NoUserSessionException when calling middleware service from BeforeLogin event listener

[alexbudarov]

Environment

• Platform version: 7.2.8

Description of the bug or enhancement

project attached:
servicefromaeltest.zip

forum topic: https://www.cuba-platform.com/discuss/t/exception-in-service-when-invoked-from-authenticationeventlistener/13689/6

• create middleware service
• create BeforeLoginEvent event listener on core module
• call service from this event listener

Exception happens:

11:03:26.036 INFO  c.h.cuba.core.sys.ServiceInterceptor    - Exception in ImAService.doAThing(): com.haulmont.cuba.security.global.NoUserSessionException: User session not found: 23dce942-d13f-11df-88cd-b3d32fd1e595
11:03:26.052 ERROR c.h.c.s.a.AuthenticationServiceBean     - Login error
com.haulmont.cuba.core.global.RemoteException: User session not found: 23dce942-d13f-11df-88cd-b3d32fd1e595
	at com.haulmont.cuba.core.sys.ServiceInterceptor.aroundInvoke(ServiceInterceptor.java:96) ~[cuba-core-7.2.8.jar:7.2.8]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:644) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:633) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:175) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:95) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212) ~[spring-aop-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at com.sun.proxy.$Proxy158.doAThing(Unknown Source) ~[na:na]
	at com.company.servicefromaeltest.listeners.AuthenticationEventListener.beforeLogin(AuthenticationEventListener.java:19) ~[app-core-0.1-SNAPSHOT.jar:na]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at org.springframework.context.event.ApplicationListenerMethodAdapter.doInvoke(ApplicationListenerMethodAdapter.java:305) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.event.ApplicationListenerMethodAdapter.processEvent(ApplicationListenerMethodAdapter.java:190) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.event.ApplicationListenerMethodAdapter.onApplicationEvent(ApplicationListenerMethodAdapter.java:153) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:172) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:165) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:139) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:403) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:360) ~[spring-context-5.2.3.RELEASE.jar:5.2.3.RELEASE]
	at com.haulmont.cuba.core.sys.EventsImpl.publish(EventsImpl.java:33) ~[cuba-global-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.security.auth.AuthenticationManagerBean.publishBeforeLoginEvent(AuthenticationManagerBean.java:323) ~[cuba-core-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.security.auth.AuthenticationManagerBean.login(AuthenticationManagerBean.java:115) ~[cuba-core-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.security.auth.AuthenticationServiceBean.login(AuthenticationServiceBean.java:89) ~[cuba-core-7.2.8.jar:7.2.8]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at com.haulmont.cuba.core.sys.remoting.LocalServiceInvokerImpl.invoke(LocalServiceInvokerImpl.java:94) [cuba-core-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.sys.remoting.LocalServiceProxy$LocalServiceInvocationHandler.invoke(LocalServiceProxy.java:159) [cuba-web-7.2.8.jar:7.2.8]
	at com.sun.proxy.$Proxy240.login(Unknown Source) [na:na]
	at com.haulmont.cuba.web.security.providers.LoginPasswordLoginProvider.loginMiddleware(LoginPasswordLoginProvider.java:69) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.security.providers.LoginPasswordLoginProvider.login(LoginPasswordLoginProvider.java:64) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.security.ConnectionImpl.loginInternal(ConnectionImpl.java:192) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.security.ConnectionImpl.login(ConnectionImpl.java:91) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.security.LoginScreenAuthDelegate.doLogin(LoginScreenAuthDelegate.java:148) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.app.login.LoginScreen.doLogin(LoginScreen.java:275) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.app.login.LoginScreen.doLogin(LoginScreen.java:243) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.app.login.LoginScreen.login(LoginScreen.java:213) [cuba-web-7.2.8.jar:7.2.8]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at com.haulmont.cuba.gui.xml.DeclarativeAction.actionPerform(DeclarativeAction.java:101) [cuba-gui-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.gui.components.WebButton.buttonClicked(WebButton.java:67) [cuba-web-7.2.8.jar:7.2.8]
	at com.haulmont.cuba.web.widgets.CubaButton.fireClick(CubaButton.java:76) ~[cuba-web-widgets-7.2.8.jar:na]

It happens because com.haulmont.cuba.security.auth.AuthenticationManagerBean#login sets serverSession as current authentication context, and this session isn't accepted by ServiceInterceptor.

Workarounds:

• move logic to Spring bean
• move listener to web layer