[JBoss Seam] - Re: restricting access using pages.xml
by dustismo
Ok, so now I am running on the cvs version, which seems to help (sort of).. Now when I try to access a page in the clients directory it throws an exception
| 19:30:22,185 INFO [Lifecycle] starting up: org.jboss.seam.security.identity
| 19:30:22,193 ERROR [[/Infofilter3-Main]] Session event listener threw exception
| java.lang.NullPointerException
| at org.jboss.seam.core.Selector.getCookieValue(Selector.java:60)
| at org.jboss.seam.security.Identity.initCredentialsFromCookie(Identity.java:84)
| at org.jboss.seam.security.Identity.create(Identity.java:78)
| at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
| at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
| at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
| at java.lang.reflect.Method.invoke(Method.java:585)
| at org.jboss.seam.util.Reflections.invoke(Reflections.java:18)
| at org.jboss.seam.util.Reflections.invokeAndWrap(Reflections.java:102)
| at org.jboss.seam.Component.callComponentMethod(Component.java:1826)
| at org.jboss.seam.Component.callCreateMethod(Component.java:1774)
| at org.jboss.seam.Component.newInstance(Component.java:1763)
| at org.jboss.seam.contexts.Lifecycle.startup(Lifecycle.java:164)
| at org.jboss.seam.contexts.Lifecycle.beginSession(Lifecycle.java:224)
| at org.jboss.seam.servlet.SeamListener.sessionCreated(SeamListener.java:41)
| at org.apache.catalina.session.StandardSession.tellNew(StandardSession.java:384)
| at org.apache.catalina.session.StandardSession.setId(StandardSession.java:356)
| at org.apache.catalina.session.ManagerBase.createSession(ManagerBase.java:824)
| at org.apache.catalina.session.StandardManager.createSession(StandardManager.java:290)
| at org.apache.catalina.connector.Request.doGetSession(Request.java:2223)
| at org.apache.catalina.connector.Request.getSession(Request.java:2024)
| at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:831)
| at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:842)
| at com.icesoft.faces.webapp.xmlhttp.PersistentFacesServlet.service(PersistentFacesServlet.java:220)
| at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.jboss.seam.servlet.SeamExceptionFilter.doFilter(SeamExceptionFilter.java:46)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
| at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
| at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:175)
| at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
| at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
| at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
| at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
| at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
| at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
| at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
| at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
| at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
| at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
| at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
| at java.lang.Thread.run(Thread.java:595)
| 19:30:22,311 INFO [Pages] reading pages.xml
| 19:30:22,548 ERROR [AbstractSeamPhaseListener] Swallowing exception thrown by page action
| org.jboss.seam.security.NotLoggedInException
| at org.jboss.seam.security.Identity.checkRestriction(Identity.java:159)
| at org.jboss.seam.pages.Page.enter(Page.java:186)
| at org.jboss.seam.core.Pages.enterPage(Pages.java:239)
| at org.jboss.seam.jsf.AbstractSeamPhaseListener.enterPage(AbstractSeamPhaseListener.java:241)
| at org.jboss.seam.jsf.AbstractSeamPhaseListener.beforeRender(AbstractSeamPhaseListener.java:192)
| at org.jboss.seam.jsf.SeamPhaseListener.beforePhase(SeamPhaseListener.java:53)
| at org.apache.myfaces.lifecycle.PhaseListenerManager.informPhaseListenersBefore(PhaseListenerManager.java:70)
| at org.apache.myfaces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:373)
| at com.icesoft.faces.webapp.xmlhttp.PersistentFacesServlet.service(PersistentFacesServlet.java:402)
| at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.jboss.seam.servlet.SeamExceptionFilter.doFilter(SeamExceptionFilter.java:46)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
| at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
| at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
| at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
| at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
| at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:175)
| at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
| at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
| at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
| at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
| at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
| at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
| at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
| at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
| at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
| at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
| at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
| at java.lang.Thread.run(Thread.java:595)
|
So I tried to catch the NotLoggedInException in exceptions.xml
| <!DOCTYPE exceptions PUBLIC
| "-//JBoss/Seam Exceptions Configuration DTD 1.1//EN"
| "http://jboss.com/products/seam/exceptions-1.1.dtd">
|
| <exceptions>
| <exception class="org.jboss.seam.security.NotLoggedInException">
| <redirect view-id="../login.xhtml">Please Log In</redirect>
| <end-conversation/>
| </exception>
| </exceptions>
|
Doesn't work.. What am I doing wrong and is this the suggested way to require a login for a directory?
thanks,
Dustin
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4009767#4009767
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4009767
19Â years, 2Â months
[JBoss AOP] - Re: Problem with prepackaged security aspect on a POJO using
by kabir.khanï¼ jboss.com
At a glance this looks correct...
Try checking out jboss from cvs and building that, and then the testsuite. Have a look at aoptest.sar...
Actually revisiting this I see that we do
| <prepare expr="all(org.jboss.test.aop.bean.SecuredPOJO)"/>
|
| <metadata tag="security" class="org.jboss.test.aop.bean.SecuredPOJO">
| ....
|
i.e. we "prepare" AND apply metadata to the class we want to secure. I can't remember off the top of my head if this "prepare" is a requirement or not, but try:
| <?xml version="1.0" encoding="UTF-8"?>
| <!DOCTYPE aop PUBLIC
| "-//JBoss//DTD JBOSS AOP 1.0//EN"
| "http://www.jboss.org/aop/dtd/jboss-aop_1_0.dtd">
|
| <aop>
| <prepare expr="all(security.TransferFunds)"/>
| <metadata tag="security" class="security.TransferFunds">
| <security-domain>java:/jaas/other</security-domain>
| <run-as>admin</run-as>
| <method-permission>
| <role-name>rolB</role-name>
| <method>
| <method-name>withdrawAll</method-name>
| </method>
| </method-permission>
| <method-permission>
| <role-name>rolA</role-name>
| <method>
| <method-name>deposit</method-name>
| </method>
| </method-permission>
| </metadata>
| </aop>
|
HTH
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4009761#4009761
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4009761
19Â years, 2Â months