CMIS getRepositories exception

[pnature]

Hi.

I am trying to call Alfresco CMIS SOAP API. For start I try using SoapUI. I use basic authentication. Atom REST API in SoapUI works fine but with SOAP I get this error

request

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://docs.oasis-open.org/ns/cmis/messaging/200908/">
   <soapenv:Header/>
   <soapenv:Body>
      <ns:getRepositories/>
   </soapenv:Body>
</soapenv:Envelope>

response

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
   <soap:Body>
      <soap:Fault>
         <faultcode>soaperver</faultcode>
         <faultstring>Fault occurred while processing.</faultstring>
         <detail>
            <cmisFault xmlns:ns2="http://docs.oasis-open.org/ns/cmis/core/200908/" xmlns="http://docs.oasis-open.org/ns/cmis/messaging/200908/">
               <type>runtime</type>
               <code>0</code>
            </cmisFault>
         </detail>
      </soap:Fault>
   </soap:Body>
</soap:Envelope>

In log is

2017-12-05 16:30:39,156  ERROR [extensions.webscripts.AbstractRuntime] [http-apr-8080-exec-8] Exception from executeScript: 11050011 Wrapped Exception (with status template): 11050380 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/collaboration/tagQuery.get.js': 11050379 Access Denied.  You
 do not have the appropriate permissions to perform this operation.
 org.springframework.extensions.webscripts.WebScriptException: 11050011 Wrapped Exception (with status template): 11050380 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/collaboration/tagQuery.get.js': 11050379 Access Denied.  You do not have the appropriate permissions to perform this operation.

Catalina.log

2017-12-09 07:24:15,146  ERROR [impl.webservices.AbstractService] [ajp-apr-8009-exec-10]
 org.apache.chemistry.opencmis.commons.exceptions.CmisRuntimeException
        at org.alfresco.opencmis.AlfrescoCmisExceptionInterceptor.invoke(AlfrescoCmisExceptionInterceptor.java:106)

...

Caused by: java.lang.NullPointerException
        at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:187)
        at com.google.common.cache.LocalCache.getIfPresent(LocalCache.java:3953)
        at com.google.common.cache.LocalCache$LocalManualCache.getIfPresent(LocalCache.java:4758)
        at org.alfresco.repo.cache.DefaultSimpleCache.get(DefaultSimpleCache.java:133)
        at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.isUserProtected(AuthenticationServiceImpl.java:151)
        at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.authenticate(AuthenticationServiceImpl.java:114)
        at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:202)
        at org.alfresco.opencmis.AlfrescoCmisServiceImpl.beforeCall(AlfrescoCmisServiceImpl.java:3221)
        at org.alfresco.opencmis.AlfrescoCmisServiceInterceptor.invoke(AlfrescoCmisServiceInterceptor.java:95)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
        at org.alfresco.opencmis.AlfrescoCmisExceptionInterceptor.invoke(AlfrescoCmisExceptionInterceptor.java:90)

What is a problem?

Thanks in advance.

[afaust]

The tagQuery.get.js message in the logs doesn't have anything to do with CMIS operations. What is the CMIS endpoint URL that you tried to use? Do you have to use SOAP instead of the more modern / less verbose Browser binding?

[pnature]

Hi Axel.

Enpoint is https://my.alfresco.com/alfresco/cmisws/RepositoryService 

I am more familiar with SOAP and is more common use SOAP in SOA environment.

Is normal that CMIS force MTOM? Because I get <faultstring>The request is not MTOM encoded.</faultstring> when I disable MTOM in SoapUI.

[pnature]

I have added exception from catalina.log

Caused by: java.lang.NullPointerException
        at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:187)
        at com.google.common.cache.LocalCache.getIfPresent(LocalCache.java:3953)
        at com.google.common.cache.LocalCache$LocalManualCache.getIfPresent(LocalCache.java:4758)
        at org.alfresco.repo.cache.DefaultSimpleCache.get(DefaultSimpleCache.java:133)
        at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.isUserProtected(AuthenticationServiceImpl.java:151)
        at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.authenticate(AuthenticationServiceImpl.java:114)
        at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:202)
        at org.alfresco.opencmis.AlfrescoCmisServiceImpl.beforeCall(AlfrescoCmisServiceImpl.java:3221)
        at org.alfresco.opencmis.AlfrescoCmisServiceInterceptor.invoke(AlfrescoCmisServiceInterceptor.java:95)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
        at org.alfresco.opencmis.AlfrescoCmisExceptionInterceptor.invoke(AlfrescoCmisExceptionInterceptor.java:90)

[afaust]

There technically is a chance that a "null" user name is being passed from the CMIS service to the authentication service, and then the cache. Seems like your request may not be providing a user name for authentication. To be fair, Alfresco should not throw up with a NullPointerException in this case, but the isUserProtected code is a somewhat recent addition and apparently this corner-case has not been tested for...

[pnature]

I think authorization is not problem. I have set basic authentication in SoapUI (including username and password). I can see authorization string in http log.

[afaust]

But you do see that the error occurs in the AuthenticationServiceImpl.authenticate call, right? You are free to check the source code yourself, but this error only occurs when the user name (for whatever reason) is null. Looking at OpenCMIS and Alfresco source, I can only find the Atom and Browser bindings to handle the authentication HTTP header, though documentation by OpenCMIS (and client-side code) suggest basic authentication should be supported.

Which Alfresco version are you using and did you try with alternative versions?

[4535992]

Same problem here ! Did you find a solution ?

[4535992]

K i solved by setting the property  "Force mtom" to true, but now i get the error "permissionDenied", the basic authentication is correctly setted because i can reach teh service in debug , but the property "any" of the class "CmisExtensionType" of the library "opencmis" is always null 

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
   <soap:Body>
      <soap:Fault>
         <faultcode>soap:Server</faultcode>
         <faultstring>06150149 Failed to authenticate</faultstring>
         <detail>
            <cmisFault xmlns:ns2="http://docs.oasis-open.org/ns/cmis/core/200908/" xmlns="http://docs.oasis-open.org/ns/cmis/messaging/200908/">
               <type>permissionDenied</type>
               <code>0</code>
               <message>06150149 Failed to authenticate</message>
            </cmisFault>
         </detail>
      </soap:Fault>
   </soap:Body>
</soap:Envelope>

any advise ?