Tide identity and hasRole() method

[maven dev]

Hello,

I use tide framework and identity component in my Flex app.

I'm logging with an admin role using a glassfish jdbc realm and that's
work because after I can call Java methods with @RolesAllowed("admin")
annotation and before I have security error.

So, once connected with admin role, identity.hasRole("admin")
returns...false ?

try :

[Observer]
public function loginTestButtonEvent(e:LoginTestButtonEvent):void
{
if(identity.loggedIn)
identity.hasRole('admin', checkRoleResult, checkRoleFault);
else
trace("pas logué");
}

private function checkRoleResult(event:TideResultEvent,
role:String):void {
trace("le role (resultEvent) est : " + role);
}

private function checkRoleFault(event:TideFaultEvent,
role:String):void {
trace("le role (faultEvent) est : " + role);
}

fall into checkRoleFault function and my trace is "le role
(faultEvent) est : admin"

So...when I check my role, my role isn't "admin" but my fault function
tells me my role is "admin" ??

Where is the problem please ?



Moreover, when I try to call a securized function whereas I'm not
logged, I have different error messages depending of granite.jar
version.

With 2.2.0 GA : faultCode:Server.Security.AccessDenied
faultString:'null' faultDetail:'null'
With 2.3.1 GA : faultCode:Channel.Call.Failed faultString:'error'
faultDetail:'NetConnection.Call.Failed: HTTP: Status 500'

Is it a regression ? How can we handle reliably AccessDenied
exceptions with 2.3.1 ?

Thank you

[wdrai]

Can you post the fault you get in identity.hasRole() 

"With 2.3.1 GA : faultCode:Channel.Call.Failed faultString:'error' 
faultDetail:'NetConnection.Call.Failed: HTTP: Status 500'  "

looks like a bug. What do you have in your server logs ? 500 seems to indicate a server exception.

[maven dev]

Hi,

my server logs :

[#|2012-05-21T14:37:33.062+0200|WARNING|glassfish3.1.1|
org.granite.tide.TideServiceInvoker|_ThreadID=39;_ThreadName=Thread-2;|
Validator class org.granite.tide.validation.BeanValidation not found:
validation not enabled|#]

[#|2012-05-21T14:37:33.171+0200|INFO|glassfish3.1.1|
javax.enterprise.system.core.security|
_ThreadID=39;_ThreadName=Thread-2;|JACC Policy Provider:Failed
Permission Check: context (" sim_ear/sim_ejb_jar ") , permission
(" ("javax.security.jacc.EJBMethodPermission" "helloWorldBean"
"testOlivier,Local,") ") |#]

[#|2012-05-21T14:37:33.171+0200|WARNING|glassfish3.1.1|
javax.enterprise.system.container.ejb.com.sun.ejb.containers|
_ThreadID=39;_ThreadName=Thread-2;|A system exception occurred during
an invocation on EJB helloWorldBean method public java.lang.String
sim.ejb.HelloWorldBean.testOlivier()
javax.ejb.AccessLocalException: Client not authorized for this
invocation.
at com.sun.ejb.containers.BaseContainer.preInvoke(BaseContainer.java:
1885)
at
com.sun.ejb.containers.EJBLocalObjectInvocationHandler.invoke(EJBLocalObjectInvocationHandler.java:
212)
at
com.sun.ejb.containers.EJBLocalObjectInvocationHandlerDelegate.invoke(EJBLocalObjectInvocationHandlerDelegate.java:
88)
at $Proxy122.testOlivier(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:
57)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:
43)
at java.lang.reflect.Method.invoke(Method.java:601)
at
org.granite.messaging.service.ServiceInvocationContext.invoke(ServiceInvocationContext.java:
71)
at
org.granite.messaging.service.security.AbstractSecurityService.endAuthorization(AbstractSecurityService.java:
67)
at
org.granite.messaging.service.security.GlassFishV3SecurityService.authorize(GlassFishV3SecurityService.java:
202)
at
org.granite.messaging.service.ServiceInvoker.invoke(ServiceInvoker.java:
214)
at
org.granite.messaging.amf.process.AMF3MessageProcessor.processRemotingMessage(AMF3MessageProcessor.java:
136)
at
org.granite.messaging.amf.process.AMF3MessageProcessor.process(AMF3MessageProcessor.java:
59)
at
org.granite.messaging.amf.process.AMF0MessageProcessor.process(AMF0MessageProcessor.java:
78)
at
org.granite.messaging.webapp.AMFMessageServlet.doPost(AMFMessageServlet.java:
59)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at
org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:
1539)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
343)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
217)
at
org.granite.messaging.webapp.AMFMessageFilter.doFilter(AMFMessageFilter.java:
117)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
256)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
217)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:
279)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:
175)
at
org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:
655)
at
org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:
595)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
at
com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:
91)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:
162)
at
org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:
330)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:
231)
at
com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:
174)
at
com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:
828)
at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:
725)
at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:
1019)
at
com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:
225)
at
com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:
137)
at
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:
104)
at
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:
90)
at
com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:
79)
at
com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:
54)
at
com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:
59)
at com.sun.grizzly.ContextTask.run(ContextTask.java:71)
at com.sun.grizzly.util.AbstractThreadPool
$Worker.doWork(AbstractThreadPool.java:532)
at com.sun.grizzly.util.AbstractThreadPool
$Worker.run(AbstractThreadPool.java:513)
at java.lang.Thread.run(Thread.java:722)
|#]

[#|2012-05-21T14:37:33.187+0200|WARNING|glassfish3.1.1|
javax.enterprise.system.container.web.com.sun.enterprise.web|
_ThreadID=39;_ThreadName=Thread-2;|
StandardWrapperValve[AMFMessageServlet]: PWC1406: Servlet.service()
for servlet AMFMessageServlet threw exception
java.lang.NoClassDefFoundError: org/apache/log4j/Logger
at flex.messaging.messages.ErrorMessage.<clinit>(ErrorMessage.java:
39)
at
org.granite.messaging.amf.process.AMF3MessageProcessor.processRemotingMessage(AMF3MessageProcessor.java:
142)
at
org.granite.messaging.amf.process.AMF3MessageProcessor.process(AMF3MessageProcessor.java:
59)
at
org.granite.messaging.amf.process.AMF0MessageProcessor.process(AMF0MessageProcessor.java:
78)
at
org.granite.messaging.webapp.AMFMessageServlet.doPost(AMFMessageServlet.java:
59)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at
org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:
1539)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
343)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
217)
at
org.granite.messaging.webapp.AMFMessageFilter.doFilter(AMFMessageFilter.java:
117)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
256)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
217)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:
279)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:
175)
at
org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:
655)
at
org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:
595)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
at
com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:
91)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:
162)
at
org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:
330)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:
231)
at
com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:
174)
at
com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:
828)
at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:
725)
at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:
1019)
at
com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:
225)
at
com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:
137)
at
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:
104)
at
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:
90)
at
com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:
79)
at
com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:
54)
at
com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:
59)
at com.sun.grizzly.ContextTask.run(ContextTask.java:71)
at com.sun.grizzly.util.AbstractThreadPool
$Worker.doWork(AbstractThreadPool.java:532)
at com.sun.grizzly.util.AbstractThreadPool
$Worker.run(AbstractThreadPool.java:513)
at java.lang.Thread.run(Thread.java:722)
Caused by: java.lang.ClassNotFoundException: org.apache.log4j.Logger
at
com.sun.enterprise.loader.ASURLClassLoader.findClassData(ASURLClassLoader.java:
787)
at
com.sun.enterprise.loader.ASURLClassLoader.findClass(ASURLClassLoader.java:
696)
at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
... 37 more
|#]


Thank you

[maven dev]

and my fault Flex message is here :

http://hpics.li/bf69598

[wdrai]

Unfortunately you have got this error :

java.lang.NoClassDefFoundError: org/apache/log4j/Logger  

This is a bug in 2.3.1 which incorrectly requires log4j on the classpath.

You can use a nightly build until we release 2.3.2 (which should happen very soon).

[maven dev]

Yes yesterday I've added log4j jar library in my project and this
exception disappears.

But client Tide component still have the same behaviour ?

Moreover, I can't register custon ExceptionConverters.... :(


My EJB factory :

<factories>
<factory id="ejbFactory"
class="org.granite.tide.ejb.EjbServiceFactory">
<properties>
<service-exception-
handler>org.granite.messaging.service.ExtendedServiceExceptionHandler</
service-exception-handler>
<lookup>java:global/sim_ear/sim_ejb/{component.name}Bean</lookup>
</properties>
</factory>
</factories>

In granite-config.xml (event if I use scan="true") :

<exception-converters>
<exception-converter
type="exceptionsconverters.PersoExceptionConverter"/>
</exception-converters>

I have a granite-config.properties in META-INF folder of my EJB module
whose contains my PersoExceptionConverter.

I've added a breakpoint on line 75 of
ExtendedServiceExceptionHandler.java and I can catch "classic"
exceptions already registed automaticaly by GDS but not custom...

Ex:

@Override
@RolesAllowed("admin")
public String testOlivier() {

try {
//throw new AccessLocalException();
throw new PersoException();
} catch (PersoException e) {
e.printStackTrace();
}
return "ok";
}

My PersoException isn't converted but with throw new
AccessLocalException() it's converted to Server.Security.AccessDenied.

I spent 3 days on this problem and it's not resolved yet :(

Where should I add breakpoint to see which ExceptionConverters are
registered please ?

Thank you

[wdrai]

You can put a breakpoint in ExtendedServiceExceptionHandler.getServiceException. 

At the end of the method, you will find the code that triggers the exception converters and check if yours has been registered.

[maven dev]

So end of the method is never reached

2 cases :

1) ExtendedServiceExceptionHandler.getServiceException is never call
with my custom Exception that I try to convert
2) with AccesLocalException launched I always fall in condition if (t
instanceof ServiceException) so end of the method isn't reached

I added

List<ExceptionConverter> lec =
GraniteContext.getCurrentInstance().getGraniteConfig().getExceptionConverters();

at top of the method and debug it. I was surprised to see that my
PersoExceptionConverter was correctly registered (nb: in granite-
config.xml with automatic configuration and manual configuration my
converter was registered twice. Maybe you can improve it for next
release to prevent GDS to register same converter twice ? See here
please : http://hpics.li/5a61940).


Here is my Exception that I try to convert :

public class PersoException extends RuntimeException { // tried
extending Exception or AccesLocalException etc..

/**
*
*/
private static final long serialVersionUID = 1L;

}

My PersoExceptionConverter :

public class PersoExceptionConverter implements ExceptionConverter {

public static final String PERSO_EXCEPTION = "Perso.Exception";

@Override
public boolean accepts(Throwable t, Throwable finalException) {
return true; // to accept all
//return t.getClass().equals(PersoException.class);
}

@Override
public ServiceException convert(Throwable t, String detail,
Map<String, Object> extendedData) {

ServiceException se = new ServiceException(PERSO_EXCEPTION,
t.getMessage(), detail, t);

se.getExtendedData().putAll(extendedData);

return se;
}

}

Where my PersoException is launched :

@Override
@RolesAllowed("admin")
public String testOlivier() {

try {

// throw new AccessLocalException();

throw new PersoException();
} catch (PersoException e) {
e.printStackTrace();
}

return "ok";
}

So where can be the problem please ?

I would like to know what is the method that calls
ExtendedServiceExceptionHandler.getServiceException upstream to debug
it please ?

Thank you

[wdrai]

There are two cases : 

The @RolesAllowed triggers an EJBAccessException, it is *always* translated to a Server.Security.AccessDenied fault. 

There is no easy way to override this behaviour other than extending the GlassFishV3SecurityService (and we don't recommend it).

In you latest example :

@Override 
@RolesAllowed("admin") 
public String testOlivier() { 

        try { 

                // throw new AccessLocalException(); 

                throw new PersoException(); 
        } catch (PersoException e) { 
                e.printStackTrace(); 
        } 

        return "ok"; 
} 

there is absolutely no way the PersoException will be thrown outside the method testOlivier, it is caught inside.

[maven dev]

thank you

So is there a way for GDS to catch exception inside a method and
convert it with my ExceptionConverter please ?

[wdrai]

This should do:

public String testOlivier() { 

       if (!ok) {

            log.error("Bla bla");

            throw new PersoException(); 

       }

       return "ok";:

} 

[maven dev]

Thank you very much William.

Since the beginning, my single problem was my try/catch bloc :(

Now it works like a charm :)


Concerning my Tide identity component, why once logged with admin
role, hasRole() method fall in fault callback with
identity.hasRole('admin', checkRoleResult, checkRoleFault) ?

[Observer]
public function loginTestButtonEvent(e:LoginTestButtonEvent):void
{
if(identity.loggedIn)
identity.hasRole('admin', checkRoleResult, checkRoleFault);
else
trace("pas logué");
}

private function checkRoleResult(event:TideResultEvent,
role:String):void {
trace("le role (resultEvent) est : " + role);
}

private function checkRoleFault(event:TideFaultEvent,
role:String):void {
trace("le role (faultEvent) est : " + role);
}

result -> le role (faultEvent) est : admin

Is this logical ?

Thank you

[wdrai]

The role argument in the handlers for hasRole is the exact copy of the role passed to hasRole.

The reason is that if you have many hasRole() requests running at the same time, the only way to know which result correspond to which role is this argument.

The result of the request is the event (result or fault).

[maven dev]

Thanks for this explanation.

Is it possible with identity component to know our role ?

hasRole() test if identity has role X or Y but how to know directly
the role ?

Try to debug identity but did not found anything.

My problem is I'm logged but I don't know the role I'm logging with...

[maven dev]

Sorry...

my error was I didn't add

<tide-components>
<tide-component instance-of="org.granite.tide.ejb.EjbIdentity" />
....
</tide-components>

in granite-config.xml