakarta XML Web Services, or removing it, is a follow-up.

Acceptance criteria:

• The seven endpoints are served without JAXRPCServlet; the golden replays pass in openam-core and openam-federation-library.
• openam-schema/openam-jaxrpc-schema is deleted, and no pom, assembly descriptor or WAR references it or IdentityManagementServices.wsdl.
• On a running server, checkForLocal on /jaxrpc/SMSObjectIF returns the recorded response byte for byte, AssertionManagerServlet still rejects untrusted callers before dispatch, and IdentityServices still answers.