1

After an upgrade Alfresco form version 5.2 to version 6.2 it became unstable: sometimes we got :

org.mybatis.spring.MyBatisSystemException: nested exception is org.mybatis.spring.MyBatisSystemException: nested exception is org.apache.ibatis.reflection.ReflectionException: Error instantiating class java.util.ArrayList with invalid types () or values

Usually during .parallel(). collection execution. There is full stack trace https://pastebin.com/7d7NBwkn and there is the code https://pastebin.com/RyPt5d0g . Actually I even can not understand a flow of control, why MyBatis is involved?

Please help me!

Thank you!

PS: Actually this error is not reproducible well. This exception doesn't rise when I remove .parallel(). and use single thread stream processing.

UPD: the following code rises an exception in case of .parallel(). execution and does not rise an exception in case of serial execution:

final SecurityManager sm = System.getSecurityManager();
   if (sm != null) {
        sm.checkPermission(new RuntimePermission("accessDeclaredMembers"));
    }

UPD 2 SOLUTION: in Alfresco version 5.2 System.getSecurityManager() == NULL (!!!) but in version 6.2. it has been set up. That is the matter of different behavior (details in https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/util/concurrent/ForkJoinPool.html). V 6.2 set up the SecurityManager and v 5.2. doesn't. The solution was the replacement catalina.sh in Dockerfile to new modified cataliha.sh which has removed security JVM options.

Martijn Pieters
  • 1,048,767
  • 296
  • 4,058
  • 3,343
Ekaterina Ivanova iceja.net
  • 350
  • 1
  • 5
  • 27
  • Please post the full stack trace. Partial stack trace is not helpful very much. See this [answer](https://stackoverflow.com/a/3988794/1261766). – ave Feb 24 '21 at 22:40
  • https://pastebin.com/0jcxFfc5 – Ekaterina Ivanova iceja.net Feb 25 '21 at 07:15
  • `java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")` - there's your problem: You are running the Alfresco process within a Java SecurityManager without the correct / appropriate policy file. Alfresco does not provide fine grained policy files themselves, using an AllPermission grant (see https://github.com/Alfresco/alfresco-community-repo/blob/master/packaging/docker-alfresco/Dockerfile#L64). If you deploy a custom module outside of the webapp, you also need to grant the JAR the necessary permissions. – Axel Faust Feb 25 '21 at 09:31
  • we have permission java.lang.RuntimePermission "accessDeclaredMembers"; in catalina.policy – Ekaterina Ivanova iceja.net Feb 25 '21 at 12:28
  • Have you also checked that the permission is granted to the Alfresco web application and all its constitutent code / libraries? It would not help if it is granted only to some Tomcat libraries. – Axel Faust Feb 25 '21 at 15:39
  • I have checked permissions granted to all web applications, Actually this error is not reproducible well. This exeception doesn't rise when I remove .parallel(). and use single thread stream processing. Can this issue be rlevant https://stackoverflow.com/a/64027627/1999752 ? – Ekaterina Ivanova iceja.net Feb 26 '21 at 08:03
  • @EkaterinaIvanovaiceja.net Are you sure that is the entire stack trace? There should be more `Caused by:` parts below that part (it might be possible that the original exception is swallowed by some implementation, though). – ave Feb 27 '21 at 19:02
  • @ave https://pastebin.com/7d7NBwkn – Ekaterina Ivanova iceja.net Feb 28 '21 at 06:54
  • @EkaterinaIvanovaiceja.net Regarding your question : 'why MyBatis is involved', the stack trace shows that `EcmcDictionaryServiceImpl.getDictionaryValue()` invoked inside `generateBeanData()` triggers a SELECT query for somehow. I'm not familiar with Alfresco at all, but the answer you linked could explain the `AccessControlException`. – ave Feb 28 '21 at 19:01
  • @ave thank you for your answer, please take a look to update of question – Ekaterina Ivanova iceja.net Mar 01 '21 at 15:20
  • Hi @EkaterinaIvanovaiceja.net, The recent answer from Doug was updated according to your recent updated question. – Arjun Mar 02 '21 at 16:05

1 Answers1

5

This exception comes from the Java Security manager. If you are using the Alfresco docker images, the security manager is enabled by default. If you have done a non-docker installation, you are launching tomcat using the "-security" switch. While the security manager is recommended because it makes your installation more secure, it is not required.

If you are using Alfresco's docker images, you will need to modify the docker-compose.yml file and specify a "command" argument for the "alfresco" service. Out of the box, the "command" argument is ["catalina.sh", "run", "-security"]. You need to remove the "-security" flag. For example:

    services:
        alfresco:
            image: alfresco/alfresco-content-repository-community:6.2.0-ga
            command: ["catalina.sh", "run"]

If you have installed Alfresco manually, you simply need to change the way that you are starting it. Remove the "-security" flag.

According to:

https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/util/concurrent/ForkJoinPool.html

Using parallel execution causes threads to spawn with no security configuration. This means that for this situation, you cannot use parallel execution unless you disable the security manager. So your choices are to disable the security manager using the above steps or to use serial execution.

campisano
  • 229
  • 2
  • 10
Doug Forrest
  • 486
  • 2
  • 6
  • It looks like I have completely different deployment scheme. please see the last update of question – Ekaterina Ivanova iceja.net Mar 07 '21 at 07:23
  • @EkaterinaIvanovaiceja.net There are two ways to deploy Alfresco: 1. Docker images, or 2. Manually. I covered both of those. The security manager is not enabled by Alfresco. It is enabled by Tomcat. If you are not using docker, you just need to examine your method for starting Tomcat. The "-security" command line switch will enable the security manager. There are also other command line parameters that will enable it. – Doug Forrest Mar 08 '21 at 15:15