Fix tests after Apache HttpClient5 / HttpCore5 update since those use deprecated APIs

[reta]

Description

See please opensearch-project/OpenSearch#16757

Issues Resolved

See please https://github.com/opensearch-project/security/actions/runs/12813953884/job/35729309491?pr=5034

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

N/A

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwperks]

Not sure if backport is necessary on this if its specific to apache httpcore5/httpclient5

[reta]

Not sure if backport is necessary on this if its specific to apache httpcore5/httpclient5

No, it is only 3.x line

[cwperks]

Unfortunately there are still failing tests in citest: https://github.com/opensearch-project/security/actions/runs/12816725705/job/35739621739?pr=5035

[reta]

Unfortunately there are still failing tests in citest: https://github.com/opensearch-project/security/actions/runs/12816725705/job/35739621739?pr=5035

Sadly may need more work, too many clients in too many places :(

[cwperks]

Unfortunately there are still failing tests in citest: https://github.com/opensearch-project/security/actions/runs/12816725705/job/35739621739?pr=5035

Sadly may need more work, too many clients in too many places :(

I would offer to help, but I'm not exactly sure what needs to change.

I'm currently looking at the failing tests in WebhookAuditLogTest and I'm not sure if the issue is in setting up the server, or if its the client configuration in WebhookSink.

I've got some homework to do to read up more on the Apache HttpCore/HttpClient5 docs. The deprecation messages in that library don't indicate what the replacements are.

[reta]

I would offer to help, but I'm not exactly sure what needs to change.

Thanks a lot @cwperks , for these failures I actually don't know the cause yet, I would need to do a debug session sadly ...

[reta]

I would offer to help, but I'm not exactly sure what needs to change.

Ah, @cwperks we do have to accommodate ServerBootstrap changes - we don't use that in core, hence I've not seen such failures, working on that.

[cwperks]

The SAMLHTTPMetadataResolver is still using httpcomponents v4 (via OpenSAML 4.3.2). Would this be a blocker from fully upgrading to Apache httpcomponents v5? #2932

[reta]

The SAMLHTTPMetadataResolver is still using httpcomponents v4 (via OpenSAML 4.3.2). Would this be a blocker from fully upgrading to Apache httpcomponents v5? #2932

No, v4 and v5 are independent and could be used at the same time.

[willyborankin]

The SAMLHTTPMetadataResolver is still using httpcomponents v4 (via OpenSAML 4.3.2). Would this be a blocker from fully upgrading to Apache httpcomponents v5? #2932

No, v4 and v5 are independent and could be used at the same time.

@reta OpenSAML upgrade #5038

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 71.36%. Comparing base (1924e41) to head (fa2b456).
Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5035      +/-   ##
==========================================
- Coverage   71.50%   71.36%   -0.15%     
==========================================
  Files         336      336              
  Lines       22625    22617       -8     
  Branches     3598     3599       +1     
==========================================
- Hits        16178    16140      -38     
- Misses       4648     4685      +37     
+ Partials     1799     1792       -7     

Files with missing lines	Coverage Δ
.../dlic/auth/http/jwt/keybyoidc/KeySetRetriever.java	79.04% <100.00%> (ø)
...opensearch/security/auditlog/sink/WebhookSink.java	76.30% <100.00%> (-0.28%)	⬇️
...org/opensearch/security/httpclient/HttpClient.java	84.04% <100.00%> (-1.11%)	⬇️

... and 18 files with indirect coverage changes

[reta]

@cwperks @willyborankin @DarshitChanpura we should be set for now, I will continue to chase #5035 (comment) to understand why it is needed, thanks folks!