Insert object into SecurityContext causes NullPointerException

[vestnik]

The following code in the Authenticator class:

   RuleBasedPermissionResolver perm_resolver = RuleBasedPermissionResolver.instance();
   assert perm_resolver != null;
   StatefulSession session = perm_resolver.getSecurityContext();
   assert session != null;
   assert loggedInPerson != null;
   session.insert(loggedInPerson);

Sometimes causes NullPointerException from the last line. But what is null in this case? Error often occurs after jboss start or restart. After project reexploding it disappears. Does anybody have the same issue.

Complete stack trace is the following:

09:59:21,582 ERROR [Authenticator] caught exception during authorization
java.lang.NullPointerException
     at hu.aveverde.edupro.seam.actions.Authenticator.authenticate(Authenticator.java:65)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:335)
     at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:348)
     at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58)
     at org.jboss.el.parser.AstValue.invoke(AstValue.java:96)
     at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276)
     at org.jboss.seam.core.Expressions$2.invoke(Expressions.java:175)
     at org.jboss.seam.security.jaas.SeamLoginModule.login(SeamLoginModule.java:109)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
     at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
     at javax.security.auth.login.LoginContext$5.run(LoginContext.java:706)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.login.LoginContext.invokeCreatorPriv(LoginContext.java:703)
     at javax.security.auth.login.LoginContext.login(LoginContext.java:575)
     at org.jboss.seam.security.Identity.authenticate(Identity.java:344)
     at org.jboss.seam.security.Identity.authenticate(Identity.java:332)
     at org.jboss.seam.security.Identity.login(Identity.java:259)
     at hu.aveverde.edupro.seam.actions.Authenticator.tryLogin(Authenticator.java:90)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at org.jboss.seam.util.Reflections.invoke(Reflections.java:22)
     at org.jboss.seam.intercept.RootInvocationContext.proceed(RootInvocationContext.java:32)
     at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:56)
     at org.jboss.seam.transaction.RollbackInterceptor.aroundInvoke(RollbackInterceptor.java:28)
     at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68)
     at org.jboss.seam.core.BijectionInterceptor.aroundInvoke(BijectionInterceptor.java:77)
     at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68)
     at org.jboss.seam.core.MethodContextInterceptor.aroundInvoke(MethodContextInterceptor.java:44)
     at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68)
     at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:107)
     at org.jboss.seam.intercept.JavaBeanInterceptor.interceptInvocation(JavaBeanInterceptor.java:185)
     at org.jboss.seam.intercept.JavaBeanInterceptor.invoke(JavaBeanInterceptor.java:103)
     at hu.aveverde.edupro.seam.actions.Authenticator_$$_javassist_seam_4.tryLogin(Authenticator_$$_javassist_seam_4.java)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:335)
     at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:348)
     at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58)
     at org.jboss.el.parser.AstValue.invoke(AstValue.java:96)
     at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276)
     at com.sun.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:68)
     at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88)
     at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
     at javax.faces.component.UICommand.broadcast(UICommand.java:387)
     at org.ajax4jsf.component.AjaxViewRoot.processEvents(AjaxViewRoot.java:321)
     at org.ajax4jsf.component.AjaxViewRoot.broadcastEvents(AjaxViewRoot.java:296)
     at org.ajax4jsf.component.AjaxViewRoot.processPhase(AjaxViewRoot.java:253)
     at org.ajax4jsf.component.AjaxViewRoot.processApplication(AjaxViewRoot.java:466)
     at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:82)
     at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
     at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
     at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
     at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:178)
     at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:290)
     at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:368)
     at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:495)
     at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:56)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.web.HotDeployFilter.doFilter(HotDeployFilter.java:53)
     at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
     at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
     at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:235)
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
     at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:190)
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:433)
     at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)
     at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)
     at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
     at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)
     at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:829)
     at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:598)
     at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
     at java.lang.Thread.run(Thread.java:619)

[vestnik]

I'm really getting tired of this error. Now it appears every second jboss restart and can be fixed only by restarting jboss. All I need is to have access to currently logged in user id in my security drool rules. I'm inserting POJO which contains it into working memory of rule based security resolver in my authenticate method and get this mystical behavior.

How can I investigate and fix it?

[serkan.s.eskici.online.nl]

I don't get it.

Why do you need to access your RuleEngine to get the id of the logged in user ?

Is the user not already in the (http)session ?

If you're using the IdentityManager, then you can observe the login-event and set the user in the session. And then you can access the user everywhere from your application by just injecting it.

[shane.bryzak]

Have you tried debugging to determine what is null?

[vestnik]

Why do you need to access your RuleEngine to get the id of the logged in user ?

For some security checks I need to have logged in user id to make a decision. For example normal user can can't edit other person details but can edit his own details and admit user can edit every person details. In my Java code I want to have only permission check with Identity.instance().checkPermission() function while this restrictions logic should go into Drool rules for rule based permission resolver. I've searched for the way how to do this and it was suggested to insert User object into security resolver working memory. This approach works but sometimes I have this annoying failures.

If there is better (and really reliable) way to access some session scoped component from Drool rules for rule-based permission resolver I'll switch to it. I'm a newbie in drool and I don't know other ways.

Have you tried debugging to determine what is null?

No I haven't since this bug appears and disappears randomly. I've tried to move insert necessary data after successful login outside of authenticate() method and now this error happens with much less frequency (once per 20 jboss restarts or even less).

[vestnik]

I've found yesterday that asserts are ignored in jboss server instance I'm running. I've added -ea option to VM arguments and will wait for the next time this issue appears to get real information what is null.

[vestnik]

Problem is fixed in the following way:

if (RuleBasedPermissionResolver.instance().getSecurityContext() == null) {
        RuleBasedPermissionResolver.instance().create();
}
RuleBasedPermissionResolver.instance().getSecurityContext().insert(loggedInUserInfo);

RuleBasedPermissionResolver.instance().getSecurityContext() sometimes return null.