1

I am working on a JSF 2.2 web application deployed on Wildfly 8.2. The application requires that Admin users be allowed to log out other users. So user A needs to click a button and log off user B. I am searching for a way invalidate a users session programmatically. The closest solution I have found is appears to be specific to Jboss 7. When I attempt to execute the following code:

private final static Logger LOG = Logger.getLogger(SessionBacker.class);
private void closeJBossSession(String sessionID){
   MBeanServer server = java.lang.management.ManagementFactory.getPlatformMBeanServer();
   ObjectName objectName;
   try {
      objectName = new ObjectName("jboss.web:type=Manager,path=/jobManagement,host=default-host");
   } catch (MalformedObjectNameException e) {
      LOG.error("MalformedObjectNameException Could not end Jboss Session "+sessionID+".  "+e.getMessage());
      return;
   }
   String[] sig = { "java.lang.String"};
   Object[] opArgs1 = { sessionID };
   try {
      String value = (String) server.invoke(objectName, "expireSession",opArgs1, sig);
   } catch (InstanceNotFoundException e) {
      LOG.error("InstanceNotFoundException Could not end Jboss Session "+sessionID+".  "+e.getMessage(),e);
   } catch (ReflectionException e) {
      LOG.error("ReflectionException Could not end Jboss Session "+sessionID+".  "+e.getMessage());
   } catch (MBeanException e) {
      LOG.error("MBeanException Could not end Jboss Session "+sessionID+".  "+e.getMessage());
   }
}

I receive the following error:

12:26:54,711 ERROR [com.eclipseinc.client.jobmg.session.ui.SessionBacker] (default task-273) InstanceNotFoundException Could not end Jboss Session 4aam9B9N3XZBuh_VOWmz43UA.  jboss.web:type=Manager,path=/jobManagement,host=default-host: javax.management.InstanceNotFoundException: jboss.web:type=Manager,path=/jobManagement,host=default-host
at org.jboss.as.jmx.PluggableMBeanServerImpl.findDelegate(PluggableMBeanServerImpl.java:1094)
at org.jboss.as.jmx.PluggableMBeanServerImpl.invoke(PluggableMBeanServerImpl.java:732)
at com.eclipseinc.client.jobmg.session.ui.SessionBacker.closeJBossSession(SessionBacker.java:115) [jobmanagement-client-EE7-SNAPSHOT.jar:]
at com.eclipseinc.client.jobmg.session.ui.SessionBacker.closeSession(SessionBacker.java:67) [jobmanagement-client-EE7-SNAPSHOT.jar:]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_40]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) [rt.jar:1.7.0_40]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_40]
at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_40]
at com.sun.el.parser.AstValue.invoke(AstValue.java:292) [javax.el-3.0.1-b05.jar:]
at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:304) [javax.el-3.0.1-b05.jar:]
at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:40) [weld-core-impl-2.2.6.Final.jar:2014-10-03 10:05]
at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:50) [weld-core-impl-2.2.6.Final.jar:2014-10-03 10:05]
at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:40) [weld-core-impl-2.2.6.Final.jar:2014-10-03 10:05]
at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:50) [weld-core-impl-2.2.6.Final.jar:2014-10-03 10:05]
at com.sun.faces.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:105) [jsf-impl-2.2.8-jbossorg-1.jar:]
at javax.faces.event.MethodExpressionActionListener.processAction(MethodExpressionActionListener.java:147) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at javax.faces.event.ActionEvent.processListener(ActionEvent.java:88) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at javax.faces.component.UIComponentBase.broadcast(UIComponentBase.java:813) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at javax.faces.component.UICommand.broadcast(UICommand.java:300) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at org.richfaces.component.RowKeyContextEventWrapper.broadcast(RowKeyContextEventWrapper.java:104) [richfaces-a4j-4.5.7.Final.jar:4.5.7.Final]
at org.richfaces.component.UIDataAdaptor.broadcast(UIDataAdaptor.java:456) [richfaces-a4j-4.5.7.Final.jar:4.5.7.Final]
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:790) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at javax.faces.component.UIViewRoot.processDecodes(UIViewRoot.java:931) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at com.sun.faces.lifecycle.ApplyRequestValuesPhase.execute(ApplyRequestValuesPhase.java:78) [jsf-impl-2.2.8-jbossorg-1.jar:]
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101) [jsf-impl-2.2.8-jbossorg-1.jar:]
at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198) [jsf-impl-2.2.8-jbossorg-1.jar:]
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646) [jboss-jsf-api_2.2_spec-2.2.8.jar:2.2.8]
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:51) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:63) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:56) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:261) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:247) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:76) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:166) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:759) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_40]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_40]
at java.lang.Thread.run(Thread.java:724) [rt.jar:1.7.0_40]

I believe that jboss.web:type=Manager is not supported in wildfly. Other posts have had similar problems and provided solutions for gathering session information by accessing the undertow subsystem. However I could not find an "expireSession" method in undertow (I searched using the using the CLI GUI). Is there a way to invalidate user sessions programatically in wildfly 8?

Community
  • 1
  • 1
Chrisg
  • 11
  • 2
  • 1
    Most straightforward approach would be to toggle some boolean in the users database and then have a request filter check for this and then invalidate the session accordingly (and toggle the boolean back). Is this approach acceptable? – BalusC Sep 09 '15 at 20:08
  • I agree with @BalusC, the approach you are attempting is bad practice. If you can get it working you will have a project that is tied to 1 particular version of 1 particular app server. Upgrading or changing app servers will be a real pain. You should really focus on an approach that doesn't rely on app server internals. – Tea Curran Sep 09 '15 at 20:58
  • Indeed. Another approach would be to get hold of all sessions in the application scope via a session listener. But this is quite expensive and relatively brittle when attempted without solid knowledge. – BalusC Sep 09 '15 at 20:59
  • Thanks for the help. When an admin logs out a user I add that user session to an application scoped set. I also created a WebFilter that check the current session is in that set. If the user is in the set I log them out redirect them to the homepage. So when the logged out user attempts to do something they are forced to login again. – Chrisg Nov 07 '15 at 22:33

0 Answers0