Java – Client.Error.MessageSend problem with Flex/BlazeDS on JBoss

apache-flexblazedsjavajbossSecurity

I'm developing a Flex 3.4 app that interops with a Java EE backend running on a JBoss-4.2.2 server, through the most recent release of BlazeDS. When I ran the Flex app from Flash Builder 4 beta 2 on Tomcat, everything was fine, the Flex app was able to make the remote call needed. But my production environment is on JBoss, and when I moved the app to JBoss (with services-config.xml updated to fit JBoss), the Flex app keeps complaining Client.Error.MessageSend upon remote calls.
At first, when I manually deployed the app to JBoss, the faultDetail was "Channel.Security.Error error Error #2048 ... "; later I tried to run the app from Flash Builder, and then faultDetail became "Channel.Connect.Failed error NetConnection.Call.BadVersion".

In services-config.xml, under <security>, was:

<login-command class="flex.messaging.security.TomcatLoginCommand" server="Tomcat"/>

when moving to JBoss, I updated it to:

<login-command class="flex.messaging.security.TomcatLoginCommand" server="JBoss"/>

I have a crossdomain.xml placed in JBoss' deploy folder, as follows:

<?xml version="1.0"?> 
<!DOCTYPE cross-domain-policy 
    SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> 
    <cross-domain-policy> 
    <allow-access-from domain="*" /> 
</cross-domain-policy>

But looks like it doesn't work. I've also tried to put crossdomain.xml in deploy/xxxxx.war folder, and the problem remains.

I'm using http://, not https://, so I guess it's not about security channel.

Tried to search for a solution, but most solutions were PHP related, which wasn't really helpful. Any one got any clues?

Best Answer

You have

<login-command class="**flex.messaging.security.TomcatLoginCommand**" server="Tomcat"/>

Where the class indicates that security is of tomcat you should change it to a class that implements the interface flex.messaging.security.LoginCommand or any security interface blaze.

Related Solutions

Apache – BlazeDS 3.2.0 and JBoss 5.1 DatabaseServerLoginModule

I went ahead and download the BlazeDS source code and after some debugging I realized that it might have just been me and my expectations when it came to the login behavior. Still, I'm a little bit confused about it and maybe someone can clarify me in the actual process since BlazeDS documentation does not explain it in a clear way.

My configuration is very simple, one amf destination for RemoteObejct usage and one security-constraint with the allowed roles. In this scenario I was expecting the ChannelSet.login to fail if the user does not include the expected roles. Instead, the login succeeds which, in my current design allows the user to proceed.

After debugging I realized that TomcatLoginCommand.isUserInRole method is only called after a RemoteObject method is called but never during the ChangeSet.login command. To confirm it, I associated security-constraints with some methods of the destination (see below - as shown in the documentation). As expected, the RemoteObject method would not be called when logging in with a user that did not have the given roles but all was good if the role was present.

<destination ...>
...
    <include-methods>
      <method name="fooMethod"/>
      <method name="barMethod" security-constraint="custom-admin-access"/>
    </include-methods>
...
</destination>

Based on this, my questions still are: Is this the intended behavior? Shouldn't ChangeSet.login fail immediately if the authenticated user does not participate in the allowed set of roles?

Java – How to handle custom Java exception in Flex app

Ok, so you are using the spring-blazeds-flex integration. In this case the mechanism described on the previous links does not work as it is. You need to create your own exception translator, otherwise you will receive the generic Server.Processing error: . Please read: http://static.springsource.org/spring-flex/docs/1.0.x/reference/html/ch02s08.html

Also you can read on the blog of my friend Ionut this article: http://margelatu.org/2009/06/15/meaningful-exceptions-in-lcdsblazeds-applications-using-spring-blazeds-integration/

Related Topic

Spring – How to solve “NullPointerException” with “Server.processing” error while we are using Flex Builder 3 and BlazeDS