[
https://issues.apache.org/jira/browse/DELTASPIKE-600?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gerhard Petracek resolved DELTASPIKE-600.
-----------------------------------------
Resolution: Not a Problem
Fix Version/s: (was: 0.8)
that's the logical consequence of the constellation you are using.
as you said: there is one invocation due to the view-config for the page,
because it inherits the metadata from your folder (because you implement the
folder interface) and after that check the folder metadata gets evaluated and
there you have the metadata as well. we can't filter the 2nd invocation autom.,
since a custom AccessDecisionVoter might just know (additional) rules for the
whole folder and not for single pages...
if you would like to keep the config that way, you need e.g. a request-scoped
AccessDecisionVoter and you skip further checks, if the check was done already
for the current view-id. or you skip the check if the metadata contains
@Folder. or you create a custom annotation as view-metadata and use it as a
marker.
please create a feature request, if you think we need something like
@Secured#restrictMultipleInvocations.
> ViewConfig @Secured AccessDecisionVoter is being called twice
> -------------------------------------------------------------
>
> Key: DELTASPIKE-600
> URL: https://issues.apache.org/jira/browse/DELTASPIKE-600
> Project: DeltaSpike
> Issue Type: Bug
> Components: JSF-Module
> Affects Versions: 0.7
> Environment: WildFly 8.0.0.Final (Mojarra 2.2.5-jbossorg-3)
> Reporter: Richard DiCroce
> Assignee: Gerhard Petracek
>
> I have the following ViewConfig:
> {code}
> public interface Pages extends ViewConfig {
> @Dependent
> class Index implements Pages {}
>
> @Secured({AuthenticatedDecisionVoter.class,
> PermissionDecisionVoter.class})
> interface SecuredByRoleAttribute extends Pages {
> @Dependent
> class TestPage implements SecuredByRoleAttribute {}
> }
>
> @Secured(AuthenticatedDecisionVoter.class)
> interface NoAuthorization extends Pages {
> @Dependent
> class TestPage implements NoAuthorization {}
> }
>
> }
> {code}
> The DecisionVoters are being called twice during each request, with different
> metadata. The first time, the metadata contains the @View for the appropriate
> page. The second time, the metadata does not contain the @View and instead
> contains the @Folder for the folder that contains the view.
> The documentation regarding @Secured in the JSF module is very light, so
> maybe this is the intended behavior, but it seems wrong to me.
> I'm not sure if this is a DS issue or a Mojarra issue or both, but the stack
> is exactly the same on both invocations:
> {noformat}
> 11:12:39,867 ERROR [stderr] (default task-7) java.lang.Exception
> 11:12:39,868 ERROR [stderr] (default task-7) at
> com.lapis.throwaway.picketlink.PermissionDecisionVoter.checkPermission(PermissionDecisionVoter.java:37)
> 11:12:39,868 ERROR [stderr] (default task-7) at
> com.lapis.throwaway.picketlink.PermissionDecisionVoter$Proxy$_$$_WeldClientProxy.checkPermission(Unknown
> Source)
> 11:12:39,868 ERROR [stderr] (default task-7) at
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> 11:12:39,868 ERROR [stderr] (default task-7) at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> 11:12:39,869 ERROR [stderr] (default task-7) at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> 11:12:39,869 ERROR [stderr] (default task-7) at
> java.lang.reflect.Method.invoke(Method.java:606)
> 11:12:39,869 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.core.api.config.view.metadata.ExecutableCallbackDescriptor.execute(ExecutableCallbackDescriptor.java:57)
> 11:12:39,870 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.security.api.authorization.Secured$Descriptor.execute(Secured.java:93)
> 11:12:39,870 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.util.SecurityUtils.invokeVoters(SecurityUtils.java:80)
> 11:12:39,870 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.security.ViewRootAccessHandler.checkAccessTo(ViewRootAccessHandler.java:87)
> 11:12:39,871 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.security.ViewRootAccessHandler$Proxy$_$$_WeldClientProxy.checkAccessTo(Unknown
> Source)
> 11:12:39,871 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.security.SecurityAwareViewHandler.createView(SecurityAwareViewHandler.java:113)
> 11:12:39,871 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.view.DeltaSpikeViewHandler.createView(DeltaSpikeViewHandler.java:70)
> 11:12:39,872 ERROR [stderr] (default task-7) at
> javax.faces.application.ViewHandlerWrapper.createView(ViewHandlerWrapper.java:173)
> 11:12:39,872 ERROR [stderr] (default task-7) at
> javax.faces.application.ViewHandlerWrapper.createView(ViewHandlerWrapper.java:173)
> 11:12:39,872 ERROR [stderr] (default task-7) at
> com.sun.faces.application.view.ViewMetadataImpl.createMetadataView(ViewMetadataImpl.java:107)
> 11:12:39,872 ERROR [stderr] (default task-7) at
> com.sun.faces.lifecycle.RestoreViewPhase.execute(RestoreViewPhase.java:241)
> 11:12:39,873 ERROR [stderr] (default task-7) at
> com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
> 11:12:39,873 ERROR [stderr] (default task-7) at
> com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:121)
> 11:12:39,873 ERROR [stderr] (default task-7) at
> com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198)
> 11:12:39,874 ERROR [stderr] (default task-7) at
> org.apache.deltaspike.jsf.impl.listener.request.DeltaSpikeLifecycleWrapper.execute(DeltaSpikeLifecycleWrapper.java:89)
> 11:12:39,874 ERROR [stderr] (default task-7) at
> javax.faces.lifecycle.LifecycleWrapper.execute(LifecycleWrapper.java:77)
> 11:12:39,874 ERROR [stderr] (default task-7) at
> javax.faces.webapp.FacesServlet.service(FacesServlet.java:646)
> 11:12:39,875 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> 11:12:39,875 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
> 11:12:39,875 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> 11:12:39,876 ERROR [stderr] (default task-7) at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> 11:12:39,876 ERROR [stderr] (default task-7) at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> 11:12:39,876 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
> 11:12:39,877 ERROR [stderr] (default task-7) at
> io.undertow.security.handlers.AuthenticationCallHandler.handleRequest(AuthenticationCallHandler.java:52)
> 11:12:39,877 ERROR [stderr] (default task-7) at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
> 11:12:39,878 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
> 11:12:39,878 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
> 11:12:39,878 ERROR [stderr] (default task-7) at
> io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
> 11:12:39,879 ERROR [stderr] (default task-7) at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> 11:12:39,879 ERROR [stderr] (default task-7) at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> 11:12:39,879 ERROR [stderr] (default task-7) at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> 11:12:39,880 ERROR [stderr] (default task-7) at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> 11:12:39,880 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
> 11:12:39,880 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
> 11:12:39,881 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
> 11:12:39,881 ERROR [stderr] (default task-7) at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
> 11:12:39,881 ERROR [stderr] (default task-7) at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:168)
> 11:12:39,882 ERROR [stderr] (default task-7) at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:687)
> 11:12:39,882 ERROR [stderr] (default task-7) at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> 11:12:39,882 ERROR [stderr] (default task-7) at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> 11:12:39,883 ERROR [stderr] (default task-7) at
> java.lang.Thread.run(Thread.java:744)
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.2#6252)
