0

I want to create login functionality for Admin so that admin can login (from Admin-portal) as any user (in User-portal). (These are two different portal running in two different host).

In Admin-portal, I have have written

<p:dialog>  
    <form action="http://user-portal.com/index.jsf" method="post"
        target="_blank">
        <h:inputHidden id="adminId" value="#{userListBean.openAdminId}"></h:inputHidden>
        <h:inputHidden id="clientId" value="#{userListBean.openClientId}"></h:inputHidden>
        <!-- some other security parameters -->
       <input type="submit" value="login"></input>
    </form>
</p:dialog>

Problem is in User-portal.
index.jsf 

<h:body>
    #{customLogin}
</h:body>

CustomLogin bean

@Named("customLogin")
@SessionScoped
public class CustomLogin implements Serializable {
.
.
@PostConstruct
public void customLoginPage() {
    HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance()
                    .getExternalContext().getRequest();
    Map<String, String[]> requestParaMap = request.getParameterMap();
    // some admin and user validation and setting other injected bean property base on it
    HttpServletResponse response = (HttpServletResponse) FacesContext.getCurrentInstance()
                    .getExternalContext().getResponse();
    string serverName = request.getServerName();
    response.sendRedirect(serverName+ "/home.jsf");
    // also tried this
    // facesContext.getExternalContext().redirect("/home.jsf");
    return;
}

CustomLogin bean is session scoped and method "customLoginPage" is invoked postconstruct. So it is running in "RESTORE_VIEW" phase of JSF Lifecycle.

I am getting following error :

javax.faces.application.ViewExpiredException: viewId:/index.jsf - View /index.jsf could not be restored.
    at com.sun.faces.lifecycle.RestoreViewPhase.execute(RestoreViewPhase.java:205) [jsf-impl-2.1.28.redhat-3.jar:2.1.28.redhat-3]
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101) [jsf-impl-2.1.28.redhat-3.jar:2.1.28.redhat-3]
    at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:116) [jsf-impl-2.1.28.redhat-3.jar:2.1.28.redhat-3]
    at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118) [jsf-impl-2.1.28.redhat-3.jar:2.1.28.redhat-3]
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:593) [jboss-jsf-api_2.1_spec-2.1.28.Final-redhat-1.jar:2.1.28.Final-redhat-1]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) [jbossweb-7.4.8.Final-redhat-4.jar:7.4.8.Final-redhat-4]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.4.8.Final-redhat-4.jar:7.4.8.Final-redhat-4]
    .
    .
    .
12:21:24,683 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/].[Faces Servlet]] (http-localhost/127.0.0.1:8080-1) JBWEB000236: Servlet.service() for servlet Faces Servlet threw exception: java.lang.IllegalStateException
    at org.apache.catalina.connector.ResponseFacade.sendRedirect(ResponseFacade.java:420) [jbossweb-7.4.8.Final-redhat-4.jar:7.4.8.Final-redhat-4]
    at com.sun.faces.context.ExternalContextImpl.redirect(ExternalContextImpl.java:602) [jsf-impl-2.1.28.redhat-3.jar:2.1.28.redhat-3]
    at javax.faces.context.ExternalContextWrapper.redirect(ExternalContextWrapper.java:462) [jboss-jsf-api_2.1_spec-2.1.28.Final-redhat-1.jar:2.1.28.Final-redhat-1]

Few web.xml content that may be helpful

<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>server</param-value>
</context-param>
<context-param>
  <param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
  <param-value>false</param-value>
</context-param>

<context-param>             
  <param-name>javax.faces.RESOURCE_EXCLUDES</param-name>
  <param-value>.xhtml .class .properties .xml</param-value>
</context-param>

<context-param>
    <param-name>facelets.DEVELOPMENT</param-name>
    <param-value>true</param-value>
</context-param>

<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>*.jsf</url-pattern>
</servlet-mapping>

I have read ViewExpiredException by BalusC. But here every request to user-portal is fresh. Plus when I change javax.faces.STATE_SAVING_METHOD to client, I am getting "GZIP exception".

Community
  • 1
  • 1
user811602
  • 1,314
  • 2
  • 17
  • 47
  • As you keep saying "portal", are you using portlets? Regardless, your problem is caused by using `
    ` instead of ``, but as this is a bit too obvious mistake and you're possibly using portlets, I'm not sure it's worth an answer. Is there any specific reason for this way of using forms?
     – BalusC Jul 23 '15 at 08:33
  • @BalusC, I am sending post data to external site, so I am using "form" instead of . – user811602 Jul 23 '15 at 09:03
  • @BalusC, On further debuging , I found that admin web application is also sending "javax.faces.ViewState=6387845437888449661%3A7065341672136465353" to user application. Is this can be cause of problem ? – user811602 Jul 23 '15 at 09:08
  • Well, the `ViewExpiredException` then basically means that the JSF view state is unknown at the target host. Your architecture is totally unclear, so it's hard to propose the right answer. Perhaps you need to synchronize sessions, or take a step back and look for a SSO library. If you aren't the application architect, talk with one for guidelines, or look for one. – BalusC Jul 23 '15 at 09:13
  • Is setting it to null in before RESTORE_VIEW phase will work? (Or is there any way admin web application does not send it (if this is cause)). I know I should google it first, but then it will take time and you may get offline in that much time:) – user811602 Jul 23 '15 at 09:17
  • Sounds like trying to solve something that is wrong from the beginning. Why not justpost to the current server and redirect from the server to the new host or via an http redirect response? That is how all serious sso frameworks do it (which as BalusC said, you should look into. E.g. picketlink) – Kukeltje Jul 23 '15 at 20:46

0 Answers0