Description

As of Jenkins 2.579, Apache Commons Lang 2 (commons-lang:commons-lang:2.6) was removed from the Jenkins core classpath.

Because miniorange-saml-sp relies on org.apache.commons.lang.StringUtils inside MoSAMLAddIdp.java without bundling commons-lang-2.6.jar or declaring a plugin dependency on commons-lang-api / commons-lang3-api, class instantiation of MoSAMLAddIdp fails with ClassNotFoundException. This breaks both Jenkins Configuration as Code (JCasC) initialization and manual configuration saving via the web UI.

Steps to Reproduce

1. Upgrade Jenkins core to version 2.579 or newer.

1. Install the miniorange-saml-sp plugin.

1. Apply a JCasC manifest defining securityRealm: moSAMLAddIdp or attempt to save SAML settings under Manage Jenkins > Security.

1. Observe the initialization failure on server startup or UI submission.

Stack Trace
java.lang.ClassNotFoundException: org.apache.commons.lang.StringUtils
Caused: java.lang.NoClassDefFoundError: org/apache/commons/lang/StringUtils
at PluginClassLoader for miniorange-saml-sp//org.miniorange.saml.MoSAMLAddIdp.<init>(MoSAMLAddIdp.java:149)
at PluginClassLoader for miniorange-saml-sp//org.miniorange.saml.MoSAMLAddIdp$DescriptorImpl.newInstance(MoSAMLAddIdp.java:1261)
at hudson.model.Descriptor.newInstance(Descriptor.java:592)
at PluginClassLoader for configuration-as-code//io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:463)
Caused: io.jenkins.plugins.casc.ConfiguratorException: securityRealm: Failed to configure 'securityRealm': Failed to construct instance of class org.miniorange.saml.MoSAMLAddIdp.