[OPENIG-910] ScriptableFilter : Get error `Cannot execute script` with groovy scripts previously working Created: 10/Mar/16  Updated: 20/Nov/18  Resolved: 05/Apr/17

Status: Closed
Project: Identity Gateway
Component/s: Core
Affects Version/s: 4.5.0, 5.0.0
Fix Version/s: Not Applicable

Type: Bug Priority: Major
Reporter: Jean-Charles Deville Assignee: Guillaume Sauthier
Resolution: Won't Fix Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

OS : OSX 10.11.3
container : Tomcat 8.0.23
jdk : 1.8.0_60


Attachments: File config.json     File generate_sso_token.groovy     File pep-application-attributes.groovy     File pep_policy_attributes.json    
Issue Links:
Relates
is related to OPENIG-1666 Script migration: Use CHF blocking API Closed
is related to OPENIG-1667 Script migration: Use CHF non-blockin... Closed
Support Ticket IDs:
Sprint: OpenIG Sprint 80, OpenIG Sprint 102
Flagged:
Impediment

 Description   

Using groovy scripts to perform authentication on OpenAM-13.0.0, I get the error `Cannot execute script` with the following stack trace:

THU MAR 10 17:02:59 CET 2016 WARNING {ScriptableFilter}/handler/config/filters/0 --- Cannot execute script
THU MAR 10 17:02:59 CET 2016 WARNING {ScriptableFilter}/handler/config/filters/0 --- java.lang.Exception: java.lang.NoSuchMethodError: org.apache.xml.resolver.CatalogManager.setIgnoreMissingProperties(Z)V
# javax.script.ScriptException: java.lang.Exception: java.lang.NoSuchMethodError: org.apache.xml.resolver.CatalogManager.setIgnoreMissingProperties(Z)V
# 	at org.forgerock.openig.script.Script$GroovyImpl.run(Script.java:62)
# 	at org.forgerock.openig.script.Script.run(Script.java:245)
# 	at org.forgerock.openig.script.AbstractScriptableHeapObject.runScript(AbstractScriptableHeapObject.java:206)
# 	at org.forgerock.openig.filter.ScriptableFilter.filter(ScriptableFilter.java:58)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:55)
# 	at org.forgerock.openig.filter.Chain.handle(Chain.java:69)
# 	at org.forgerock.openig.decoration.baseuri.BaseUriHandler.handle(BaseUriHandler.java:79)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:57)
# 	at org.forgerock.openig.handler.router.NullResponseFilter.filter(NullResponseFilter.java:49)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:55)
# 	at org.forgerock.openig.filter.RuntimeExceptionFilter.filter(RuntimeExceptionFilter.java:56)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:55)
# 	at org.forgerock.openig.handler.router.Route.handle(Route.java:138)
# 	at org.forgerock.openig.handler.router.RouterHandler.handle(RouterHandler.java:283)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:57)
# 	at org.forgerock.http.routing.Router.handle(Router.java:92)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:57)
# 	at org.forgerock.http.filter.TransactionIdInboundFilter.filter(TransactionIdInboundFilter.java:60)
# 	at org.forgerock.http.handler.Chain.handle(Chain.java:55)
# 	at org.forgerock.http.servlet.HttpFrameworkServlet.service(HttpFrameworkServlet.java:222)
# 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
# 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
# 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
# 	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
# 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
# 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
# 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
# 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
# 	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
# 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
# 	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
# 	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:617)
# 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
# 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518)
# 	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091)
# 	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:668)
# 	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1521)
# 	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1478)
# 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
# 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
# 	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
# 	at java.lang.Thread.run(Thread.java:745)
# Caused by: java.lang.Exception: java.lang.NoSuchMethodError: org.apache.xml.resolver.CatalogManager.setIgnoreMissingProperties(Z)V
# 	... 42 more
# Caused by: java.lang.NoSuchMethodError: org.apache.xml.resolver.CatalogManager.setIgnoreMissingProperties(Z)V
# 	at groovyx.net.http.ParserRegistry.<clinit>(ParserRegistry.java:111)
# 	at groovyx.net.http.HTTPBuilder.<init>(HTTPBuilder.java:194)
# 	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
# 	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
# 	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
# 	at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
# 	at org.codehaus.groovy.reflection.CachedConstructor.invoke(CachedConstructor.java:77)
# 	at org.codehaus.groovy.runtime.callsite.ConstructorSite$ConstructorSiteNoUnwrapNoCoerce.callConstructor(ConstructorSite.java:102)
# 	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallConstructor(CallSiteArray.java:57)
# 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callConstructor(AbstractCallSite.java:182)
# 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callConstructor(AbstractCallSite.java:190)
# 	at generate_sso_token.run(generate_sso_token.groovy:32)
# 	at groovy.util.GroovyScriptEngine.run(GroovyScriptEngine.java:577)
# 	at org.forgerock.openig.script.Script$GroovyImpl.run(Script.java:58)
# 	... 41 more

Notice that the message is logged at the level WARNING. I would expect it to be logged as an ERROR.

Find attached the routes and scripts used when encountering this error.
Notice that the issue occurs in the script `generate_sso_token.groovy`

Other way to reproduce the issue, using PyForge (error occurs but is now expected):

python run-pybot.py -s policyenforcementfilter -f openig


 Comments   
Comment by Violette Roche Montane [ 10/Mar/16 ]

After investigation, this bug starts when we pushed OPENIG-509 Update to OpenAM 13 artifacts

Comment by Violette Roche Montane [ 11/Mar/16 ]

The error above happens when multiple versions of a class in the classpath are coexisting. This causes the NoClassDefFoundError.
It seems that the CatalogManager class used by the 'xml-resolver-1.2.jar' required by the HTTPBuilder API exists in multiple versions.
The HTTPBuilder is often in conflict when 'xerces' and 'jaxb-xjc' jars are used. (unfortunately OpenAM-13 uses both).

Comment by Guillaume Sauthier [ 11/Mar/16 ]

I've been looking at Groovy ClassLoading and it seems that they always ask parent first when loading class.
That means that, even if the groovy classloader has been filled with the appropriate jar files, they may not be used if a parent loader has the same class.

Comment by Guillaume Sauthier [ 26/Apr/16 ]

There is no easy general solution to this problem (it may even be tricky with OSGi ...)

Comment by Guillaume Sauthier [ 29/Aug/16 ]

The workaround is to not use CatalogManager or libraries that depends on it (like Groovy RESTClient).

Comment by Jean-Charles Deville [ 08/Nov/16 ]

Any new workaround ? (except asking user not to use CatalogManager or libraries that depends on it (like Groovy RESTClient) ?!

Comment by Guillaume Sauthier [ 05/Apr/17 ]

With OPENIG-1666, an article has been prepared to help for script migration to supported APIs

Comment by Jean-Charles Deville [ 11/Apr/17 ]

Release 5.0.0 (+cleanup):
Close issues that have been tagged with "Not a Defect" or "won't Fix"
Close issue that are now tested in automated tests

Generated at Sun Sep 27 06:51:55 UTC 2020 using Jira 7.13.12#713012-sha1:6e07c38070d5191bbf7353952ed38f111754533a.