Seam-Security JPAIdentityStore CriteriaQuery Issue

[haye]

I'm getting the following exception when I attempt to authenticate






java.lang.RuntimeException: com.objectdb.o._PersistenceException: Unexpected query token 'FROM' (SELECT is expected)
        at org.jboss.seam.security.IdentityImpl.authenticate(IdentityImpl.java:329)
        at org.jboss.seam.security.IdentityImpl.login(IdentityImpl.java:229)
        at org.jboss.seam.security.org$jboss$weld$bean-WEB-INF$lib$seam-security-3$0$0$Final-ManagedBean-class_org$jboss$seam$security$IdentityImpl_$$_WeldClientProxy.login(org$jboss$weld$bean-WEB-INF$lib$seam-security-3$0$0$Final-ManagedBean-class_org$jboss$seam$security$IdentityImpl_$$_WeldClientProxy.java)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.sun.el.parser.AstValue.invoke(AstValue.java:234)
        at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:297)
        at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:43)
        at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:56)
        at com.sun.faces.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:105)
        at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88)
        at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
        at javax.faces.component.UICommand.broadcast(UICommand.java:315)
        at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:794)
        at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:1259)
        at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:81)
        at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
        at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
        at javax.faces.webapp.FacesServlet.service(FacesServlet.java:409)
        at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1534)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:281)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
        at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:655)
        at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595)
        at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
        at com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:91)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:162)
        at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:326)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:227)
        at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:170)
        at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:822)
        at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:719)
        at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1013)
        at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:225)
        at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90)
        at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79)
        at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54)
        at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59)
        at com.sun.grizzly.ContextTask.run(ContextTask.java:71)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513)
        at java.lang.Thread.run(Thread.java:662)
Caused by: com.objectdb.o._PersistenceException: Unexpected query token 'FROM' (SELECT is expected)
        at com.objectdb.o._PersistenceException.b(_PersistenceException.java:45)
        at com.objectdb.o.JPE.g(JPE.java:140)
        at com.objectdb.o.ERR.f(ERR.java:59)
        at com.objectdb.o.OBC.onObjectDBError(OBC.java:1444)
        at com.objectdb.jpa.JpaQuery.getSingleResult(JpaQuery.java:617)
        at org.jboss.seam.security.management.picketlink.JpaIdentityStore.lookupIdentity(JpaIdentityStore.java:1233)
        at org.jboss.seam.security.management.picketlink.JpaIdentityStore.validateCredential(JpaIdentityStore.java:1899)
        at org.picketlink.idm.impl.repository.WrapperIdentityStoreRepository.validateCredential(WrapperIdentityStoreRepository.java:303)
        at org.picketlink.idm.impl.api.session.managers.AttributesManagerImpl.validateCredentials(AttributesManagerImpl.java:607)
        at com.asalsolutions.security.auth.TijAuthenticator.authenticate(SimpleAuthenticator.java:82)
        at org.jboss.seam.security.IdentityImpl.authenticate(IdentityImpl.java:305)
        ... 45 more
Caused by: com.objectdb.o.UserException: Unexpected query token 'FROM' (SELECT is expected)
        at com.objectdb.o.MSG.d(MSG.java:61)
        at com.objectdb.o.TKN.J(TKN.java:755)
        at com.objectdb.o.TKI.u(TKI.java:256)
        at com.objectdb.o.TKI.n(TKI.java:133)
        at com.objectdb.o.QPR.s(QPR.java:276)
        at com.objectdb.o.QPR.o(QPR.java:145)
        at com.objectdb.o.QRC.<init>(QRC.java:119)
        at com.objectdb.o.QRM.UR(QRM.java:242)
        at com.objectdb.o.MST.UR(MST.java:878)
        at com.objectdb.o.WRA.UR(WRA.java:286)
        at com.objectdb.o.WSM.UR(WSM.java:113)
        at com.objectdb.o.QRR.g(QRR.java:220)
        at com.objectdb.o.QRR.b(QRR.java:143)
        at com.objectdb.jpa.JpaQuery.getSingleResult(JpaQuery.java:610)
        ... 51 more






The issue appears to be that JpaIdentityStore.lookupIdentity() does not call select() on the criteria object. The resulting query is incomplete.

Environment: Glassfish 3.1, seam-security-3.0.0.Final

[haye]

No takers? I'll provide more details...

From JpaIdentityStore.java starting at line 1216:

protected Object lookupIdentity(IdentityObject obj, EntityManager em)
   {
      Property<?> identityNameProp = modelProperties.get(PROPERTY_IDENTITY_NAME);
      Property<?> identityTypeProp = modelProperties.get(PROPERTY_IDENTITY_TYPE);
      
      CriteriaBuilder builder = em.getCriteriaBuilder();
      CriteriaQuery<?> criteria = builder.createQuery(identityClass);
      Root<?> root = criteria.from(identityClass);
      
      List<Predicate> predicates = new ArrayList<Predicate>();
      predicates.add(builder.equal(root.get(identityNameProp.getName()), obj.getName()));
      predicates.add(builder.equal(root.get(identityTypeProp.getName()), lookupIdentityType(obj.getIdentityType().getName(), em)));
      
      // TODO add criteria for identity type
      
      criteria.where(predicates.toArray(new Predicate[predicates.size()]));
      
      return em.createQuery(criteria).getSingleResult();
   }

I believe there has to be a call to criteria.select(root) somewhere in there. Otherwise the resulting query will be missing the 'SELECT' keyword. There are also other queries in the class that also lack a 'select.'

I'm using ObjectDB as my JPA implementation and itt won't accept the query without a select. I'm not sure how other implementations handle it but it seems to me that it they would also complain.

[shane.bryzak]

Hmm, perhaps Hibernate is more relaxed when it comes to this.  Could you please raise a JIRA issue, and I'll look into it?

http://issues.jboss.org/browse/SEAMSECURITY

[haye]

I keep on getting the following error when I try to login to JIRA:

Sorry, a communication error occurred while trying to contact the remote authentication server

Can someone with access to JIRA please raise the issue?

[shane.bryzak]

It seems to be working now, could you try it again?  I could raise the issue myself, however if I did then it wouldn't receive priority (we generally fix issues that users raise in a more timely fashion, however issues that we raise ourselves more often than not get bumped multiple times) ;)

[haye]

I'm still getting the error. I even registered a new account and yet I'm still not able to login to JIRA (no problem logging in at jboss.org).

I now notice the following message on main JIRA page:

Due change in internal JIRA user management infrastructure, you may fall in problem to access/authenticate JIRA from external clients (eg. Eclipse plugin) using remote API. In this case login into JIRA over web please to sync internal DB correctly.

I'll retry again tomorrow. Hopefully, login issues will be sorted out by then.

[lightguard]

This ticket has been filed at https://issues.jboss.org/browse/SEAMSECURITY-65