Alfresco Web Client: Access Denied

[xwu]

I recently do a fresh installation of Alfresco Lab Stable 3.1 version. Alfresco Share runs ok, but the web-client gives more troubles.

As the first login to Alfresco web client might be ok after the restart of Alfresco, the problem is that once I logout, close the web-browser, and try to re-login, I got the following error,

org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied. You do not have the appropriate permissions to perform this operation.
caused by:
net.sf.acegisecurity.AccessDeniedException: Access is denied.

I used both Firefox and Safari, and cleared all the caches/cookies within these browers, but I still got the same error. I do notice that when I try to open

http://company.com:8080/alfresco

it automatically becomes

http://company.com:8080/alfresco/faces/jsp/dashboards/container.jsp

I guess something wrong in the logout process related to some configuration mistake, but have no idea how to correct. Below is the log in the file "host-manager.2009-x-xx.log".

Jun 30, 2009 12:29:54 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet Faces Servlet threw exception
org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied.  You do not have the appropriate permissions to perform this operation.
        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:53)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:275)
        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        at $Proxy7.hasAspect(Unknown Source)
        at org.alfresco.web.bean.repository.User$1.execute(User.java:231)
        at org.alfresco.web.bean.repository.User$1.execute(User.java:227)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:320)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:227)
        at org.alfresco.web.bean.repository.User.getUserPreferencesRef(User.java:224)
        at org.alfresco.web.bean.repository.User.getPreferences(User.java:193)
        at org.alfresco.web.bean.repository.PreferencesService.getPreferences(PreferencesService.java:61)
        at org.alfresco.web.bean.repository.PreferencesService.getPreferences(PreferencesService.java:51)
        at org.alfresco.web.bean.users.UserPreferencesBean.getContentFilterLanguage(UserPreferencesBean.java:122)
        at org.alfresco.web.app.servlet.AuthenticationHelper.authenticate(AuthenticationHelper.java:250)
        at org.alfresco.web.app.servlet.AuthenticationHelper.authenticate(AuthenticationHelper.java:106)
        at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:75)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
        at java.lang.Thread.run(Thread.java:619)
Caused by: net.sf.acegisecurity.AccessDeniedException: Access is denied.
        at net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.java:86)
        at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:394)
        at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
        … 32 more

Any suggestion is greatly appreciated.
Brett

[jayjayecl]

WHat happens when you try to reach http://company.com:8080/alfresco/faces/jsp/login.jsp ?

[xwu]

Thanks for your reply. It generates another kind of error

javax.faces.FacesException: javax.faces.el.EvaluationException: Cannot get value for expression '#{UserPreferencesBean.language}'
caused by:
org.apache.jasper.JasperException: javax.faces.el.EvaluationException: Cannot get value for expression '#{UserPreferencesBean.language}'
caused by:
javax.faces.el.EvaluationException: Cannot get value for expression '#{UserPreferencesBean.language}'
caused by:
javax.faces.el.EvaluationException: Exception getting value of property language of base of type : org.alfresco.web.bean.users.UserPreferencesBean
caused by:
javax.faces.el.EvaluationException: Bean: org.alfresco.web.bean.users.UserPreferencesBean, property: language
caused by:
java.lang.reflect.InvocationTargetException
caused by:
org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied. You do not have the appropriate permissions to perform this operation.
caused by:
net.sf.acegisecurity.AccessDeniedException: Access is denied.

Wired thing is that Alfresco Share works flawlessly…

[jayjayecl]

Hi,
- stop Alfresco
- clear tomcat/work/Catalina/localhost folder
- retry

and tell us if the error remains

[xwu]

thanks for the help. I followed your suggestions, and after Alfresco started, I still got the same error that when I visited

http://company.com:8080/alfresco

the page automatically became

http://company.com:8080/alfresco/faces/jsp/dashboards/container.jsp

and thus, I got the error message as

Jul 6, 2009 4:03:40 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet Faces Servlet threw exception
org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied.  You do not have the appropriate permissions to perform this operation.
        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:53)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:275)
        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        at $Proxy7.hasAspect(Unknown Source)
        at org.alfresco.web.bean.repository.User$1.execute(User.java:231)
        at org.alfresco.web.bean.repository.User$1.execute(User.java:227)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:320)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:227)
        at org.alfresco.web.bean.repository.User.getUserPreferencesRef(User.java:224)
        at org.alfresco.web.bean.repository.User.getPreferences(User.java:206)
        at org.alfresco.web.bean.repository.PreferencesService.getPreferences(PreferencesService.java:71)
        at org.alfresco.web.app.Application.getLanguage(Application.java:688)
        at org.alfresco.web.app.servlet.AuthenticationHelper.authenticate(AuthenticationHelper.java:246)
        at org.alfresco.web.app.servlet.AuthenticationHelper.authenticate(AuthenticationHelper.java:106)
        at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:75)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
        at java.lang.Thread.run(Thread.java:619)
Caused by: net.sf.acegisecurity.AccessDeniedException: Access is denied.
        at net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.java:86)
        at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:394)
        at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
        … 31 more

Any other suggestions?

[jayjayecl]

Have you changed web.xml ?

Do you have Community (=Labs) or Enterprise Version ?

[xwu]

nope. "web.xml" has never been edited since the installation. And we use Alfresco Lab 3.1 final. thanks

[davidrfoote]

I encountered the same situation with Alfresco Community 3.2 (upgraded from community 2.9). I can login and authenticate correctly with Share, but not with web-client.

Message as follows: prior to seeing a login dialog.
org.alfresco.repo.security.permissions.AccessDeniedException: 09030006 Access Denied. You do not have the appropriate permissions to perform this operation.
caused by:
net.sf.acegisecurity.AccessDeniedException: Access is denied.


——
I cleared /tomcat6/work/Catalina/localhost and restarted, no difference.

I also have not changed web.xml from defaults.

[dward]

Are you seeing this message in the logs while tomcat is starting up? If so, undeploy the studio application.

Do you have any custom spring configuration? If so, what?

[davidrfoote]

Studio is not installed. Also the message is shown on the /alfresco login page prior to any login option. This does not happen on /share.

It is  also intermittent, inconsistent between users, and between tomcat restarts.

No custom spring configurations aside from google app gmail configuration. But this occurs with or without that configuration enabled.

We did also have some user login corruption on the upgrade from 2.9 windows to 3.2 linux. These are mostly addressed by upgrading to the 3.2 9-29-09 nightly dev build.