pulls in renamed com.springsource.* jars which cause conflicts with the original jars

The spring-security-openid gets dependencies from the ebr() repository, which pulls in renamed copies of commons-httpclient, commons-codec and a few more. This is disastrous when an app depends on newer versions of those, with the original names. Both the original and the renamed jars will be included in the war file, causing disasters at runtime with war deployment when the older versions happen to get in the way.

I got around it by replacing the transitive dependencies of the plugin with the following:

runtime(group: 'org.springframework.security', name: 'org.springframework.security.openid', version: '3.0.3.RELEASE') {
    transitive = false
}
runtime(group: 'org.openid4java', name: 'openid4java-consumer', version: '0.9.5') {
    excludes 'xercesImpl'
}