1 2 Previous Next 23 Replies Latest reply on Oct 8, 2008 3:29 AM by enda

    scheme="http" and restrict

    enda

      I am trying to get out of SSL after I login



        <page view-id="/private/*" scheme="http">
             <restrict>#{identity.loggedIn}</restrict>
          </page>



      and I get this exception



      org.jboss.seam.security.NotLoggedInException
           at org.jboss.seam.security.Identity.checkRestriction(Identity.java:185)
           at org.jboss.seam.navigation.Page.checkPermission(Page.java:218)
           at org.jboss.seam.navigation.Page.preRender(Page.java:238)
           at org.jboss.seam.navigation.Pages.preRender(Pages.java:316)
           at org.jboss.seam.jsf.SeamPhaseListener.preRenderPage(SeamPhaseListener.java:560)
           at org.jboss.seam.jsf.SeamPhaseListener.beforeRenderResponse(SeamPhaseListener.java:471)
           at org.jboss.seam.jsf.SeamPhaseListener.beforeServletPhase(SeamPhaseListener.java:144)
           at org.jboss.seam.jsf.SeamPhaseListener.beforePhase(SeamPhaseListener.java:114)
           at com.sun.faces.lifecycle.Phase.handleBeforePhase(Phase.java:214)
           at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:96)
           at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
           at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
           at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:85)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
           at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:154)
           at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:260)
           at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:366)
           at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:493)
           at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:60)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:58)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.debug.hot.HotDeployFilter.doFilter(HotDeployFilter.java:68)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
           at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
           at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)
           at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
           at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
           at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
           at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
           at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
           at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
           at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
           at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
           at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
           at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
           at java.lang.Thread.run(Thread.java:619)
      20:41:29,736 ERROR [Exceptions] Can't find exception class for exception handler
      java.lang.ClassNotFoundException: No ClassLoaders found for: org.jboss.seam.ConcurrentRequestTimeoutException
           at org.jboss.mx.loading.LoadMgr3.beginLoadTask(LoadMgr3.java:306)
           at org.jboss.mx.loading.RepositoryClassLoader.loadClassImpl(RepositoryClassLoader.java:521)
           at org.jboss.mx.loading.RepositoryClassLoader.loadClass(RepositoryClassLoader.java:415)
           at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
           at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
           at java.lang.Class.forName0(Native Method)
           at java.lang.Class.forName(Class.java:169)
           at org.jboss.seam.util.Reflections.classForName(Reflections.java:165)
           at org.jboss.seam.exception.Exceptions.parse(Exceptions.java:139)
           at org.jboss.seam.exception.Exceptions.initialize(Exceptions.java:97)
           at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
           at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
           at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
           at java.lang.reflect.Method.invoke(Method.java:597)
           at org.jboss.seam.util.Reflections.invoke(Reflections.java:21)
           at org.jboss.seam.util.Reflections.invokeAndWrap(Reflections.java:125)
           at org.jboss.seam.Component.callComponentMethod(Component.java:2092)
           at org.jboss.seam.Component.callCreateMethod(Component.java:2015)
           at org.jboss.seam.Component.newInstance(Component.java:1976)
           at org.jboss.seam.Component.getInstance(Component.java:1876)
           at org.jboss.seam.Component.getInstance(Component.java:1855)
           at org.jboss.seam.Component.getInstance(Component.java:1832)
           at org.jboss.seam.Component.getInstance(Component.java:1827)
           at org.jboss.seam.exception.Exceptions.instance(Exceptions.java:196)
           at org.jboss.seam.jsf.SeamPhaseListener.beforePhase(SeamPhaseListener.java:123)
           at com.sun.faces.lifecycle.Phase.handleBeforePhase(Phase.java:214)
           at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:96)
           at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
           at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
           at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:85)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
           at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:154)
           at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:260)
           at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:366)
           at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:493)
           at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:60)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:58)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.debug.hot.HotDeployFilter.doFilter(HotDeployFilter.java:68)
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
           at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
           at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
           at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
           at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)
           at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
           at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
           at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
           at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
           at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
           at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
           at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
           at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
           at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
           at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
           at java.lang.Thread.run(Thread.java:619)
      



        • 1. Re: scheme="http" and restrict
          enda

          when I use


          <page view-id="/private/*" scheme="http" login-required="true">
              </page>



          then no exception, but it will not get me on the page I expect to go to(http), it stays in the login page (https)


          Some hints?


          Thanks

          • 2. Re: scheme="http" and restrict
            enda

            without


            login-required="true"



            would work, but then I will not request login

            • 3. Re: scheme="http" and restrict
              enda

              It seems it logs me in only for https scheme, but not for http session that is why it redirects me to the login page...?

              • 4. Re: scheme="http" and restrict
                enda

                So I have figured out that that https has it own session and http as well, is there an option to have them synchronized or better just one session for both schemes?


                this:


                <core:servlet-session invalidate-on-scheme-change="false"/>



                does not work for me ;(.


                PS I have Seam 2.0.3.CR1


                Thanks for help

                • 5. Re: scheme="http" and restrict
                  enda

                  the same question and no answer?
                  jboss discussion

                  • 6. Re: scheme="http" and restrict
                    shane.bryzak

                    Are the same cookie values still being sent when you switch schemes?

                    • 7. Re: scheme="http" and restrict
                      enda

                      1.when my navigation is http -> https it seems work
                      2.but if I go directly to https then it dies not work


                      1. I get 2 cookies


                      JSESSIONID
                      org.jboss.seam.security.username



                      2. I get 3 cookies


                      JSESSIONID (path /myApp) - Encrypted connections only
                      org.jboss.seam.security.username
                      JSESSIONID (path /)

                      • 8. Re: scheme="http" and restrict
                        enda

                        Details



                        1) welcome page (http) -> login page (https) -> home (http)
                        this one works


                        2 cookies:


                        localhost - JSESSIONID
                        content - 2ED1AC0A676B6DF12873AA6E2042D679
                        host - localhost
                        path - /
                        send for - Any type of connection
                        expires - at the end of session
                        
                        localhost - org.jboss.seam.security.username
                        content - myLogin
                        host - localhost
                        path - /MYAPP
                        send for - Any type of connection
                        expires - (some time)




                        2) login page (https) -> home (http)
                        here I stay at login page since I have 2 sessions
                        this one does not work


                        3 cookies:


                        localhost - JSESSIONID
                        content - 024BA11AD0B714ED8FBC17CCEA469F4C
                        host - localhost
                        path - /CM3v2
                        send for - Encrypted connections only
                        expires - at the end of session
                        
                        
                        localhost - org.jboss.seam.security.username
                        content - myLogin
                        host - localhost
                        path - /MYAPP
                        send for - Any type of connection
                        expires - (some time)
                        
                        localhost - JSESSIONID
                        content - B38B0863802952FE27B8934193791C5E
                        host - localhost
                        path - /
                        send for - Any type of connection
                        expires - at the end of session

                        • 9. Re: scheme="http" and restrict
                          enda

                          Details



                          1) welcome page (http) -> login page (https) -> home (http)
                          this one works


                          2 cookies:


                          localhost - JSESSIONID
                          content - 2ED1AC0A676B6DF12873AA6E2042D679
                          host - localhost
                          path - /
                          send for - Any type of connection
                          expires - at the end of session
                          
                          localhost - org.jboss.seam.security.username
                          content - myLogin
                          host - localhost
                          path - /MYAPP
                          send for - Any type of connection
                          expires - (some time)




                          2) login page (https) -> home (http)
                          here I stay at login page since I have 2 sessions
                          this one does not work


                          3 cookies:


                          localhost - JSESSIONID
                          content - 024BA11AD0B714ED8FBC17CCEA469F4C
                          host - localhost
                          path - /CM3v2
                          send for - Encrypted connections only
                          expires - at the end of session
                          
                          
                          localhost - org.jboss.seam.security.username
                          content - myLogin
                          host - localhost
                          path - /MYAPP
                          send for - Any type of connection
                          expires - (some time)
                          
                          localhost - JSESSIONID
                          content - B38B0863802952FE27B8934193791C5E
                          host - localhost
                          path - /
                          send for - Any type of connection
                          expires - at the end of session

                          • 10. Re: scheme="http" and restrict
                            shane.bryzak

                            The session ID cookies have different paths, which explains why the authenticated session is being lost.  Is it a single Seam application (with a single war file) that's being deployed?

                            • 11. Re: scheme="http" and restrict
                              enda

                              it is a single application that has a single ear file and a single war in it. 

                              • 12. Re: scheme="http" and restrict
                                shane.bryzak

                                Do you have any idea why the context paths might be different?  Under which path is your app deployed?

                                • 13. Re: scheme="http" and restrict
                                  enda

                                  It is deployed under


                                  localhost/MyApp



                                  I have port 80 and 443


                                  when I go to the login.seam


                                  I go to


                                  localhost/MyApp/login.seam



                                  I never go to localhost/


                                  I could be reproducing it over and over again.


                                  I found that if I navigate to the login.seam via http then seam redirects to the https and it is ok.
                                  if I go to the login.seam via https directly then I get the problem.

                                  • 14. Re: scheme="http" and restrict
                                    enda

                                    If you mean on my server. I have there 3 applications that are independent of each other.

                                    1 2 Previous Next