A valid SecureContext was not provided when using SiteServic

[amitev]

Hi. I when I call SiteService to get the site for a specific node, I get the following exception:

Caused by: net.sf.acegisecurity.AuthenticationCredentialsNotFoundException: A valid SecureContext was not provided in the RequestContext
   at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:477)
   at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:355)
   at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:44)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.audit.AuditMethodInterceptor.proceed(AuditMethodInterceptor.java:160)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:137)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:44)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.audit.AuditMethodInterceptor.proceedWithAudit(AuditMethodInterceptor.java:217)
   at org.alfresco.repo.audit.AuditMethodInterceptor.proceed(AuditMethodInterceptor.java:184)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:137)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy7.getType(Unknown Source)
   at org.alfresco.repo.site.SiteServiceImpl.getSiteNodeRef(SiteServiceImpl.java:944)
   at org.alfresco.repo.site.SiteServiceImpl.getSite(SiteServiceImpl.java:926)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

It is strange because I'm logged in as admin. Idea what I'm doing wrong?

[mrogers]

Not without more information…  :?

What's calling the site service and how is it being done.

[andy]

Hi

Which version of Alfresco are you using?

This means a publc service method has been called that does not have any security definition.
The next call actually blows up ….

Later versions of Alfresco have a catch all definition to avoid this.Something like

org.alfresco.service.cmr.repository.NodeService.*=ACL_DENY‍

in public-services-security-context.xml.

Please provide the stack trace.

Andy

[amitev]

It was thrown in a webscript (child of DeclarativeWebScript).
Looks like <authentication>user</authentication> tag was missing in the desc.xml. Now it's working. Thank you very much for the help!

[amitev]

It would be useful if Alfresco provides a more specific exception messages to help developers quickly solve their problems.

[mrogers]

Indeed, but the way to do this is to raise enhancement requests in JIRA or submit a contribution yourself.     And please be specific, raising a vague wide ranging requests will not help.

In this specific case the exception message is probably as good as it can get since the secutity service does not know why there is no security context.   But if you have suggestions on how it can be improved then please raise in JIRA.

[andy]

Hi

This kind of stuff will get fixed when we move/upgrade to SpringSecurity. Until then there is not much point.
It is not possible to wrap this exception for all use cases.
However, not authenticating and calling a puiblic service should porbably throw something better.


Andy