NPE in ExtendedFormAuthenticator

[leegreiner]

I belive I have come across an issue when using the ExtendedFormAuthenticator in 4.0.5.GA. When a user sits on the login page for too long and their session expires the following NullPointerException is thrown in ExtendedFormAuthenticator.authenticate():

13:44:15,765 ERROR [CoyoteAdapter] An exception or error occurred in the container during the request processing
java.lang.NullPointerException
at org.jboss.web.tomcat.security.ExtendedFormAuthenticator.authenticate(ExtendedFormAuthenticator.java:104)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:416)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:595)

The session appears to be null and an attempt is made to remove a note from the session thereby causing the NPE. Earlier references to the session are enclosed by if(session != null). The one attempting to remove the note is not.

Any comments?

[gdemir]

Hi,

The same thing just happened to me as well. I think the code is buggy. Since the earlier reference had checked session to be not null, I believe at line 104, the same check should be applied too.

I will add the check to the code, and jar uf it.

Gokhan.

[anthonyestelita]

Has there been any plans for this to be fixed? We too are experiencing the same exact issue (if a user sits at the login page for a period of time the NPE exception is thrown by the ExtendedFormAuthenticator). I searched the jboss bugs for this issue and I don't see a closed nor open bug for it. :-( Is there a workaround? Right now the user is forced to basically log-in twice (first time throws the NPE and the second time it works).

[leegreiner]

I ended up writing my own authenticator, one that guarded against the NPE.

[anil.saldhana]

http://jira.jboss.com/jira/browse/JBAS-4592

[rmartony]

"leegreiner" wrote:
I ended up writing my own authenticator, one that guarded against the NPE.

Could you share your version of the ExtendedFormAuthenticator?

Thanks,
Rafael

[leegreiner]

This was our solution:

package edu.duke.dcri.web.tomcat.security;

import java.io.IOException;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.deploy.LoginConfig;

public class ExtendedFormAuthenticator extends org.jboss.web.tomcat.security.ExtendedFormAuthenticator
{

 public ExtendedFormAuthenticator()
 {
 }

 public boolean authenticate(Request request, Response response, LoginConfig config)
 throws IOException
 {
 boolean alreadyAuthenticated = false;
 try
 {
 alreadyAuthenticated = super.authenticate(request, response, config);
 }
 catch(NullPointerException npe) { }
 return alreadyAuthenticated;
 }
}

When the NullPointerException is raised there is no session and the authenticator returns false, the desired effect.

[rmartony]

That's great leegreiner, thanks.

Another question, how do I install the new authenticator?
Do I have to follow these (http://wiki.jboss.org/wiki/ExternalizeTomcatAuthenticators) instructions?

Currently I'm using the JBoss ExtendedFormAuthenticator via WEB-INF/context.xml descriptor with a Valve element. (http://wiki.jboss.org/wiki/ExtendedFormAuthenticator)

Regards,
Rafael.

[leegreiner]

We typically drop a jar containing the authenticator in the default/lib directory so that all application deployed on the server have access to it but are not forced to use it by default.

Each application that wants to use the authenticator will include it as defined in the "Configuring the ExtendedFormAuthenticator for an Application" section of http://wiki.jboss.org/wiki/ExtendedFormAuthenticator.