This week's giveaway is in the Android forum.
We're giving away four copies of Android Security Essentials Live Lessons and have Godfrey Nolan on-line!
See this thread for details.
The moose likes Other Java Products and Servers and the fly likes Securty Realm Error with GWT 2.0 app on Glassfish V2 Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Android Security Essentials Live Lessons this week in the Android forum!
JavaRanch » Java Forums » Products » Other Java Products and Servers
Bookmark "Securty Realm Error with GWT 2.0 app on Glassfish V2 " Watch "Securty Realm Error with GWT 2.0 app on Glassfish V2 " New topic
Author

Securty Realm Error with GWT 2.0 app on Glassfish V2

Joe Richard
Ranch Hand

Joined: Aug 15, 2001
Posts: 76
RPC Security Error

I have a security realm setup on my machine but I get a security error when my RPC call tries to return back the object.
This is a GWT project...so data object implements IsSerializable instead of Serializable.
The application runs on Glassfish v2.

here is the code;

method:
public CustomerDataModel getNoteData(String serialNumber) {
System.out.println("!== SerialNumber = " + serialNumber);
String[] dataBack = new String[8];

Integer serk = new Integer(serialNumber);
F01131CS messageHeader = headersDAO.getNoteHeader(serk.intValue());
BigDecimal nextHeader = messageHeader.getZZSERK();
List<F01132> messageDetail = notesDetailsDAO.getMessageDetail(nextHeader);
String[] notes = new String[messageDetail.size()];

if (messageHeader != null) {
System.out.println("!== inside of GetMessageDataImpl.getNoteData.messageHeader != null");
dataBack[0] = new Integer( messageHeader.getZZAN8() ).toString();
dataBack[1] = messageHeader.getZZALPH().trim();
dataBack[2] = "$0.00";
dataBack[3] = "$";
dataBack[4] = "$0.00";
dataBack[5] = "";
dataBack[6] = messageHeader.getZZDTI();
dataBack[7] = messageHeader.getZZMSGP().trim();

if (!messageDetail.isEmpty()) {
System.out.println("!== inside of GetMessageDataImpl.getNoteData.messageDetail.isEmpty");
for (int detailCounter=0; detailCounter<messageDetail.size(); detailCounter++) {
F01132 detailLine = (F01132)messageDetail.get(detailCounter);
notes[detailCounter] = detailLine.getCYWTXT();
}
}
else {
notes[0] = " ";
}
}
System.out.println("!== Prepare messageData");
CustomerDataModel messageData = new CustomerDataModel(dataBack, notes);
System.out.println("!== messageData has been prepared sending back");
return messageData;
}

DataObject
public class CustomerDataModel implements IsSerializable {

//private static final long serialVersionUID = 1L;
private String[] listData = new String[8];
private List<String> noteData = new ArrayList<String>();

public CustomerDataModel() {
}

public CustomerDataModel(String[] list, String[] notes) {
setListData(list);
setNoteData(notes);
}
/**
* return all notes for customer
* @return String[]0
*/
public List<String> getNoteData() {
return noteData;
}
/**
* return customer list
* @return String[]
*/
public String[] getListData() {
return listData;
}
/**
* set note data for note list
* @param notedata
*/
public void setNoteData(String[] notedata) {
for (int loop=0; loop<notedata.length; loop++) {
String notes = notedata[loop];
noteData.add(notes);
}
}
/**
* set data for customer list
* @param listdata
*/
public void setListData(String[] listdata) {
listData[0] = listdata[0];
listData[1] = listdata[1];
listData[2] = listdata[2];
listData[3] = listdata[3];
listData[4] = listdata[4];
listData[5] = listdata[5];
listData[6] = listdata[6];
listData[7] = listdata[7];
}
}


Security Setup
(web.xml)
<security-constraint>
<display-name>CollectionNotesAll</display-name>
<web-resource-collection>
<web-resource-name>CollectionNotesAll</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>CollectionNotesAll</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>BASIC</auth-method>
<realm-name>glenoitRealm</realm-name>
</login-config>

<security-role>
<description>CollectionNotes all role</description>
<role-name>CollectionNotesAll</role-name>
</security-role>

(sun-web.xml)
<security-role-mapping>
<role-name>CollectionNotesAll</role-name>
<group-name>acccrd</group-name>
<group-name>xclcor</group-name>
<group-name>mis</group-name>
<group-name>usr</group-name>
</security-role-mapping>

(application.xml)
<module>
<web>
<web-uri>CollectionNotesUIBinder.war</web-uri>
<context-root>CollectionNotes_UIBinder</context-root>
</web>
</module>
<module>
<ejb>CollectionNotesEJB.jar</ejb>
</module>
<security-role>
<description>CollectionNotes all role</description>
<role-name>CollectionNotesAll</role-name>
</security-role>

(sun-application.xml)
<security-role-mapping>
<role-name>CollectionNotesAll</role-name>
<group-name>acccrd</group-name>
<group-name>xclcor</group-name>
<group-name>mis</group-name>
<group-name>usr</group-name>
</security-role-mapping>


ERROR:
[#|2010-09-23T09:46:29.778-0400|INFO|sun-appserver9.1|javax.enterprise.system.core.security|_ThreadID=18;_ThreadName=httpSSLWorkerThread-80-4;|
JACC Policy Provider: PolicyWrapper.implies, context(Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war)- permission((java.lang.reflect.ReflectPermission suppressAccessChecks))
domain that failed(ProtectionDomain (file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-user.jar <no signer certificates>)
EJBClassLoader : urlSet = [URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesEJBClient.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesJPA.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/glenoit-util.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-dev.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-user.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war/WEB-INF/classes/, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war/WEB-INF/lib/gwt-servlet.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesEJB_jar/, URLEntry : file:/M:/Sun/AppServer/domains/domain1/generated/ejb/j2ee-apps/Accounts-Rcv-Collection-Notes/]
doneCalled = false
Parent -> EJBClassLoader :
urlSet = []
doneCalled = false
Parent -> java.net.URLClassLoader@3aef16


(principals com.sun.web.security.WebPrincipal "pgmrjoe")

java.security.Permissions@101d0ba (
(java.io.FilePermission C:\DOCUME~1\ADMINI~1.EXC\LOCALS~1\Temp\\- delete)
(java.io.FilePermission M:/Sun/AppServer/domains/domain1\lib\databases\- delete)
(java.io.FilePermission M:/Sun/AppServer/domains/domain1\imq\instances\imqbroker\log\- delete)
(java.io.FilePermission //goldsboro-gw2/XclQualIssueImages/* delete)
(java.io.FilePermission //goldsboro-gw2.excellfash.com/XclQualIssueImages/* delete)
(java.io.FilePermission <<ALL FILES>> read,write)
(java.net.SocketPermission localhost:1024- listen,resolve)
(java.net.SocketPermission * connect,resolve)
(javax.management.MBeanTrustPermission register)
(java.lang.RuntimePermission getClassLoader)
(java.lang.RuntimePermission loadLibrary.*)
(java.lang.RuntimePermission accessDeclaredMembers)
(java.lang.RuntimePermission getProtectionDomain)
(java.lang.RuntimePermission modifyThreadGroup)
(java.lang.RuntimePermission stopThread)
(java.lang.RuntimePermission setContextClassLoader)
(java.lang.RuntimePermission queuePrintJob)
(java.util.PropertyPermission line.separator read)
(java.util.PropertyPermission java.vm.version read)
(java.util.PropertyPermission java.vm.specification.version read)
(java.util.PropertyPermission java.vm.specification.vendor read)
(java.util.PropertyPermission java.vendor.url read)
(java.util.PropertyPermission java.vm.name read)
(java.util.PropertyPermission * read,write)
(java.util.PropertyPermission os.name read)
(java.util.PropertyPermission java.vm.vendor read)
(java.util.PropertyPermission path.separator read)
(java.util.PropertyPermission java.specification.name read)
(java.util.PropertyPermission os.version read)
(java.util.PropertyPermission os.arch read)
(java.util.PropertyPermission java.class.version read)
(java.util.PropertyPermission java.version read)
(java.util.PropertyPermission file.separator read)
(java.util.PropertyPermission java.vendor read)
(java.util.PropertyPermission java.vm.specification.name read)
(java.util.PropertyPermission java.specification.version read)
(java.util.PropertyPermission java.specification.vendor read)
(javax.management.MBeanPermission [com.sun.messaging.jms.*:*] *)
(unresolved javax.security.jacc.WebUserDataPermission /* null)
(unresolved com.sun.corba.ee.impl.presentation.rmi.DynamicAccessPermission access null)
(unresolved javax.security.jacc.WebResourcePermission /* !GET,POST,PUT)
(unresolved com.sun.enterprise.security.CORBAObjectPermission * *)
(javax.security.auth.PrivateCredentialPermission javax.resource.spi.security.PasswordCredential * "*" read)
)

)|#]

[#|2010-09-23T09:46:29.778-0400|SEVERE|sun-appserver9.1|javax.enterprise.system.container.web|_ThreadID=18;_ThreadName=httpSSLWorkerThread-80-4;_RequestID=94f9369c-3d10-4d49-add6-0233d0f58fed;|WebModule[/CollectionNotes_UIBinder]Exception while dispatching incoming RPC call
java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:107)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeClass(ServerSerializationStreamWriter.java:694)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeImpl(ServerSerializationStreamWriter.java:730)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serialize(ServerSerializationStreamWriter.java:612)
at com.google.gwt.user.client.rpc.impl.AbstractSerializationStreamWriter.writeObject(AbstractSerializationStreamWriter.java:129)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter$ValueWriter$8.write(ServerSerializationStreamWriter.java:152)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeValue(ServerSerializationStreamWriter.java:534)
at com.google.gwt.user.server.rpc.RPC.encodeResponse(RPC.java:609)
at com.google.gwt.user.server.rpc.RPC.encodeResponseForSuccess(RPC.java:467)
at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:564)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:188)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:224)
at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:738)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:831)
at sun.reflect.GeneratedMethodAccessor7861.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:276)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:517)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:192)
at org.apache.catalina.core.ApplicationFilterChain.servletService(ApplicationFilterChain.java:404)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:290)
at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:271)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:202)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:94)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:206)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:150)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080)
at org.apache.coyote.tomcat5.CoyoteAdapter.service(CoyoteAdapter.java:272)
at com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.invokeAdapter(DefaultProcessorTask.java:637)
at com.sun.enterprise.web.connector.grizzly.comet.CometEngine.executeServlet(CometEngine.java:547)
at com.sun.enterprise.web.connector.grizzly.comet.CometEngine.handle(CometEngine.java:299)
at com.sun.enterprise.web.connector.grizzly.comet.CometAsyncFilter.doFilter(CometAsyncFilter.java:87)
at com.sun.enterprise.web.connector.grizzly.async.DefaultAsyncExecutor.invokeFilters(DefaultAsyncExecutor.java:175)
at com.sun.enterprise.web.connector.grizzly.async.DefaultAsyncExecutor.interrupt(DefaultAsyncExecutor.java:153)
at com.sun.enterprise.web.connector.grizzly.async.AsyncProcessorTask.doTask(AsyncProcessorTask.java:92)
at com.sun.enterprise.web.connector.grizzly.TaskBase.run(TaskBase.java:265)
at com.sun.enterprise.web.connector.grizzly.ssl.SSLWorkerThread.run(SSLWorkerThread.java:106)
|#]

Persistence equals goals
SCJD (In Progress), SCJP
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Securty Realm Error with GWT 2.0 app on Glassfish V2
 
Similar Threads
GlaasFish EJB runtime error
Login Exception when using JDBC Realm (Glassfish V3.1 + IceFaces 2 + MySQL)
Cannot save Dates in Toplink
Aunthentication Problem:URGENT
problem in deploying on glassfish v2