Security Context is null in sessionDestroyed

[maik.lehradt]

We are using a javax.servlet.HttpSessionListener to clean up session data after a session timeout or if a user quits his session. In this listener an EJB 3.0 SLSB is called. Everything works fine if a user clicks the log out button. The SLSB is called and does its job. But with no user interaction (i.e. a session timeout), an exception is thrown whenever an EJB is called.

14:33:00,220 DEBUG [SessionListener] Session destroyed 8F8B26D11F14A00A281D7EF56ED9371B
14:33:00,220 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/xxx]] Session event listener threw exception
java.lang.IllegalStateException: Local Call: Security Context is null
    at org.jboss.ejb3.security.Ejb3AuthenticationInterceptorv2.invoke(Ejb3AuthenticationInterceptorv2.java:109)
    at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
    at org.jboss.ejb3.ENCPropagationInterceptor.invoke(ENCPropagationInterceptor.java:41)
    at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
    at org.jboss.ejb3.BlockContainerShutdownInterceptor.invoke(BlockContainerShutdownInterceptor.java:67)
    at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
    at org.jboss.aspects.currentinvocation.CurrentInvocationInterceptor.invoke(CurrentInvocationInterceptor.java:67)
    at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
    at org.jboss.ejb3.session.SessionSpecContainer.invoke(SessionSpecContainer.java:176)
    at org.jboss.ejb3.session.SessionSpecContainer.invoke(SessionSpecContainer.java:216)
    at org.jboss.ejb3.proxy.impl.handler.session.SessionProxyInvocationHandlerBase.invoke(SessionProxyInvocationHandlerBase.java:207)
    at org.jboss.ejb3.proxy.impl.handler.session.SessionProxyInvocationHandlerBase.invoke(SessionProxyInvocationHandlerBase.java:164)
    at $Proxy1580.isLoggedIn(Unknown Source)
    at xxx.PrincipalService.isLoggedIn(ArgosPrincipalService.java:156)
    at xxx.SlidingPlanJanitor.cleanUp(SlidingPlanJanitor.java:57)
    at xxx.SessionListener.cleanUpAfterSessionTimeout(SessionListener.java:94)
    at xxx.SessionListener.sessionDestroyed(SessionListener.java:61)

We used this listener for a while in JBoss 4.2.3.GA, but with JBoss 5.1.0.GA it doesn't work anymore.

[maik.lehradt]

I have found other threads with similar problems.

http://community.jboss.org/message/203993#203993

http://community.jboss.org/message/141846#141846

Other articles with tips:

http://anil-identity.blogspot.com/2009/05/as5-specifying-security-domain.html

http://community.jboss.org/wiki/SecurityFAQ

http://community.jboss.org/wiki/ClientLoginModule

http://community.jboss.org/wiki/WebAuthentication

The mentioned tips didn't work for me. We still get an java.lang.IllegalStateException whenever the timeout is reached, but not when a user invalidates its session. It seems that we only get this error if an ejb is called outside of a http request. I even tried to authenticate the user again, but it didn't work.

Any help/hint is appreciated.

[kennardconsulting]

Maik,

We are trying almost exactly the same thing you describe (only using HttpSessionBindingListener.valueUnbound). We are also seeing exactly the same behaviour and same error that you describe!

We were just wondering if you made any progress with this issue? If not, I think we're about as stuck as you!

Regards,

Richard.

[kennardconsulting]

Maik,

I believe I have found a partial solution. It may not work in your case, but in our case the problem was that we have specified a <security-domain> at the top of our jboss.xml. We need this because in general our EJBs require authentication (eg. the @Role annotation)

However we could get away with making the particular bean that handles 'sessionDestroyed' a stateless bean, requiring no authentication, and then you can override security domain to be 'not needed' on a per-bean basis. For example:

<jboss xmlns="http://www.jboss.com/xml/ns/javaee"  xmlns:xsi=

"http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation=

"http://www.jboss.com/xml/ns/javaee  ://www.jboss.org/j2ee/schema/jboss_5_0.xsd"  version=

"5.0">

<!-- Security domain -->

<security-domain>avant-ss</security-domain>

<enterprise-beans>

<!-- AuthorisedRepNotifier (allow unauthenticated access) -->

<session>

<ejb-name>AuthorisedRepNotifierBean</ejb-name> 

<security-domain />

</session>