History | Log In     View a printable version of the current page.  
   HOME       BROWSE PROJECT       FIND ISSUES   
    QUICK SEARCH:  
Issue Details (XML | Word | Printable)

Key: CIB-1624
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: 3 3
Assignee: jason
Reporter: Daniel Ostermeier
Votes: 0
Watchers: 2
Operations

If you were logged in you would be able to see more operations.
Pulse

NPE on user login with LDAP authentication and remember me selected

Created: 28/Aug/08 10:41 AM   Updated: 13/Oct/09 05:48 AM
Component/s: Users
Affects Version/s: 2.0.11
Fix Version/s: 2.0.40, 2.1.9

Original Estimate: Unknown Remaining Estimate: Unknown Time Spent: Unknown


 Description  « Hide
The error below happens only when a user logs in via LDAP and the "remember me" option is selected (client is FF or IE).


:: internal error ::


An internal error has occurred. Recent server error and warning messages are shown below to give further information. Please report this error to zutubi support, including details about what action you were performing and the messages shown below.

 

errors

8/19/08 12:36:19 PM PDT (145 ms ago) failure warning count :: 1 org.mortbay.jetty.servlet.ServletHandler :: handle


/j_acegi_security_check:


java.lang.IllegalArgumentException: [Assertion failed] - this String argument must have length; it cannot be <code>null</code> or empty
       at org.springframework.util.Assert.hasLength(Assert.java:136)
       at org.springframework.util.Assert.hasLength(Assert.java:147)
       at org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices.loginSuccess(TokenBasedRememberMeServices.java:269)

       at org.acegisecurity.ui.AbstractProcessingFilter.successfulAuthentication(AbstractProcessingFilter.java:389)
       at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:211)
       at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)
       at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148)
       at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90)
       at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
       at com.opensymphony.module.sitemesh.filter.PageFilter.parsePage(PageFilter.java:118)
       at com.opensymphony.module.sitemesh.filter.PageFilter.doFilter(PageFilter.java:52)
       at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
       at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:195)
       at com.zutubi.pulse.spring.FilterWrapper.doFilter(FilterWrapper.java:46)
       at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
       at org.mortbay.jetty.servlet.WebApplicationHandler.dispatch(WebApplicationHandler.java:471)
       at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:568)
       at org.mortbay.http.HttpContext.handle(HttpContext.java:1530)
       at org.mortbay.jetty.servlet.WebApplicationContext.handle(WebApplicationContext.java:633)
       at org.mortbay.http.HttpContext.handle(HttpContext.java:1482)
       at org.mortbay.http.HttpServer.service(HttpServer.java:927)
       at org.mortbay.http.HttpConnection.service(HttpConnection.java:816)
       at org.mortbay.http.HttpConnection.handleNext(HttpConnection.java:983)
       at org.mortbay.http.HttpConnection.handle(HttpConnection.java:833)
       at org.mortbay.http.SocketListener.handleConnection(SocketListener.java:244)
       at org.mortbay.util.ThreadedServer.handle(ThreadedServer.java:357)
       at org.mortbay.util.ThreadPool$PoolThread.run(ThreadPool.java:534)

 All   Comments   Work Log   Change History      Sort Order:
[ Permlink | « Hide ]
Daniel Ostermeier - 29/Aug/08 12:00 AM
resolved in revision 4379

[ Permlink | « Hide ]
Daniel Ostermeier - 29/Aug/08 01:55 AM
have found further issues.

[ Permlink | « Hide ]
Daniel Ostermeier - 10/Sep/08 02:37 AM
2.0.12 fixed in revision 4769.

[ Permlink | « Hide ]
Daniel Ostermeier - 10/Sep/08 04:38 AM
resolved.

[ Permlink | « Hide ]
Rohan McGovern - 07/Oct/09 07:07 AM
Several people have complained about this issue on our installation (2.0.38), so I do not think it's fixed. The backtrace looks almost exactly the same:

   1: 10/7/09 12:21:52 PM CEST (5 secs ago) failure severe count :: 1 org.mortbay.jetty.servlet.ServletHandler :: handle
   2:
   3: /j_acegi_security_check:
   4:
   5: java.lang.IllegalArgumentException: [Assertion failed] - this String argument must have length; it cannot be <code>null</code> or empty
   6: at org.springframework.util.Assert.hasLength(Assert.java:136)
   7: at org.springframework.util.Assert.hasLength(Assert.java:147)
   8: at org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices.loginSuccess(TokenBasedRememberMeServices.java:269)
   9: at org.acegisecurity.ui.AbstractProcessingFilter.successfulAuthentication(AbstractProcessingFilter.java:389)
  10: at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:211)
  11: at org.acegisecurity.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:274)
  12: at org.acegisecurity.util.FilterChainProxy.doFilter(FilterChainProxy.java:148)
  13: at org.acegisecurity.util.FilterToBeanProxy.doFilter(FilterToBeanProxy.java:90)
  14: at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
  15: at com.opensymphony.module.sitemesh.filter.PageFilter.parsePage(PageFilter.java:118)
  16: at com.opensymphony.module.sitemesh.filter.PageFilter.doFilter(PageFilter.java:52)
  17: at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
  18: at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:195)
  19: at com.zutubi.pulse.servercore.spring.FilterWrapper.doFilter(FilterWrapper.java:46)
  20: at org.mortbay.jetty.servlet.WebApplicationHandler$CachedChain.doFilter(WebApplicationHandler.java:821)
  21: at org.mortbay.jetty.servlet.WebApplicationHandler.dispatch(WebApplicationHandler.java:471)
  22: at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:568)
  23: at org.mortbay.http.HttpContext.handle(HttpContext.java:1530)
  24: at org.mortbay.jetty.servlet.WebApplicationContext.handle(WebApplicationContext.java:633)
  25: at org.mortbay.http.HttpContext.handle(HttpContext.java:1482)
  26: at org.mortbay.http.HttpServer.service(HttpServer.java:909)
  27: at org.mortbay.http.HttpConnection.service(HttpConnection.java:820)
  28: at org.mortbay.http.HttpConnection.handleNext(HttpConnection.java:986)
  29: at org.mortbay.http.HttpConnection.handle(HttpConnection.java:837)
  30: at org.mortbay.http.SocketListener.handleConnection(SocketListener.java:245)
  31: at org.mortbay.util.ThreadedServer.handle(ThreadedServer.java:357)
  32: at org.mortbay.util.ThreadPool$PoolThread.run(ThreadPool.java:534)
  33: )

[ Permlink | « Hide ]
jason - 07/Oct/09 11:01 AM
Hi Rohan,

Are you able to check the configuration of one of the users that have seen this problem for me? In $PULSE_DATA/records/snapshot/users/<login>/record.xml, is there a a non-empty <value name="password">? (Don't include the value here for obvious reasons.) LDAP users should have randomly-generated (and regularly-changing) passwords that we use to allow remember me logins without storing the LDAP passwords at all (otherwise they would need to be stored in plain text, which we are not willing to do).

[ Permlink | « Hide ]
Rohan McGovern - 09/Oct/09 07:46 AM
I checked accounts of people who have seen this problem, and for them there's no "password" value at all. Other accounts which do have a "password" value (because they were created before we switched to using LDAP) don't see the problem.

When I create LDAP users I leave the password field blank, should I not do that?

[ Permlink | « Hide ]
jason - 12/Oct/09 06:32 AM
Hi Rohan,

No, what you have done is fine, it looks like Pulse is not generating the random password when it should. I have already checked over the code to make sure it looks reasonable, I'll now try to break it in practice and see if I can get into the same situation that you have.

[ Permlink | « Hide ]
jason - 13/Oct/09 05:48 AM
Fixed in change 6789, backported to 2.0.x in change 6790. This new case could occur when remember me was used and LDAP auto-add was disabled, depending on how the user was created.


Powered by Atlassian JIRA the Professional Issue Tracker. (Standard Edition, Version: 3.10.1-#261) - Bug/feature request - Contact Administrators