2

GeoServer 2.22.0 with Authkey Extension Module in a kartoza/geoserver docker image.

We are trying to set up an authentication protocol with the authkey module and key provider using user properties, following the documentation and additional hints in here and here.

I am able to add a new authentication filter and synchronize the (default) user/group service. When saving the default filter chain ('my_auth_filter' is "selected") GeoServer seems to completely crash, the /.../geoserver/web/ site displaying "503 Service Temporarily Unavailable".

We did see an error while restarting during one of the first crashes:

ERROR [geoserver.security] Error loading filter; my_auth_filter
com.thoughtworks.xstream.mapper.CannotResolveClassException: authKeyAuthentication.

And later, during another crash:

WARN   [web.security] - Error saving config
org.geoserver.security.validation.SecurityConfigException: The filter chain pattern list is empty for filter chain "my_auth_chain"

Those messages did not show up anymore during later crashes.

As far as I can see, the filter chain should not be empty as filter chain testing on the authentication page does result in the correct responsible chain (default).

We then deleted GeoServer data directory and restarted the GeoServer pod to get a “clean” environment. I set up one workspace, one store and just a few layers. As before, I added a new AuthKey authentication filter (mapper: user property, user/group service: default, synchronized: 1 key). In the filter chain settings, I added my filter to “selected” and removed basic and anonymous filters. When saving this, GeoServer crashes again.

I am adding the lines of the logs close to the crash event (only those that are different from what we see in our production environment):

31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removing all entries
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removed all entries
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removing all entries for formLogout
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removed 0 entries for formLogout
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removing all entries
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removed all entries
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removing all entries for sslFilter
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0
31 Jan 16:36:03 DEBUG  [geoserver.security] - AuthenticationCache removed 0 entries for sslFilter
31 Jan 16:36:03 DEBUG  [geoserver.security] - Cache entries #: 0

[…]

31 Jan 16:36:03 TRACE  [geoserver.monitor] - Testing /web/ for monitor filtering
31 Jan 16:36:03 DEBUG  [geoserver.monitor] - /geoserver/web/ was filtered from monitoring

[…]

31 Jan 16:36:04 DEBUG  [geoserver.security] - Bad credentials
org.springframework.security.authentication.BadCredentialsException: Bad credentials
    at org.springframework.security.authentication.dao.DaoAuthenticationProvider.additionalAuthenticationChecks(DaoAuthenticationProvider.java:93)
    at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:166)
    at org.geoserver.security.auth.UsernamePasswordAuthenticationProvider.authenticate(UsernamePasswordAuthenticationProvider.java:85)
    at org.geoserver.security.GeoServerAuthenticationProvider.authenticate(GeoServerAuthenticationProvider.java:54)
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:175)
    at org.geoserver.security.GeoServerSecurityManager.checkForDefaultAdminPassword(GeoServerSecurityManager.java:1374)
    at org.geoserver.security.web.SecurityHomePageContentProvider$SecurityWarningsPanel.<init>(SecurityHomePageContentProvider.java:115)
    at org.geoserver.security.web.SecurityHomePageContentProvider.getPageBodyComponent(SecurityHomePageContentProvider.java:44)
    at org.geoserver.web.GeoServerHomePage$10.populateItem(GeoServerHomePage.java:699)
    at org.apache.wicket.markup.html.list.ListView.onPopulate(ListView.java:523)
    at org.apache.wicket.markup.repeater.AbstractRepeater.onBeforeRender(AbstractRepeater.java:124)
    at org.apache.wicket.Component.internalBeforeRender(Component.java:950)
    at org.apache.wicket.Component.beforeRender(Component.java:1018)
    at org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1826)
    at org.apache.wicket.Component.onBeforeRender(Component.java:3921)
    at org.apache.wicket.Page.onBeforeRender(Page.java:801)
    at org.apache.wicket.Component.internalBeforeRender(Component.java:950)
    at org.apache.wicket.Component.beforeRender(Component.java:1018)
    at org.apache.wicket.Component.internalPrepareForRender(Component.java:2236)
    at org.apache.wicket.Page.internalPrepareForRender(Page.java:242)
    at org.apache.wicket.Component.render(Component.java:2327)
    at org.apache.wicket.Page.renderPage(Page.java:1018)
    at org.apache.wicket.request.handler.render.WebPageRenderer.renderPage(WebPageRenderer.java:124)
    at org.apache.wicket.request.handler.render.WebPageRenderer.respond(WebPageRenderer.java:236)
    at org.apache.wicket.core.request.handler.RenderPageRequestHandler.respond(RenderPageRequestHandler.java:175)
    at org.apache.wicket.request.cycle.RequestCycle$HandlerExecutor.respond(RequestCycle.java:895)
    at org.apache.wicket.request.RequestHandlerStack.execute(RequestHandlerStack.java:64)
    at org.apache.wicket.request.cycle.RequestCycle.execute(RequestCycle.java:265)
    at org.apache.wicket.request.cycle.RequestCycle.processRequest(RequestCycle.java:222)
    at org.apache.wicket.request.cycle.RequestCycle.processRequestAndDetach(RequestCycle.java:293)
    at org.apache.wicket.protocol.http.WicketFilter.processRequestCycle(WicketFilter.java:261)
    at org.apache.wicket.protocol.http.WicketFilter.processRequest(WicketFilter.java:203)
    at org.apache.wicket.protocol.http.WicketServlet.doGet(WicketServlet.java:137)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:655)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
    at org.springframework.web.servlet.mvc.ServletWrappingController.handleRequestInternal(ServletWrappingController.java:166)
    at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:177)
    at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:52)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1043)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:655)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.filters.CorsFilter.handleNonCORS(CorsFilter.java:357)
    at org.apache.catalina.filters.CorsFilter.doFilter(CorsFilter.java:176)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.ThreadLocalsCleanupFilter.doFilter(ThreadLocalsCleanupFilter.java:28)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:73)
    at org.geoserver.flow.controller.IpBlacklistFilter.doFilter(IpBlacklistFilter.java:89)
    at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:70)
    at org.geoserver.monitor.MonitorFilter.doFilter(MonitorFilter.java:90)
    at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:70)
    at org.geoserver.ows.HTTPHeadersCollector.doFilter(HTTPHeadersCollector.java:48)
    at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:70)
    at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:194)
    at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:70)
    at org.geoserver.filters.SpringDelegatingFilter.doFilter(SpringDelegatingFilter.java:43)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.platform.AdvancedDispatchFilter.doFilter(AdvancedDispatchFilter.java:39)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerAnonymousAuthenticationFilter.doFilter(GeoServerAnonymousAuthenticationFilter.java:53)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.geoserver.security.filter.GeoServerUserNamePasswordAuthenticationFilter.doFilter(GeoServerUserNamePasswordAuthenticationFilter.java:122)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:158)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
    at org.geoserver.security.filter.GeoServerSecurityContextPersistenceFilter$1.doFilter(GeoServerSecurityContextPersistenceFilter.java:52)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:142)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:77)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:48)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:49)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1789)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:829)
 […]
31 Jan 16:36:33 DEBUG  [filter.GeoServerSecurityContextPersistenceFilter$1] - SecurityContextHolder now cleared, as request processing completed
31 Jan 16:36:33 WARN   [support.DisposableBeanAdapter] - Destroy method 'destroy' on bean with name 'gwcMemoryBlobStore' threw an exception: java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@294bd825[Not completed, task = org.geowebcache.storage.blobstore.memory.MemoryBlobStore$BlobStoreTask@1fc20b0] rejected from java.util.concurrent.ThreadPoolExecutor@4615feac[Shutting down, pool size = 1, active threads = 1, queued tasks = 0, completed tasks = 0]
31 Jan 16:36:33 WARN   [support.DisposableBeanAdapter] - Invocation of destroy method failed on bean with name 'geoServerLoader': org.springframework.beans.factory.BeanCreationNotAllowedException: Error creating bean with name 'wmsLifecycleHandler': Singleton bean creation not allowed while singletons of this factory are in destruction (Do not request a bean from a BeanFactory in a destroy method implementation!)
31 Jan 16:36:33 INFO   [geoserver.logging] - Beginning GeoServer cleanup sequence

Is there anything we break while adding the filter to the chain? Does anyone see an error we make while setting up the AuthKey Module? Where and what should we look for?

5
  • You need to turn up the logging level to developer in the global settings page, and then make the request again. Then edit your question with the relevant part of the log file.
    – Ian Turton
    Jan 12, 2023 at 17:16
  • Thanks Ian. We did as you suggested and I added parts of the logs and some explanation about it - hopefully relevant.
    – Marcus
    Jan 13, 2023 at 16:22
  • During last week we have provoked the crash (by saving the filter chain) a couple of times and searched for reasons or at least hints in the logs. Unfortunately, we cannot see any pointer for this behaviour: I added a screenshot of the live log during a crash – there don’t seem to be any error messages at all, GeoServer just tries to restart (11:32:34). What can we do to resolve this challenge, where should we look for clues?
    – Marcus
    Jan 23, 2023 at 11:49
  • the exception "The filter chain pattern list is empty for filter chain "my_auth_chain"" seems clear enough
    – Ian Turton
    Jan 23, 2023 at 12:02
  • That's what I thought. Filter chain testing on the authentication page does result in the correct responsible chain (default), though. How else do I fill the chain pattern list?
    – Marcus
    Jan 23, 2023 at 12:17

1 Answer 1

1

With the help of terrestris we found a configuration that is working for us (GeoServer 2.22.2 by now):

  • Data / Layers / some_layer (or per workspace):
    • Allow READ-access for authenticated users only, see tab Security.
      • ROLE_AUTHENTICATED: read
  • Security / Data:
    • Removed *.*.r rule from the Data Security.
  • Security / Authentication:
    • Authentication Filters: Add new.
      • Name: AuthKey
      • Name of the URL parameter: authkey
      • Authentication key to user mapper: User property
      • User/Group Service: default
      • Pressed Synchronize user/group service
    • Filter Chains: default
      • Pass the AuthKey filter to the Selected chain filters.
      • Ordering: basic / AuthKey / anonymous

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.