[GEODE-5618] FunctionService.onServer() and FunctionService.onRegion() fail when multiuser-authentication=true

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.7.0
• Component/s: functions, security
• Labels: pull-request-available
• Assignee: Juan Ramos
• Reporter: Juan Ramos
• Created: 22/Aug/18 11:45
• Updated: 03/Oct/18 21:38
• Resolved: 29/Aug/18 09:32

Description

The problem resides within the ServerFunctionExecutor class, specifically in the following section of code:

ServerFunctionExecutor.java

public ResultCollector execute(final String functionName) {
(...)
 byte[] functionAttributes = getFunctionAttributes(functionName);
 if (functionAttributes == null) {
 Object obj = GetFunctionAttributeOp.execute(this.pool, functionName);
 functionAttributes = (byte[]) obj;
 addFunctionAttributes(functionName, functionAttributes);
 }
(..)
}

We are specifically executing an internal function (namely GetFunctionAttributeOp) to retrieve the metadata for the function executed by the client without setting the user attributes required by the authentication mechanism and, as such, the execution fails for this particular function instead of the one executed by the client (it's not even part of the stack trace):

Exception in thread "main" java.lang.UnsupportedOperationException: Use Pool APIs for doing operations when multiuser-secure-mode-enabled is set to true.
 at org.apache.geode.cache.client.internal.PoolImpl.authenticateIfRequired(PoolImpl.java:1549)
 at org.apache.geode.cache.client.internal.PoolImpl.authenticateIfRequired(PoolImpl.java:1531)
 at org.apache.geode.cache.client.internal.PoolImpl.execute(PoolImpl.java:781)
 at org.apache.geode.cache.client.internal.GetFunctionAttributeOp.execute(GetFunctionAttributeOp.java:24)
 at org.apache.geode.internal.cache.execute.ServerFunctionExecutor.execute(ServerFunctionExecutor.java:310)

The other top-level methods from ServerFunctionExecutor and ServerRegionFunctionExecutor configure the user attributes before actually executing the function, that's why (as a workaround), the user can use FunctionService.onServer(regionService).execute(new MyFunction()), works as expected:

 if (proxyCache != null) {
 if (this.proxyCache.isClosed()) {
 throw proxyCache.getCacheClosedException("Cache is closed for this user.");
 }
 UserAttributes.userAttributes.set(this.proxyCache.getUserAttributes());
 }

The solution would be to add the same pre-operation logic to the buggy method.

Issue Links

• links to: GitHub Pull Request #2360