Seam 1.2.1, AS 4.2.1, @Restricted method gives NoClassDef

[smokingapipe]

I have a factory method that is restricted, like this:

@Out(required=false) List<User> userList;

 @Factory("userList")
 @Restrict("#{s:hasRole('admin')}")
 public void listUsers() {

This is the first time I have tried using @Restricted, so it's not like other @Restricted clauses are working. No, the first one isn't working.

When I try to access the userList, I get a big nasty exception:

Caused by: java.lang.NoClassDefFoundError: com/sun/el/ExpressionFactoryImpl
 at org.jboss.seam.util.UnifiedELValueBinding.<init>(UnifiedELValueBinding.java:18)
 at org.jboss.seam.security.Identity.evaluateExpression(Identity.java:506)
 at org.jboss.seam.security.Identity.checkRestriction(Identity.java:149)
 at org.jboss.seam.interceptors.SecurityInterceptor.aroundInvoke(SecurityInterceptor.java:35

It must be something simple: a jar in the wrong place, something like that.

Any ideas?

Thanks

[smokingapipe]

I looked some more and the missing class is defined in el-ri.jar . But I thought that that jar should no longer be used in JBoss 4.2.1. This means that some Seam class is compiled to look for the com.sun.el.ExpressionFactoryImpl class. Is there a work-around for this?

Everything else is working. On my UI elements, I can put security restrictions on them. It's only throwing this when I invoke a method which is @Restricted.

Thanks

[smokingapipe]

And it looks like the problem is in org.jboss.seam.util.EL:

import com.sun.el.ExpressionFactoryImpl;
import com.sun.el.lang.VariableMapperImpl;

which means that Seam is still dependent on the Sun EL RI, while JBoss AS has switched, and packaging the Sun RI in the EAR causes problems apparently.

Any ideas would be welcome.

[smokingapipe]

Further checking, the Sun RI is used in only two files in Seam:

./main/org/jboss/seam/util/EL.java:import com.sun.el.ExpressionFactoryImpl;
./main/org/jboss/seam/util/EL.java:import com.sun.el.lang.VariableMapperImpl;
./main/org/jboss/seam/jsf/SeamELFunctionMapper.java:import com.sun.el.lang.FunctionMapperImpl;

I think I'm at an impasse here, and will simply remove the @Restricted declarations at this point, and rely on the UI elements to prevent unauthorized use until this can be fixed. This is for an internal use thing with a very small user group at this point, for testing, not real deployment, so that's a reasonable decision for Right Now.

[norman.richards]

I think you may need to have that JAR around.

FWIW, this all works fine in the upcoming Seam 1.3.

[smokingapipe]

I think you may need to have that JAR around.

It seems like that jar would mess up other things. Reading Michael Yuan's blog:

http://www.michaelyuan.com/blog/2007/05/29/seam-book-examples-updated-to-jboss-as-420-ga/

There is now a JIRA open on it:

http://jira.jboss.org/jira/browse/JBSEAM-1740

FWIW, this all works fine in the upcoming Seam 1.3.

Wait, isn't Seam 1.3 gone, replaced by Seam 2.0? I'm sort of tempted to switch to 2.0 right now but this is for something that needs to be in production use fairly soon and I'm not thrilled to deploy on beta software versions.

[norman.richards]

Yes - Seam 2.0. I got confused. :)

[smokingapipe]

By the way this shows why classes which are not public should not be labeled public. My guess is that com.sun.el.*Impl should have default permissions so external projects couldn't specify them directly.

[michael.yuan]

It seems like that jar would mess up other things. Reading Michael Yuan's blog:

Let me clarify: the el-*.jar entires in application.xml mess up things. It does not hurt to leave the JARs in the EAR/WAR classpath -- at least this is what I think ...

cheers
Michael

[smokingapipe]

When I put the jars in the war/WEB-INF/lib, I get:

SEVERE: Error Rendering View[/index.xhtml]
com.sun.facelets.FaceletException: Could not instantiate feature[compiler.ExpressionFactory]: org.jboss.seam.ui.facelet.SeamExpressionFactory
 at com.sun.facelets.compiler.Compiler.featureInstance(Compiler.java:154)
 at com.sun.facelets.compiler.Compiler.createExpressionFactory(Compiler.java:128)
 at com.sun.facelets.impl.DefaultFaceletFactory.createFacelet(DefaultFaceletFactory.java:198)

It totally breaks it.

[michael.yuan]

Can you try to put just the implementation classes not the interfaces in the lib dir? Thanks.

[smokingapipe]

I put el-ri.jar in the WEB-INF/lib, and got the same "java.lang.NoClassDefFoundError: com/sun/el/ExpressionFactoryImpl".

I then put the el-ri.jar directly in the ear, and added it as a module in application.xml, and... it works! I tested it and it lets me run the restricted factory method. I then changed it from @Restrict("#{s:hasRole('admin')}") to @Restrict("#{s:hasRole('thisRoleDoesNotExist')}") , logged in as admin, and tried to access that factory, and got:

Authorization check failed for expression [#{s:hasRole('thisRoleDoesNotExst')}]

as I expected. So this fix seems to work, so far, and lets me keep working on this.

I'll be keeping my eyes open for Seam 1.2.2 or whatever, where hopefully this dependency will be gone.

[michael.yuan]

SmokingAPipe,

Is this AS 4.2.1 GA?

Thanks

cheers
Michael

[smokingapipe]

Yes, it's AS 4.2.1 GA.

Release ID: JBoss [Trinity] 4.2.1.GA (build: SVNTag=JBoss_4_2_1_GA date=200707131605)

[smokingapipe]

Built on Friday the 13th, note!