[jboss-user] [Security & JAAS/JBoss] - ExtendedFormAuthenticator causes IllegalStateException in Se

[cardoso]

Hello,

I am using the ExtendedFormAuthenticator which works fine if both username and password are correct.

But after entering an invalid password and submitting the form, the following IllegalStateException is thrown, and therefore the error-page is not shown.

2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.JBossWebRealm] User: testuser is NOT authenticated
2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.JBossWebRealm] End authenticate, principal=null
2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.ExtendedFormAuthenticator] forwardToErrorPage
2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.ExtendedFormAuthenticator] SessionID: 125F46B5D04395A49BFF11FD83BAF
2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.ExtendedFormAuthenticator] Setting j_username = testuser
2008-04-19 14:23:07,780 TRACE [org.jboss.web.tomcat.security.ExtendedFormAuthenticator] Setting j_password = --hidden--
2008-04-19 14:23:07,780 TRACE [org.jboss.security.SecurityRolesAssociation] Setting threadlocal:null
2008-04-19 14:23:07,780 TRACE [org.jboss.security.SecurityRolesAssociation] Setting threadlocal:null
2008-04-19 14:23:07,781 ERROR [org.apache.catalina.connector.CoyoteAdapter] An exception or error occurred in the container during the requ
est processing
java.lang.IllegalStateException: Security Context is null
        at org.jboss.web.tomcat.security.SecurityAssociationActions$GetAuthExceptionAction.run(SecurityAssociationActions.java:168)
        at java.security.AccessController.doPrivileged(Native Method)
        at org.jboss.web.tomcat.security.SecurityAssociationActions.getAuthException(SecurityAssociationActions.java:290)
        at org.jboss.web.tomcat.security.ExtendedFormAuthenticator.populateSession(ExtendedFormAuthenticator.java:180)
        at org.jboss.web.tomcat.security.ExtendedFormAuthenticator.forwardToErrorPage(ExtendedFormAuthenticator.java:123)
        at org.apache.catalina.authenticator.FormAuthenticator.authenticate(FormAuthenticator.java:260)
        at org.jboss.web.tomcat.security.ExtendedFormAuthenticator.authenticate(ExtendedFormAuthenticator.java:86)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:417)
        at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:90)
        at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:96)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:309)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:601)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
        at java.lang.Thread.run(Thread.java:595)

Before this happens the javax.security.auth.login.FailedLoginException was thrown by the LoginModule, 

Does anyone have an idea what is going wrong?

Thomas


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4145312#4145312

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4145312