I found the problem:  I also had the uber-jar in the bundle containing an older oak-auth.  After removing that the dependency is resolved.

I have the exact same problem after the 1.2.16 hotfix.  The imported packages for my bundle shows:org.apache.jackrabbit.oak.spi.security.authentication.external,version=[1.0,2) -- Cannot be resolvedIn the depfinder the following is found:         org.apache.jackrabbit.oak.spi.security.authentication...