IllegalArgumentException: No handler can be found for the key 'javax.security.auth.Subject.container'

Question

I am basically following this tutorial: https://www.ibm.com/developerworks/java/library/j-javaee8-security-api-4/index.html?ca=drs-

My development environment: TomEE 8.0 M1 Plume

pom.xml

    <dependency>
        <groupId>org.glassfish.soteria</groupId>
        <artifactId>javax.security.enterprise</artifactId>
        <version>1.0</version>
    </dependency>
    <dependency>
        <groupId>javax</groupId>
        <artifactId>javaee-api</artifactId>
        <version>8.0</version>
        <scope>provided</scope>
    </dependency>

ApplicationConfig:

@CustomFormAuthenticationMechanismDefinition(
        loginToContinue = @LoginToContinue(
                loginPage = "/login.xhtml",
                errorPage = "/login.xhtml?error",
                useForwardToLogin = true
        )
)

@ApplicationScoped
@Named
public class ApplicationConfig {
}

TestServlet:

@WebServlet("/test")
public class TestServlet extends HttpServlet {

    @Inject
    SecurityContext securityContext;

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        securityContext.isCallerInRole("admin");
    }
}

Go to http://localhost:8080/test, I get this exception:

    05-Dec-2018 16:38:39.132 SEVERE [http-nio-8080-exec-219] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [servlet.TestServlet] in context with path [] threw exception
 java.lang.IllegalArgumentException: No handler can be found for the key 'javax.security.auth.Subject.container'
    at javax.security.jacc.PolicyContext.getContext(PolicyContext.java:91)
    at org.glassfish.soteria.authorization.JACC$2.run(JACC.java:175)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.glassfish.soteria.authorization.JACC.getFromContext(JACC.java:173)
    at org.glassfish.soteria.authorization.JACC.getSubject(JACC.java:73)
    at org.glassfish.soteria.authorization.JACC.isCallerInRole(JACC.java:78)
    at org.glassfish.soteria.authorization.spi.impl.ReflectionAndJaccCallerDetailsResolver.isCallerInRole(ReflectionAndJaccCallerDetailsResolver.java:82)
    at org.glassfish.soteria.SecurityContextImpl.isCallerInRole(SecurityContextImpl.java:89)
    at servlet.TestServlet.doGet(TestServlet.java:20)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:65)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.tomee.catalina.OpenEJBValve.invoke(OpenEJBValve.java:44)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:607)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.tomee.catalina.OpenEJBSecurityListener$RequestCapturer.invoke(OpenEJBSecurityListener.java:97)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:668)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:770)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

I am from Spring and Spring Security background but new to CDI and EJB.

Could you please tell me how to configure that handler or am I missing something?

Thank you!

Answer 1

The error is caused since TomEE does not fully implement JACC on which the default authorization SPI ("ReflectionAndJaccCallerDetailsResolver") of Soteria depends.

Note that TomEE does in fact support JACC, just not fully.

There's a couple of options here (from easy to more challenging):

1. The obvious; wait for TomEE 8 final which should make this work one way or the other (using either their own EE Security implementation or otherwise)
2. Implement the SPI that Soteria uses for authorization and call TomEE/Tomcat native APIs to do the same thing that the default implementation is now using JACC for.
3. Contribute to TomEE and implement the missing bits in their JACC implementation (or contribute to Tomcat with a web only implementation). There's a JIRA for that already, see TOMEE-1912

I've been planning to provide an example for 2. and make the SPI more obvious in Soteria 1.1, but unfortunately haven't got around to that yet.