Spring security

Support
#1

Hello,

we are having troubles starting our application after installing the rest-api-addon.
See the atached stacktrace.app_20201020_trim.log (80.9 KB)
The used Java-Version is

openjdk version “1.8.0_252”
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_252-b09)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.252-b09, mixed mode)

The Tomcat used is

Installed version : 9.0.34

We are not sure why this Problem ocurs. Does anybody have had a similiar problem?

Greetings
Paul

#3

Hi, @paul.blak

Could you please tell, which CUBA version do you use?
I have a suggestion that the problem can be related to the spring-security version used in your project. So upgrading CUBA to the latest 7.2.9 can probably solve this.

Regards,
Gleb

#5

Hi @shalyganov,

could you specify what the problem is? We tried to simulate the error on our machine, the error descriped is occouring on our clients server.
I am not able to reproduce the error at this time.
Yes, we war on an older Version of CUBA on 7.2.5 to be specific, but before upgrading to the next version i would like to reproduce the error.

Thanks
Paul

#6

Hi, @paul.blak

The problem comes from the bug which was introduced in Spring 5.2. It only occurs when starting the application without internet access. This bug was fixed in Spring Security 5.2.2+.
CUBA and REST API add-on 7.2.5 use Spring Security 5.2.1 which has this bug.
But in 7.2.9 version Spring Security was upgraded to 5.2.6 in which this bug is already fixed.

Regards,
Gleb

1 Like
#7

Hi @shalyganov,

thanks for the response. That acutally explains everything.
We will uprade to the new versions.

Thank you and have a great week.
Paul

1 Like
#8

Hey @shalyganov,

we upgraded the versions but we still seem to have the problem.
FYI We also have the cuba-saml-addon in there, could this be the same issue?
The error looks like this:saml-stack.txt (81.6 KB)

Greetings
Paul

#12

Hi, Paul

Seems like there was a little mistake from my side. Spring-security was upgraded in Cuba 7.2.9 but cuba-web does not use it as a dependency. And the latest REST add-on version still depends on Spring Security 5.2.1.
So the solution for you will be to explicitly add these dependencies to your project. It can be done in the build.gradle file.

First, add CUBA’s bom configuration.


buildscript {
    ext.cubaVersion = '7.2.9'
    ...
}

configurations {
    bom
}

dependencies {
    bom("com.haulmont.cuba:cuba-global:$cubaVersion")
}

Then add spring-security dependencies to web-module:

configure(webModule) {
    ...

    dependencies {
        ...

        compile(bom['org.springframework.security:spring-security-core'])
        compile(bom['org.springframework.security:spring-security-web'])
        compile(bom['org.springframework.security:spring-security-config'])
    }

BOM manages the dependencies versions used in CUBA. So by adding it, you will always get the actual versions of the dependencies used in the corresponding CUBA version.

Regards,
Gleb

1 Like
#13

Hello Gleb,

thanks for the reply. I tried to include the configs you posted, but something is wrong with them. When i add them as you described i get

only buildscript {} and other plugins {} script blocks are allowed before plugins {} blocks, no other statements are allowed

when i try to include them in any other position i get

Could not find method bom() for arguments [com.haulmont.cuba:cuba-global:7.2.9] on object of type org.gradle.api.internal.artifacts.dsl.dependencies.DefaultDependencyHandler

I think i might be missing something.

Greetings
Paul

#14

@paul.blak, please make sure to put these blocks:

configurations {
    bom
}

dependencies {
    bom("com.haulmont.cuba:cuba-global:$cubaVersion")
}

right after buildscript and all plugins blocks, but before this line:
apply(plugin: 'cuba')

Regards,
Gleb

2 Likes
#15

Gleb, thank you very much for your help.
I didnt’ think the order would break the build.
It worked now and i think this is the solution for our problem.

1 Like