Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider
Benedikt Lang <[email protected]> Mon, 23 Mar 2026 08:54:57 +0100
| Newsgroups | gmane.comp.java.openejb.user |
|---|---|
| Message-ID | <[email protected]> |
Hey Markus, can confirm the fix works correctly. Thanks a lot for your help. Best Benedikt On 23.03.26 08:24, Markus Jung wrote: > Hey Benedikt, > > > had some time now to look at your reproducer (sorry it took a bit, > we're all just volunteers afterall) and it seems like this is indeed a > bug in TomEE when using notifyProvider=true combined with JAX-RS. I > filed an issue for it > (https://issues.apache.org/jira/browse/TOMEE-4596) and pushed a fix to > our main and tomee-10.x branches. > > Could you download the latest SNAPSHOT build from here > https://repository.apache.org/content/groups/snapshots/org/apache/tomee/apache-tomee/10.1.5-SNAPSHOT/ > and confirm the fix also works in your real applications? > > > Thanks > > Markus > > > On 3/16/26 11:07, Benedikt Lang wrote: >> Hi Richard, >> >> >> if uploaded the reproducer to github here: >> https://github.com/pickbreaker/tomee-oidc-bug-reproducer >> >> >> Gruß >> >> Benedikt >> >> On 13.03.26 13:12, Richard Zowalla wrote: >>> Hi, >>> >>> Perhaps it would be best, if you could upload that reproducer, so we >>> can replicate. >>> >>> Gruß >>> Richard >>> >>>> Am 13.03.2026 um 12:24 schrieb Benedikt Lang <[email protected]>: >>>> >>>> Hello Markus, >>>> >>>> >>>> our Keycloak Client is indeed set up as a public client. However >>>> changing it to a confidential one and configuring the client secret >>>> did not change the outcome. >>>> >>>> A colleague of mine built a minimal reproducer and we experimented >>>> a bit. The exception only shows, when using the authentication >>>> mechanism with JAX-RS. When using a servlet directly the exception >>>> vanishes. >>>> >>>> >>>> Hope this helps >>>> >>>> Thanks >>>> >>>> Benedikt >>>> >>>> On 13.03.26 09:07, Markus Jung wrote: >>>>> Hello Benedikt, >>>>> >>>>> >>>>> your config is _very_ similar to the one we run at my company, I >>>>> also added a test to verify this behavior works >>>>> (https://github.com/apache/tomee/commit/9efdac831ae6a906664fd0c72b0ccd8410a528ce) >>>>> which passes on my machine. I noticed your >>>>> @OpenIdAuthenticationMechanismDefinition does not contain a client >>>>> secret. Did you simply remove it before copying into your mail or >>>>> is your client in Keycloak maybe configured for public access (= >>>>> Client authentication in Keycloak turned off)? >>>>> >>>>> >>>>> Thanks >>>>> >>>>> Markus >>>>> >>>>> >>>>> On 3/12/26 10:15, Benedikt Lang wrote: >>>>>> Hello Markus, >>>>>> >>>>>> >>>>>> thanks for the reply. >>>>>> >>>>>> The definition reads as follows: >>>>>> >>>>>> ```java >>>>>> >>>>>> @OpenIdAuthenticationMechanismDefinition(providerURI >>>>>> ="${openId.providerURI}", clientId ="${openId.clientId}", >>>>>> redirectURI ="${baseURL}", redirectToOriginalResource =false, >>>>>> logout =@LogoutDefinition(notifyProvider =true, redirectURI >>>>>> ="${baseURL}")) >>>>>> >>>>>> ``` >>>>>> >>>>>> With the providerUri being `https://<domain>/realms/<realmName>`. >>>>>> >>>>>> We are using Keycloak as our OIDC provider as well. Furthermore >>>>>> I'm pretty sure the Access Token validates as the Endpoint is >>>>>> secured. >>>>>> >>>>>> >>>>>> Thanks >>>>>> >>>>>> Benedikt >>>>>> >>>>>> >>>>>> On 11.03.26 19:05, Markus Jung wrote: >>>>>>> Hello Benedikt, >>>>>>> >>>>>>> from a first glance looks like either a bug in TomEE or your >>>>>>> session hasn't been properly authenticated (Access token/ID >>>>>>> token failed to verify?). >>>>>>> I'm curious about the rest of your >>>>>>> @OpenIdAuthenticationMechanismDefinition. Could you possibly >>>>>>> share that? Also, what OIDC provider are you using? >>>>>>> >>>>>>> We're running the OIDC authentication at my company with >>>>>>> notifyProvider=true on logout without any issues on Keycloak. >>>>>>> That's also what I tested against during the implementation, so >>>>>>> there could of course still be quirks to with other OIDC providers. >>>>>>> >>>>>>> >>>>>>> Thanks >>>>>>> Markus >>>>>>> >>>>>>> Am 11. März 2026 18:07:43 MEZ schrieb Benedikt >>>>>>> Lang<[email protected]>: >>>>>>>> Hello, >>>>>>>> >>>>>>>> I am using TomEE 10.1.4 to serve a web application. For >>>>>>>> authentication I am using the OpenIdAuthenticationMechanisms >>>>>>>> via `@OpenIdAuthenticationMechanismDefinition`. When using >>>>>>>> notifyProvider=false the logout endpoint runs fine, but when >>>>>>>> setting it to true I receive the following exception: >>>>>>>> >>>>>>>> ``` >>>>>>>> >>>>>>>> jakarta.enterprise.context.ContextNotActiveException: WebBeans >>>>>>>> context with scope type annotation @SessionScoped does not >>>>>>>> exist within current thread >>>>>>>> at >>>>>>>> org.apache.webbeans.container.BeanManagerImpl.getContext(BeanManagerImpl.java:339) >>>>>>>> at >>>>>>>> org.apache.webbeans.intercept.NormalScopedBeanInterceptorHandler.getContextualInstance(NormalScopedBeanInterceptorHandler.java:89) >>>>>>>> at >>>>>>>> org.apache.webbeans.intercept.SessionScopedBeanInterceptorHandler.getContextualInstance(SessionScopedBeanInterceptorHandler.java:76) >>>>>>>> at >>>>>>>> org.apache.webbeans.intercept.NormalScopedBeanInterceptorHandler.get(NormalScopedBeanInterceptorHandler.java:71) >>>>>>>> at >>>>>>>> org.apache.tomee.security.cdi.openid.TomEEOpenIdContext$$OwbNormalScopeProxy0.getIdentityToken(org/apache/tomee/security/cdi/openid/TomEEOpenIdContext.java) >>>>>>>> at >>>>>>>> org.apache.tomee.security.cdi.OpenIdAuthenticationMechanism.cleanSubject(OpenIdAuthenticationMechanism.java:87) >>>>>>>> at >>>>>>>> org.apache.tomee.security.cdi.OpenIdAuthenticationMechanism$$OwbNormalScopeProxy0.cleanSubject(org/apache/tomee/security/cdi/OpenIdAuthenticationMechanism.java) >>>>>>>> at >>>>>>>> org.apache.tomee.security.cdi.DefaultAuthenticationMechanism.cleanSubject(DefaultAuthenticationMechanism.java:56) >>>>>>>> at >>>>>>>> org.apache.tomee.security.cdi.DefaultAuthenticationMechanism$$OwbNormalScopeProxy0.cleanSubject(org/apache/tomee/security/cdi/DefaultAuthenticationMechanism.java) >>>>>>>> at >>>>>>>> org.apache.tomee.security.provider.TomEESecurityServerAuthModule.cleanSubject(TomEESecurityServerAuthModule.java:60) >>>>>>>> at >>>>>>>> org.apache.tomee.security.provider.TomEESecurityServerAuthContext.cleanSubject(TomEESecurityServerAuthContext.java:37) >>>>>>>> at >>>>>>>> org.apache.catalina.authenticator.AuthenticatorBase.logout(AuthenticatorBase.java:1238) >>>>>>>> at >>>>>>>> org.apache.catalina.connector.Request.logout(Request.java:2527) >>>>>>>> at >>>>>>>> org.apache.catalina.connector.RequestFacade.logout(RequestFacade.java:764) >>>>>>>> at >>>>>>>> jakarta.servlet.http.HttpServletRequestWrapper.logout(HttpServletRequestWrapper.java:302) >>>>>>>> at >>>>>>>> org.apache.openejb.server.httpd.EEFilter$NoCdiRequest.logout(EEFilter.java:95) >>>>>>>> at >>>>>>>> org.apache.openejb.server.httpd.ServletRequestAdapter.logout(ServletRequestAdapter.java:92) >>>>>>>> at >>>>>>>> jakarta.servlet.http.HttpServletRequestWrapper.logout(HttpServletRequestWrapper.java:302) >>>>>>>> at >>>>>>>> org.apache.openejb.rest.ThreadLocalHttpServletRequest.logout(ThreadLocalHttpServletRequest.java:398) >>>>>>>> at >>>>>>>> <redacted>.LogoutRestAdapter.logout(LogoutRestAdapter.java:36) >>>>>>>> at >>>>>>>> <redacted>t.LogoutRestAdapter$$OwbNormalScopeProxy0.logout(<redacted>/LogoutRestAdapter.java) >>>>>>>> at >>>>>>>> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native >>>>>>>> Method) >>>>>>>> at >>>>>>>> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) >>>>>>>> at >>>>>>>> java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) >>>>>>>> at >>>>>>>> java.base/java.lang.reflect.Method.invoke(Method.java:569) >>>>>>>> at >>>>>>>> org.apache.openejb.server.cxf.rs.PojoInvoker.performInvocation(PojoInvoker.java:37) >>>>>>>> at >>>>>>>> org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96) >>>>>>>> at >>>>>>>> org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200) >>>>>>>> at >>>>>>>> org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:103) >>>>>>>> at >>>>>>>> org.apache.openejb.server.cxf.rs.AutoJAXRSInvoker.invoke(AutoJAXRSInvoker.java:68) >>>>>>>> at >>>>>>>> org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59) >>>>>>>> at >>>>>>>> org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96) >>>>>>>> at >>>>>>>> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) >>>>>>>> at >>>>>>>> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) >>>>>>>> at >>>>>>>> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267) >>>>>>>> at >>>>>>>> org.apache.openejb.server.cxf.rs.CxfRsHttpListener.doInvoke(CxfRsHttpListener.java:266) >>>>>>>> at >>>>>>>> org.apache.tomee.webservices.CXFJAXRSFilter.doFilter(CXFJAXRSFilter.java:80) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:162) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:138) >>>>>>>> at >>>>>>>> org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) >>>>>>>> >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:162) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:138) >>>>>>>> at >>>>>>>> org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:67) >>>>>>>> >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:162) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:138) >>>>>>>> at >>>>>>>> io.smallrye.metrics.jaxrs.JaxRsMetricsServletFilter.doFilter(JaxRsMetricsServletFilter.java:37) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:162) >>>>>>>> at >>>>>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:138) >>>>>>>> at >>>>>>>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:165) >>>>>>>> at >>>>>>>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:88) >>>>>>>> at >>>>>>>> org.apache.tomee.catalina.OpenEJBValve.invoke(OpenEJBValve.java:45) >>>>>>>> >>>>>>>> at >>>>>>>> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:607) >>>>>>>> at >>>>>>>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:113) >>>>>>>> at >>>>>>>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83) >>>>>>>> at >>>>>>>> org.apache.tomee.catalina.OpenEJBSecurityListener$RequestCapturer.invoke(OpenEJBSecurityListener.java:97) >>>>>>>> at >>>>>>>> org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:654) >>>>>>>> at >>>>>>>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72) >>>>>>>> at >>>>>>>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) >>>>>>>> at >>>>>>>> org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399) >>>>>>>> at >>>>>>>> org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) >>>>>>>> at >>>>>>>> org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903) >>>>>>>> at >>>>>>>> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1775) >>>>>>>> at >>>>>>>> org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) >>>>>>>> at >>>>>>>> org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:973) >>>>>>>> at >>>>>>>> org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:491) >>>>>>>> at >>>>>>>> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) >>>>>>>> at java.base/java.lang.Thread.run(Thread.java:840) >>>>>>>> >>>>>>>> ``` >>>>>>>> >>>>>>>> >>>>>>>> Is this a bug in TomEE? What should I look out for to determine >>>>>>>> what the culprit is? >>>>>>>> >>>>>>>> >>>>>>>> Best regards >>>>>>>> >>>>>>>> Benedikt Lang >>>>>>>> >>>>>>>>