0039776: OBSecurityException appears after login with user with no roles

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0039776

Openbravo ERP

A. Platform

public

2018-12-10 16:39

2018-12-19 22:30

Reporter

nicolasuriz

Assigned To

jarmendariz

Priority

normal

Severity

major

Reproducibility

always

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

3.0PR19Q1

Merge Request Status

Review Assigned To

alostale

OBNetwork customer

Gold

Web browser

Modules

Core

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0039776: OBSecurityException appears after login with user with no roles

Description

When you attempt to login with an user which has no roles (or no role that allows access to backend), login form shows an error message notifying that. However, if page is reloaded, an error page appears indicating there was an unhandled exception.

Looking at the log file, this exception is caused by the following stacktrace:

2018-12-13 10:56:44,170 [http-bio-8080-exec-10] ERROR org.openbravo.dal.core.ThreadHandler - Your user is not assigned to a Role and it is required to login into Openbravo. Ask the Security Administrator
org.openbravo.base.exception.OBSecurityException: Your user is not assigned to a Role and it is required to login into Openbravo. Ask the Security Administrator
    at org.openbravo.dal.core.OBContext.initialize(OBContext.java:880) ~[classes/:?]
    at org.openbravo.dal.core.OBContext.initialize(OBContext.java:814) ~[classes/:?]
    at org.openbravo.dal.core.OBContext.initialize(OBContext.java:808) ~[classes/:?]
    at org.openbravo.dal.core.OBContext.setFromRequest(OBContext.java:777) ~[classes/:?]
    at org.openbravo.dal.core.OBContext.setOBContext(OBContext.java:419) ~[classes/:?]
    at org.openbravo.dal.core.DalRequestFilter$1.doBefore(DalRequestFilter.java:78) ~[classes/:?]
    at org.openbravo.dal.core.ThreadHandler.run(ThreadHandler.java:45) [classes/:?]
    at org.openbravo.dal.core.DalRequestFilter.doFilter(DalRequestFilter.java:105) [classes/:?]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.72]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.72]
    at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71) [log4j-web-2.11.1.jar:2.11.1]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.72]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.72]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) [catalina.jar:7.0.72]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) [catalina.jar:7.0.72]
...

Steps To Reproduce

1. Login to backend
2. Create a user without any role or POS Terminal access.
3. Log out from backend
4. Login with the new user created
5. Login form shows an error message. This is OK
6. Refresh the web page
7. An "unexpected error" error page is displayed and it does not allow to keep working.

Proposed Solution

When refreshing page, it should render the login page instead of the exception page.

Additional Information