Security Authenticate Error FreeMarker Template Merge

[nyronian]

About a week ago I started to get "Authentication" Errors while calling the template merger:

http://localhost:8080/alfresco/template/?templatePath=....

What is odd is it will work about half the time.  I will attempt the page, it will give the error.  I do a ctrl-F5 3-4 times and it will work.  It works for a while then stops working….I refresh a few times and it works.  That is with no changes to code.

I am calling the URL From a servlet I created.  At first, I was connecting and retreiving a ticket.  I started to get the error.  I then removed the ticket and opened the template up to "guest" access and sent guest=true as a parameter.  The behavior stayed the same. 

Below is the exception I recieve when I call the template URL.  I tried to shorten it up a bit showing the full thread.  If you need more, let me know.

16:53:04,093 ERROR [[localhost].[/alfresco].[templateContent]] Servlet.service()
 for servlet templateContent threw exception
org.alfresco.error.AlfrescoRuntimeException: Error during template servlet processing: IO Error during processing of the template 'workspace://SpacesStore/0646a58e-0a40-11dc-8d85-e5e68ca42e13'. 
Please contact your system administrator. at org.alfresco.web.app.servlet.BaseTemplateContentServlet.processTempla
teRequest(BaseTemplateContentServlet.java:264)    
at org.alfresco.web.app.servlet.TemplateContentServlet.service(TemplateContentServlet.java:117)     
at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
….
Caused by: org.alfresco.service.cmr.repository.TemplateException: IO Error during processing of the template 'workspace://SpacesStore/0646a58e-0a40-11dc-8d85-e5
e68ca42e13'. Please contact your system administrator.
        at com.tlhc.wc.web.template.WCFreeMarkerProcessor.process(WCFreeMarkerProcessor.java:158)
        at org.alfresco.repo.template.TemplateServiceImpl.processTemplate(TemplateServiceImpl.java:115)
….
Caused by: net.sf.acegisecurity.BadCredentialsException: Bad credentials presented
        at net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider.getUserF
romBackend(DaoAuthenticationProvider.java:393)
        at net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider.authenti
cate(DaoAuthenticationProvider.java:225)
        at net.sf.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:159)
        at net.sf.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:49)
        at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvo
cation(AbstractSecurityInterceptor.java:372)
        at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInter
ceptor.invoke(MethodSecurityInterceptor.java:77)

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

One item to note is that I extended the FreeMarkerProcessor to add data to the model.  I don't beleive it is causing any problems.  And again….a few ctrl-F5 on my browser and it will eventually work….just nobody seems to be ok with that…. :wink:

Thank you for your help.

[nyronian]

Does anybody know this?  Why would I continually get "Bad Permissions"  for templates that have guest access and I pass in "guest=true".  I also get it when I pass in a valid ticket.  I can't seem to win on this one and not sure where to go with it.

I'm about to be killed in a demo tomorrow morning 

[kevinr]

You are probably best using a ticket if possible - as the Guest user will need access to the Template and all objects that it touches during processing to avoid the Access Denied exceptions.

You indicate that it "used to work" and then stopped working correctly. Something must have changed in your setup - i.e. what data the template touches, the permissions on folders, user permissions or something similar.

Thanks,

Kevin

[nyronian]

I agree…the "Used to work" implies something changed, the problem is, I don't know what…I have done about a months worth of work since it started and didn't see it as an issue when it first started….figured it would go away and was not a priority when it first started….now I don't know what changed when it started.

I get the same result when using a ticket with admin priviliges.  What is odd is that with a few refreshes it goes away….at least for while.

Another, possibility related odity is that I get similar behavior with CIFS…that is, I try to login with admin and it prompts me several times before working….I just try it 3-4 times and then it authenticates and lets me in….

[kevinr]

Sounds like it's going to be a little tricky to diagnose

It's an odd error - "Bad credentials" suggests that the ticket is out-of-date. If the admin user is having the problem then that rules out permissions as the problem - as the admin user will bypass all permission checks. How are you generating the ticket? One other thing - we have recently added "no-cache" headers to the template servlet output - it is possible that you are seeing cached output which is why a Refresh in the browser causes it to work…

FYI the CIFS issue is a windows authentication issue usual - it tends to see a race condition between two types of windows authentication mechanism - but i thought that was supposed to have been fixed in 2.0 (i could be wrong) - are you using 1.4 or 2.0? It's definitely not related to your other problem though.

Thanks,

Kevin

[finner]

Hi,
Did you get a resolution for this ? I have something similar.
I access a document using a url something like
http://serverort/alfresco/d/d/workspace/SpacesStore/nnnnnnnnnnnn/RSS_2.0_recent_docs.ftl?userSession...
and authenticate the against an external database using the userSessionId parameter.
This is ok, but when, in the same browser session, I cut the url down to http://serverort/alfresco and press return I get bad Credentials and when I refresh I see the dashboard.

BUT on localhost I don't get the bad credentials exception and I see the dashboard.

What's worrying me is that it always throws the Bad Credentials on the server and only once in a while (nearly never but it does pop up) on localhost

Any ideas ?
Thanks
Finner

[kevinr]

I'm not sure to be honest - does it do this in 2.1?

Kevin

[finner]

Hi Kevin,
Yes, I'm running 2.1 Community.