topic Re: Transaction must be active and synchronization is required in Alfresco Archive

Transaction must be active and synchronization is required

mliedtke — Fri, 22 Feb 2008 17:14:45 GMT

Hi,I'm getting an error when trying to deploy a webscript in liferay. I'm using LifeRay 4.4.1 with Alfresco 2.1.1 deployed as a portlet on JBoss 4.2, and when I include any of the out of the box WebScrips portlets I get the following error.The Web Script /alfresco/168s/ui/myspaces has responded wit

Re: Transaction must be active and synchronization is required

mliedtke — Mon, 25 Feb 2008 18:51:37 GMT

I started pulling apart the code, and there seems to be an issue with the authenticator "org.alfresco.web.scripts.portlet.WebClientPortletAuthenticator".

It's able to find the user on the request, and appears to be authenticating the user ok, but then when it attempts to get a NodeRef for the person object it craps out.

It looks like the last part of the authenticator where it puts the user object on the session is ( in the methog createWebClientUser(PortletSession session) ) is crapping out.

If anyone has any ideas, please write back, I'm lost
:?:

Re: Transaction must be active and synchronization is required

mliedtke — Mon, 25 Feb 2008 19:14:45 GMT

A little more info…

More specifically it looks like the issue is with PersonServiceImpl.getPersonOrNul(user)

As far as I can tell it's getting a Null Pointer when trying to perform a search for the user…It looks like the SearchService is null, so when it tries to query the user it is crapping out….

Any clues?

Re: Transaction must be active and synchronization is required

mliedtke — Tue, 26 Feb 2008 17:31:20 GMT

Well Some more info…I'm hoping someone will be able to help…

It looks like the scriptContext (org.alfresco.web.scripts.context.WebScriptContext) that is included in the WebClientPortletAuthenticator is not fully initialized or something…

I've looked at it, and it seems like any call against it (except toString like calls) are causing this error. To me it seems like the services used by this bean are not properly set or something.

I got nothing here…Please help :?

Re: Transaction must be active and synchronization is required

pmonks — Tue, 26 Feb 2008 19:24:16 GMT

Is this a standard installation of Alfresco, or are you trying to embed it in your own application?

If the former, the symptoms you're describing sound like a basic problem with the installation which are probably most easily corrected by installing again from scratch.

Re: Transaction must be active and synchronization is required

lucien2046 — Wed, 27 Feb 2008 16:13:14 GMT

I have the same problem with Alfresco 2.9B and Liferay 4.4.1. Haven't been able to figure out what it is yet …

Re: Transaction must be active and synchronization is required

lucien2046 — Wed, 27 Feb 2008 16:28:26 GMT

Seems there was an issue in 2.1.1E that was fixed in 2.1.2E:
http://issues.alfresco.com/browse/AWC-1686

The fix may not have made it into 2.9B

Re: Transaction must be active and synchronization is required

mliedtke — Wed, 27 Feb 2008 16:49:54 GMT

Excellent, thanks for finding this.

Yesterday (actually the last 3 days) I ended up re-writing the Auth Handler WebClientPortletAuthenticator to bypass using the scriptContext to get the person, and directly get the PersonService bean from the application context. This was a little goofy though because it was a little tricky to get the app context from the portlet context. I ended up needing to use PortletApplicaitonContextUtils in the spring-portlet.jar to get the application context from the portlet context. Its a bit of a cludge, but it's getting me moving until the fix gets pushed.

Re: Transaction must be active and synchronization is required

mliedtke — Fri, 29 Feb 2008 17:25:55 GMT

here's the class code i created…It's kind of messy, and requires adding spring-portlet.jar


/*
 * Bassed off of org.alfresco.web.scripts.portlet.WebClientPortletAuthenticator
 * 
 * Sets and gets the Authenticated user directly off the session rather then the
 * application scope of the session.
 * 
 * 
 */
package com.tca.authentication;

import javax.portlet.PortletSession;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;

import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.repository.User;
import org.alfresco.web.scripts.WebScriptContext;
import org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

// TCA Added
import javax.portlet.PortletContext;

import org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator;
import org.alfresco.web.scripts.portlet.WebScriptPortletRequest;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.service.cmr.repository.NodeService;

import org.springframework.context.ApplicationContext;
import org.springframework.web.portlet.context.PortletApplicationContextUtils;



/**
 * Portlet authenticator which synchronizes with the Alfresco Web Client authentication
 * 
 * @author davidc
 */
public class WebClientPortletAuthenticator implements WebScriptPortletAuthenticator
{
    // Logger
    private static final Log logger = LogFactory.getLog(WebClientPortletAuthenticator.class);

    // dependencies
    private AuthenticationService authenticationService;
    private WebScriptContext scriptContext;
      
    /**
     * @param authenticationService
     */
    public void setAuthenticationService(AuthenticationService authenticationService)
    {
        this.authenticationService = authenticationService;
    }
    
    /**
     * @param scriptContext
     */
    public void setScriptContext(WebScriptContext scriptContext)
    {
        this.scriptContext = scriptContext;
    }
    
    /* (non-Javadoc)
     * @see org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator#authenticate(org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication, boolean, javax.portlet.RenderRequest, javax.portlet.RenderResponse)
     */
    public boolean authenticate(RequiredAuthentication required, boolean isGuest, RenderRequest req, RenderResponse res)
    {
       logger.debug("Starting authenticate - RequiredAuthentication: " + required + " - isGuest: " + isGuest);
       logger.debug("Using authentication service: " +authenticationService);
       
       
       PortletSession session = req.getPortletSession();
        
        // first look for the username key in the session - we add this by hand for some portals
        // when the WebScriptPortletRequest is created
        String portalUser = (String)req.getPortletSession().getAttribute(WebScriptPortletRequest.ALFPORTLETUSERNAME);
        logger.debug("User Name from request: "+portalUser);
        
        if (portalUser == null)
        {
            portalUser = req.getRemoteUser();
            logger.debug("User Name from session: "+portalUser);
        }
        
        if (logger.isDebugEnabled())
        {   
            logger.debug("JSR-168 Remote user: " + portalUser);
        }
        
        if (isGuest || portalUser == null)
        {
            if (logger.isDebugEnabled())
                logger.debug("Authenticating as Guest");
            
            // authenticate as guest
            AuthenticationUtil.setCurrentUser(AuthenticationUtil.getGuestUserName());

            if (logger.isDebugEnabled())
                logger.debug("Setting Web Client authentication context for guest");
            
            createWebClientUser(session);
            removeSessionInvalidated(session);
        }
        else
        {
            if (logger.isDebugEnabled())
                logger.debug("Authenticating as user " + portalUser);
            
            AuthenticationUtil.setCurrentUser(portalUser);

            // determine if Web Client context needs to be updated
            User user = getWebClientUser(session);
            if (user == null || !portalUser.equals(user.getUserName()))
            {
                if (logger.isDebugEnabled())
                    logger.debug("Setting Web Client authentication context for user: " + portalUser);
                
                createWebClientUser(session);
                removeSessionInvalidated(session);
            }
        }
        
        return true;
    }

    /**
     * Helper.  Remove Web Client session invalidated flag
     * 
     * @param session
     */
    private void removeSessionInvalidated(PortletSession session)
    {
       if (logger.isDebugEnabled())
        {   
            logger.debug("Invalidating session:  " + AuthenticationHelper.SESSION_INVALIDATED);
        }
        //session.removeAttribute(AuthenticationHelper.SESSION_INVALIDATED, PortletSession.APPLICATION_SCOPE);
        session.removeAttribute(AuthenticationHelper.SESSION_INVALIDATED);
    }
    
    /**
     * Helper.  Create Web Client session user
     * 
     * @param session
     */
    private void createWebClientUser(PortletSession session)
    {
       try{
          String loginUser = authenticationService.getCurrentUserName();
          String loginTicket = authenticationService.getCurrentTicket();
          if (logger.isDebugEnabled())
           {   
               logger.debug("Starting createWebClientUser for user: " + loginUser + " and ticket " + loginTicket);
           }
                 
          PortletContext portletContext = session.getPortletContext();
          if (logger.isDebugEnabled())
             logger.debug("##portletContext " + portletContext);
          
          ApplicationContext appContext = PortletApplicationContextUtils.getRequiredWebApplicationContext(portletContext);
          if (logger.isDebugEnabled())
                logger.debug("##appContext " + appContext);
          
          PersonService personService = (PersonService)appContext.getBean("personService");
          if (logger.isDebugEnabled())
             logger.debug("##personService " + personService);
          
          NodeService nodeService = (NodeService)appContext.getBean("nodeService");
          if (logger.isDebugEnabled())
             logger.debug("##nodeService " + nodeService);
                    
           NodeRef personRef = personService.getPerson(loginUser);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully retrieved person reference: " + personRef);
           }
           
          User user = new User(loginUser, authenticationService.getCurrentTicket(), personRef);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully created the user: " + user);
               logger.debug("##Setting on session: " + session);
           }
           
          //session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user, PortletSession.APPLICATION_SCOPE);
          session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("Successfully set the user on the session ###");
           }
       }
       catch(Exception e)
       {

          logger.error("Error in createWebClientUser: " + e.toString());
          e.printStackTrace();

       }
    }
    
    /**
     * Helper.  Get Web Client session user
     * 
     * @param session
     * @return
     */
    private User getWebClientUser(PortletSession session)
    {
       if (logger.isDebugEnabled())
        {   
            logger.debug("Getting the user from the session:  " + AuthenticationHelper.AUTHENTICATION_USER);
        }
       /* Removed and get globally at the session 
        * return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER, PortletSession.APPLICATION_SCOPE);
        */
        //return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER, PortletSession.APPLICATION_SCOPE);
        return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER);
    }
    
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Transaction must be active and synchronization is required

dvignola — Fri, 27 Jun 2008 11:47:57 GMT

I have the same problem with Alfresco 2.9B and Liferay 4.4.1. Haven't been able to figure out what it is yet …

I'm trying to integrate Alfresco Community 2.9B in Liferay 5.0.1 and, sadly, I have encountered the same "Transaction must be active and synchronization is required" error using Alfresco Portlets.

Is there in this forum anyone that have just implemented some workaround to go ahed in the Alfresco-Liferay Integration? I think about some peudo-sso mechanisms that allow a Liferay logged user to access Alfresco portlet avoiding a second (Alfresco) login. No matter if is not the same logical user (a real user management integration between Liferay and Alfresco seems still far) but an Alfresco recognized (and granted) user is enough.

Thanks a lot for contribution

Davide Vignola

Re: Transaction must be active and synchronization is required

mliedtke — Fri, 27 Jun 2008 14:20:38 GMT

I was able to get it working (Alf 2.1.? com & Liferay 5.0.?) with the updated auth code…provided earlier in the post, but ended up taking a different root.

I ended up implementing CAS for auth, and it has worked out very well…I used the version posed on the Liferay site (too lazy to check what version), then decided to use an Iframe portlet to access alfresco webscripts. I really didn't want to use CAS at first, but then decided that it was kind of clunky to work in the full alfresco client in a portlet in liferay. When I decided to move away from "full" integration, CAS became a good option. Also CAS ended up being really easy to set up, and it's integration with AD is really good.

I created 2 webscripts. One is a doc list portlet for displaying the contents of a folder in a "narrow" column portlet. The second is a my spaces portlet (a modified version of the OOTB alfresco my spaces portlet). I use them as the primary interaction between, then I provide links to the full alfresco client; since I'm using CAS there is a seamless sign on process. Also by using the iFrame solution, there is quite a bit less load on the Liferay server/process, allowing interaction with alfresco through the portlets to be super quick.

At this point our solution is still in the proof of concept process, but I have presented it to the CIO of my company and several members of senior leadership, and they're all pretty happy with it, and now we're looking for capital and time to fully implement.

Re: Transaction must be active and synchronization is required

dvignola — Fri, 27 Jun 2008 15:58:45 GMT

First of all, Thanks for your replay.

I don't understand very well if the solution that you decided to follow needs the CAS integration or not. Maybe my english undersanting is not too much accurate…

But I'll investigate about CAS+Alfresco+Liferay (is the cignex one??) for sure. Thanks

Davide

Re: Transaction must be active and synchronization is required

mliedtke — Fri, 27 Jun 2008 16:20:10 GMT

Not a problem, glad if I can help.

I actually did not use the Cignex solution…but am looking into what they did, so see if there a pieces we could use.

As far as CAS, you shouldn't need it if your access Alfresco as a strict JSR-168 portlet (but there are issues because issues with Alfreco's auth code). But by adding in CAS, you do gain quite a bit, by adding the ability to access alfresco directly (not as a portlet), or hit a webscript directly. Take a look at CAS, it's a pretty good product, and not that hard to get running.

Re: Transaction must be active and synchronization is required

ericc — Tue, 19 Aug 2008 12:36:49 GMT

Sorry to come back from the dead this topic.
I try to have Alfresco 2.9b working with a Liferay 5.1

I followed this tutorial : http://www.optaros.com/blogs/running-alfresco-web-scripts-liferay-portlets (with some change because we are on Liferay 5.1).
All works fine (I have my portlet available on menu) but when I add it to liferay I have the "Transaction must be active and synchronization is required" error mentioned in this topic.
I don't need CAS authentification but the JSR-168 mechanism so the code put by mliedtke interest me much but I don't know how to make it work.

I copy/paste the code, adapt the package name, add the spring jar used but I always have non resolved import for :
import org.alfresco.web.scripts.WebScriptContext;
import org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication;
import org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator;

And I don't found in Alfresco's source code this file…
So complety lost in this bug and any help will be welcome.

Thanks.

here's the class code i created…It's kind of messy, and requires adding spring-portlet.jar


/*
 * Bassed off of org.alfresco.web.scripts.portlet.WebClientPortletAuthenticator
 * 
 * Sets and gets the Authenticated user directly off the session rather then the
 * application scope of the session.
 * 
 * 
 */
package com.tca.authentication;

import javax.portlet.PortletSession;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;

import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.repository.User;
import org.alfresco.web.scripts.WebScriptContext;
import org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

// TCA Added
import javax.portlet.PortletContext;

import org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator;
import org.alfresco.web.scripts.portlet.WebScriptPortletRequest;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.service.cmr.repository.NodeService;

import org.springframework.context.ApplicationContext;
import org.springframework.web.portlet.context.PortletApplicationContextUtils;



/**
 * Portlet authenticator which synchronizes with the Alfresco Web Client authentication
 * 
 * @author davidc
 */
public class WebClientPortletAuthenticator implements WebScriptPortletAuthenticator
{
    // Logger
    private static final Log logger = LogFactory.getLog(WebClientPortletAuthenticator.class);

    // dependencies
    private AuthenticationService authenticationService;
    private WebScriptContext scriptContext;
      
    /**
     * @param authenticationService
     */
    public void setAuthenticationService(AuthenticationService authenticationService)
    {
        this.authenticationService = authenticationService;
    }
    
    /**
     * @param scriptContext
     */
    public void setScriptContext(WebScriptContext scriptContext)
    {
        this.scriptContext = scriptContext;
    }
    
    /* (non-Javadoc)
     * @see org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator#authenticate(org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication, boolean, javax.portlet.RenderRequest, javax.portlet.RenderResponse)
     */
    public boolean authenticate(RequiredAuthentication required, boolean isGuest, RenderRequest req, RenderResponse res)
    {
       logger.debug("Starting authenticate - RequiredAuthentication: " + required + " - isGuest: " + isGuest);
       logger.debug("Using authentication service: " +authenticationService);
       
       
       PortletSession session = req.getPortletSession();
        
        // first look for the username key in the session - we add this by hand for some portals
        // when the WebScriptPortletRequest is created
        String portalUser = (String)req.getPortletSession().getAttribute(WebScriptPortletRequest.ALFPORTLETUSERNAME);
        logger.debug("User Name from request: "+portalUser);
        
        if (portalUser == null)
        {
            portalUser = req.getRemoteUser();
            logger.debug("User Name from session: "+portalUser);
        }
        
        if (logger.isDebugEnabled())
        {   
            logger.debug("JSR-168 Remote user: " + portalUser);
        }
        
        if (isGuest || portalUser == null)
        {
            if (logger.isDebugEnabled())
                logger.debug("Authenticating as Guest");
            
            // authenticate as guest
            AuthenticationUtil.setCurrentUser(AuthenticationUtil.getGuestUserName());

            if (logger.isDebugEnabled())
                logger.debug("Setting Web Client authentication context for guest");
            
            createWebClientUser(session);
            removeSessionInvalidated(session);
        }
        else
        {
            if (logger.isDebugEnabled())
                logger.debug("Authenticating as user " + portalUser);
            
            AuthenticationUtil.setCurrentUser(portalUser);

            // determine if Web Client context needs to be updated
            User user = getWebClientUser(session);
            if (user == null || !portalUser.equals(user.getUserName()))
            {
                if (logger.isDebugEnabled())
                    logger.debug("Setting Web Client authentication context for user: " + portalUser);
                
                createWebClientUser(session);
                removeSessionInvalidated(session);
            }
        }
        
        return true;
    }

    /**
     * Helper.  Remove Web Client session invalidated flag
     * 
     * @param session
     */
    private void removeSessionInvalidated(PortletSession session)
    {
       if (logger.isDebugEnabled())
        {   
            logger.debug("Invalidating session:  " + AuthenticationHelper.SESSION_INVALIDATED);
        }
        //session.removeAttribute(AuthenticationHelper.SESSION_INVALIDATED, PortletSession.APPLICATION_SCOPE);
        session.removeAttribute(AuthenticationHelper.SESSION_INVALIDATED);
    }
    
    /**
     * Helper.  Create Web Client session user
     * 
     * @param session
     */
    private void createWebClientUser(PortletSession session)
    {
       try{
          String loginUser = authenticationService.getCurrentUserName();
          String loginTicket = authenticationService.getCurrentTicket();
          if (logger.isDebugEnabled())
           {   
               logger.debug("Starting createWebClientUser for user: " + loginUser + " and ticket " + loginTicket);
           }
                 
          PortletContext portletContext = session.getPortletContext();
          if (logger.isDebugEnabled())
             logger.debug("##portletContext " + portletContext);
          
          ApplicationContext appContext = PortletApplicationContextUtils.getRequiredWebApplicationContext(portletContext);
          if (logger.isDebugEnabled())
                logger.debug("##appContext " + appContext);
          
          PersonService personService = (PersonService)appContext.getBean("personService");
          if (logger.isDebugEnabled())
             logger.debug("##personService " + personService);
          
          NodeService nodeService = (NodeService)appContext.getBean("nodeService");
          if (logger.isDebugEnabled())
             logger.debug("##nodeService " + nodeService);
                    
           NodeRef personRef = personService.getPerson(loginUser);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully retrieved person reference: " + personRef);
           }
           
          User user = new User(loginUser, authenticationService.getCurrentTicket(), personRef);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully created the user: " + user);
               logger.debug("##Setting on session: " + session);
           }
           
          //session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user, PortletSession.APPLICATION_SCOPE);
          session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);
           
          if (logger.isDebugEnabled())
           {   
               logger.debug("Successfully set the user on the session ###");
           }
       }
       catch(Exception e)
       {

          logger.error("Error in createWebClientUser: " + e.toString());
          e.printStackTrace();

       }
    }
    
    /**
     * Helper.  Get Web Client session user
     * 
     * @param session
     * @return
     */
    private User getWebClientUser(PortletSession session)
    {
       if (logger.isDebugEnabled())
        {   
            logger.debug("Getting the user from the session:  " + AuthenticationHelper.AUTHENTICATION_USER);
        }
       /* Removed and get globally at the session 
        * return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER, PortletSession.APPLICATION_SCOPE);
        */
        //return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER, PortletSession.APPLICATION_SCOPE);
        return (User)session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER);
    }
    
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Transaction must be active and synchronization is required

mliedtke — Tue, 19 Aug 2008 15:39:38 GMT

It's been quite some time since I've looked at that solution I posted since I decided to implement CAS. Based on what you posted

I always have non resolved import for :
import org.alfresco.web.scripts.WebScriptContext;
import org.alfresco.web.scripts.WebScriptDescription.RequiredAuthentication;
import org.alfresco.web.scripts.portlet.WebScriptPortletAuthenticator;

One thing to note is I started with the class org.alfresco.web.scripts.portlet.WebClientPortletAuthenticator from 2.0.1, and since 2.9 is really a 3.0 beta, I'm guessing that there are some significant auth changes. You may want to grab the WebClientPortletAuthenticator from the 2.9 code base, and apply my changes to that. The main piece of code that you may want to look at is where it gets the user and sets it on the session.
I think that this is the main section of code that you may want to look at.


          PortletContext portletContext = session.getPortletContext();
          if (logger.isDebugEnabled())
             logger.debug("##portletContext " + portletContext);
          
          ApplicationContext appContext = PortletApplicationContextUtils.getRequiredWebApplicationContext(portletContext);
          if (logger.isDebugEnabled())
                logger.debug("##appContext " + appContext);
          
          PersonService personService = (PersonService)appContext.getBean("personService");
          if (logger.isDebugEnabled())
             logger.debug("##personService " + personService);
          
          NodeService nodeService = (NodeService)appContext.getBean("nodeService");
          if (logger.isDebugEnabled())
             logger.debug("##nodeService " + nodeService);
                    
           NodeRef personRef = personService.getPerson(loginUser);
          
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully retrieved person reference: " + personRef);
           }
          
          User user = new User(loginUser, authenticationService.getCurrentTicket(), personRef);
          
          if (logger.isDebugEnabled())
           {   
               logger.debug("##Successfully created the user: " + user);
               logger.debug("##Setting on session: " + session);
           }
          
          //session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user, PortletSession.APPLICATION_SCOPE);
          session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Good Luck!