Re: Security Filter and Tomcat 7

Hi Chris, I'm finally getting back to trying to make our app run with Tomcat 7.  Isn't this a change that should be made to security filter so that it runs correctly with Tomcat 7?  I'd be willing to bet that other people have and will continue to run into this problem.
  I had written my own Realm implementation and this worked just great, however my current exception doesn't even look like execution reaches my realm class.

Dec 13 14:03:44 SEVERE thr:13 u:- c:org.apache.jsp.e_jsp m:_jspService java.lang.NoSuchMethodError: org.apache.catalina.Realm.hasRole(Ljava/security/Principal;Ljava/lang/String;)Z
at org.securityfilter.realm.catalina.CatalinaRealmAdapter.isUserInRole(CatalinaRealmAdapter.java:108)
at org.securityfilter.filter.SecurityFilter.doFilter(SecurityFilter.java:214)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:224)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:928)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:987)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:539)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:300)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:680)

My realm is defined in security-filter.xml as:

<realm className="com.company.authentication.MyRealm">

Thanks,
  -M@

On Sep 29, 2011, at 12:55 PM, Christopher Schultz wrote:

> Matt,
> 
> On 9/1/2011 7:17 PM, Matthew Hixson wrote:
>> I am trying to get our webapp working with Tomcat 7 and am finding
>> that Security Filter is failing because it is compiled against an
>> older servlet spec.
> 
> The servlet spec is backward-compatible, so that's not the issue.
> 
>> Has Security Filter been obsoleted by Tomcat's
>> <security-constraint> support?
> 
> <security-constraint> has been a part of the spec (it's not
> Tomcat-specific) since the beginning. No spec changes have altered the
> capabilities of securityfilter.
> 
>> Sep 01 15:58:25 INFO thr:14 u:- c:org.apache.jsp.e_jsp m:_jspService --- IN E.JSP ---
>> java.lang.NoSuchMethodError:
> org.apache.catalina.Realm.hasRole(Ljava/security/Principal;Ljava/lang/String;)Z
>> 	at org.securityfilter.realm.catalina.CatalinaRealmAdapter.isUserInRole(CatalinaRealmAdapter.java:108)
> 
> Tomcat's internal classes have changed. The CatalinaRealmAdapter was
> built originally for a Tomcat 4/5 integration and, unfortunately, over
> time it has diverged more and more from what sf expects and can use.
> 
> One solution is to provide "adapter" classes for all versions of Tomcat
> (and WebLogic, and Jetty, and...). Another solution is to implement your
> own Realm yourself. That's what I have done: I have a DataSourceRealm
> built using some of Tomcat's code as a basis, but doesn't reference any
> of Tomcat's classes, etc. This code runs happily on versions of Tomcat
> going from 4.3 through the latest 7.0 (I know because I've been using sf
> in this way through all those versions... actually skipped 5.0 to don't
> take my word for it).
> 
> I've been asked for my DataSourceRealm implementation a few times, so
> maybe it's time to put it into CVS. You can download it here at the
> bottom of the page:
> http://www.christopherschultz.net/projects/java/
> 
> -chris
> 
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1_______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user


------------------------------------------------------------------------------
Systems Optimization Self Assessment
Improve efficiency and utilization of IT resources. Drive out cost and 
improve service delivery. Take 5 minutes to use this Systems Optimization 
Self Assessment. http://www.accelacomm.com/jaw/sdnl/114/51450054/