basic auth fails with missing spring auth methods -> backend build drags two conflicting versions of spring-security

[landryb]

Description

running npm start from master (eg 175c2b9), the web ui on port 8081 works fine, but trying to auth as admin/admin locally, i get a 500 code on /rest/geostore/session/login from the backend running on port 8080

How to reproduce

• run the devel env
• try to login with the default credentials

Expected Result
i should be logged in as admin to test/debug admin-only features

Current Result

full trace of the 500 error below

java.lang.NoSuchMethodError: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken org.springframework.security.authentication.UsernamePasswordAuthenticationToken.unauthenticated(java.lang.Object, java.lang.Object)'
	org.springframework.security.web.authentication.www.BasicAuthenticationConverter.convert(BasicAuthenticationConverter.java:98)
	org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:160)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	it.geosolutions.geostore.services.rest.security.keycloak.KeyCloakFilter.doFilter(KeyCloakFilter.java:119)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter.doFilterInternal(DefaultLogoutPageGeneratingFilter.java:58)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:237)
	org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:223)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	it.geosolutions.geostore.services.rest.security.oauth2.OAuth2GeoStoreAuthenticationFilter.doFilter(OAuth2GeoStoreAuthenticationFilter.java:133)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	it.geosolutions.geostore.services.rest.security.GeoStoreAuthenticationFilter.doFilter(GeoStoreAuthenticationFilter.java:79)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:223)
	org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	it.geosolutions.geostore.services.rest.security.GeoStoreAuthenticationFilter.doFilter(GeoStoreAuthenticationFilter.java:79)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)
	org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)
	org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:112)
	org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:82)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
	org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:221)
	org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)
	org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)
	org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)
	org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)

• Not browser related

I've tested with the backend running with java 11 and java 17, same error. Tried from two different firefox on different hosts, same thing.

Other useful information

[landryb]

just as a sidenote: according to https://stackoverflow.com/questions/74177440/java-lang-nosuchmethoderror-authentication-usernamepasswordauthenticationtoke it's due to multiple versions of spring jars, so somewhere in the doc it should be mentioned that the various target subdirs in product & java/web should be cleaned up...

[landryb]

running the full build.sh script effectively removes some spring 5.3.18 jars from 2023 in the various target subdirs, now i only have jars for spring versions 5.6.12 & 5.7.12... but i still get the same traceback when trying to login. will trash all target subdirs and retry.

[landryb]

same thing from a clean build without any leftovers from previous builds...

[landryb]

i have something that works again with this dummy diff:

diff --git a/pom.xml b/pom.xml
index 3efb0a478..759c2550c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,7 +22,7 @@
         <ehcache-web.version>2.0.4</ehcache-web.version>
         <commons-pool.version>1.5.4</commons-pool.version>
         <jaxws-api.version>2.3.1</jaxws-api.version>
-        <spring.security.version>5.6.12</spring.security.version>
+        <spring.security.version>5.7.12</spring.security.version>
         <log4j-version>2.19.0</log4j-version>
         <jackson-version>2.16.1</jackson-version>
         <json-patch.version>1.12</json-patch.version>

maybe a recent commit to java dependencies bumped something and now drags spring-security 5.7.12, and we end up with both versions installed which now conflict ? with that diff, i have only one version of spring-security installed, and logging as admin/admin works again.

[pierrejego]

Same behavior here.
Updating parent pom to 5.7.12 fix the build issue

[landryb]

as found out by @pierrejego, apparently the other 5.7.12 spring-security version might be dragged by geostore 2.2, per https://github.com/geosolutions-it/geostore/blob/2.2.x/src/pom.xml#L49 ?