Bug 506730

Summary: BankID (Norwegian common online banking authentication system) applet fails to load
Product: [Fedora] Fedora Reporter: Tore Anderson <tore>
Component: java-1.6.0-openjdkAssignee: Omair Majid <omajid>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 16CC: dbhole, ingvar, lkundrak, mark, patrickm, rruss, terjeros
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
See Also: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=539
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-01-09 16:40:16 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Attachments:
Description Flags
More error messages from ~/.xsession-errors
none
Remove useless cast which casues a CastException
none
Screenshot of a successfully loaded BankID applet
none
path to fix the issue none

Description Tore Anderson 2009-06-18 10:06:32 EDT
Description of problem:

When attempting to log on to my online bank, Firefox fails to load the BankID applet (where you're supposed to input a one-time code from a token and a password).  It is therefore impossible to log on to Norwegian online banks (at least the ones using BankID, which are most of them) using a plain F11 installation.

Version-Release number of selected component (if applicable):

java-1.6.0-openjdk-plugin-1.6.0.0-22.b16.fc11.i586

How reproducible:

100%

Steps to Reproduce:
1. Visit http://www.sbm.no/
2. Click "Logg på nettbanken" in the upper right hand link collection box
3. In the new window/tab, enter "12345678901" (or any other random 11-digit number I suppose) in the "Brukernavn" field, then press "Utfør".
4. Select the radio box before "Pålogging med BankID e-legitimasjon", and again input "12345678901" as "Fødselsnummer".  Press "Utfør".
5. Press "Run" in the security warning pop-up from Java.
  
Actual results:

Only a grey square appears in the page, and the status bar reads "Start: applet not initialized".

Expected results:

The BankID applet should show, allowing you to enter a few security credentials and ultimately grant access to the online bank.

Additional info:

It works great if I replace the IcedTea plugin with the Sun one (jre-1.6.0_14-fcs.i586).
Comment 1 Tore Anderson 2009-06-18 10:07:20 EDT
Created attachment 348472 [details]
More error messages from ~/.xsession-errors
Comment 2 Omair Majid 2009-06-26 15:36:00 EDT
Created attachment 349596 [details]
Remove useless cast which casues a CastException

Unfortunately I cant verify if this fix works. What I can confirm is that it causes the applet to load which shows this:

Det har oppstatt en feil.
Vennligst prov igjen senere.
[OK]

Clicking on the ok button takes me to https://nettbank.edb.com/Logonnull which says Not Found :(
Comment 3 Tore Anderson 2009-06-27 05:48:41 EDT
Hello,

Unless you accidentally hit a maintenance window where logins were disabled, there's now a new problem I'm afraid...

The message translates as "There has been an error. Please try later."

I'll attach a screenshot on how the applet looks after a successful load with Sun's JRE.

Tore
Comment 4 Tore Anderson 2009-06-27 05:49:22 EDT
Created attachment 349643 [details]
Screenshot of a successfully loaded BankID applet
Comment 5 Omair Majid 2009-07-14 16:55:15 EDT
Fixed upstream: http://icedtea.classpath.org/hg/icedtea6/rev/a50daec5fab4
Comment 6 Bug Zapper 2010-04-27 11:03:24 EDT
This message is a reminder that Fedora 11 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 11.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '11'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 11's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 11 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 8 Tore Anderson 2010-06-15 17:21:41 EDT
Just checked with Fedora 13, java-1.6.0-openjdk-plugin-1.6.0.0-41.b18.fc13.x86_64.  It still doesn't work.  Firefox says «Start: applet not initialized.» in the status bar, and the following backtrace appears in the console output:

java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (fedora-41.b18.fc13-x86_64)
OpenJDK 64-Bit Server VM (build 14.0-b16, mixed mode)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:735)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_18
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.33.5-112.fc13.x86_64
SID                : null
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_18&sid=null&os=LIN
java.lang.NullPointerException
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.RuntimeException: Failed to handle message: width 1 height 1 for instance 1
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:660)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Caused by: java.lang.NullPointerException
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	... 2 more
java.lang.NullPointerException
	at sun.applet.PluginAppletViewer.getApplets(PluginAppletViewer.java:907)
	at no.bbs.bankid.client.gui.ClientApplet.isSingleApplet(Unknown Source)
	at no.bbs.bankid.client.gui.ClientApplet.init(Unknown Source)
	at sun.applet.AppletPanel.run(AppletPanel.java:436)
	at java.lang.Thread.run(Thread.java:636)
java.lang.NullPointerException
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.RuntimeException: Failed to handle message: width 396 height 280 for instance 2
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:660)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Caused by: java.lang.NullPointerException
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	... 2 more

It works fine with Sun's JRE.

Tore
Comment 9 Omair Majid 2010-07-01 10:22:53 EDT
*** Bug 609855 has been marked as a duplicate of this bug. ***
Comment 10 Terje Røsten 2010-07-01 12:55:05 EDT
As I said in Bug 609855 this worked during winter. I can see if I can
find a old system and help find where it stopped working.
Comment 11 Terje Røsten 2010-07-01 13:53:13 EDT
Okay, it's the transition to 1.6.0_18 (from 1.6.0_17) which breaks.

java-1.6.0-openjdk-plugin-1.6.0.0-37.b17.fc12.x86_64 works

java-1.6.0-openjdk-plugin-1.6.0.0-38.b18.fc12.x86_64 don't work


Full logs from some testing:

Works:
--------------------

$ rpm -qa |grep openjdk
java-1.6.0-openjdk-1.6.0.0-36.b17.fc12.x86_64
java-1.6.0-openjdk-plugin-1.6.0.0-36.b17.fc12.x86_64

*** NSPlugin Viewer  *** WARNING: unhandled variable 18 (<unknown variable>) in NPN_GetValue()
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_17
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.31.12-174.2.3.fc12.x86_64
SID                : null
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_17&sid=null&os=LIN
BankID client version: 4.0.27


$ rpm -qa |grep openjdk
java-1.6.0-openjdk-1.6.0.0-37.b17.fc12.x86_64
java-1.6.0-openjdk-plugin-1.6.0.0-37.b17.fc12.x86_64

** NSPlugin Viewer  *** WARNING: unhandled variable 18 (<unknown variable>) in NPN_GetValue()
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_17
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.31.12-174.2.3.fc12.x86_64
SID                : null
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_17&sid=null&os=LIN
BankID client version: 4.0.27



Don't work:
------------------------

Msg in browser:

Error 404: SRVE0190E: File not found: /bankid_javaversion=1.6.0_18&sid=null&os=LIN

*** NSPlugin Viewer  *** WARNING: unhandled variable 18 (<unknown variable>) in NPN_GetValue()
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (fedora-38.b18.fc12-x86_64)
OpenJDK 64-Bit Server VM (build 14.0-b16, mixed mode)
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_18
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0 
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.31.12-174.2.3.fc12.x86_64
SID                : null
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_18&sid=null&os=LIN
        
                
$ rpm -qa |grep openjdk
java-1.6.0-openjdk-plugin-1.6.0.0-38.b18.fc12.x86_64
java-1.6.0-openjdk-1.6.0.0-38.b18.fc12.x86_64



** NSPlugin Viewer  *** WARNING: unhandled variable 18 (<unknown variable>) in NPN_GetValue()
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (fedora-39.b18.fc12-x86_64)
OpenJDK 64-Bit Server VM (build 14.0-b16, mixed mode)
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_18
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.31.12-174.2.3.fc12.x86_64
SID                : null 
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_18&sid=null&os=LIN
java.lang.NullPointerException
        at sun.applet.PluginAppletViewer.getApplets(PluginAppletViewer.java:907)
        at no.bbs.bankid.client.gui.ClientApplet.isSingleApplet(Unknown Source)
        at no.bbs.bankid.client.gui.ClientApplet.init(Unknown Source)
        at sun.applet.AppletPanel.run(AppletPanel.java:436)
        at java.lang.Thread.run(Thread.java:636)

java-1.6.0-openjdk-plugin-1.6.0.0-39.b18.fc12.x86_64
java-1.6.0-openjdk-1.6.0.0-39.b18.fc12.x86_64
Comment 12 Terje Røsten 2010-07-01 14:04:55 EDT
From rawhide system, still don't work, different error msg:

BTW: why is openjdk on 1.6.0_18 when Oracle/Sun has 1.6.0_20 ?


Java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (fedora-41.b18.fc13-x86_64)
OpenJDK 64-Bit Server VM (build 14.0-b16, mixed mode)
java.lang.InterruptedException: sleep interrupted
        at java.lang.Thread.sleep(Native Method)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:735)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
DETECTOR_VERSION   : 2008-07-03 10:45
Java version       : 1.6.0_18
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/

Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.33.4-95.fc13.x86_64
SID                : null
URL                : https://nettbank.edb.com/Logon/bankid?javaversion=1.6.0_18&sid=null&os=LIN
java.lang.NullPointerException
        at sun.applet.PluginAppletViewer.getApplets(PluginAppletViewer.java:907)
        at no.bbs.bankid.client.gui.ClientApplet.isSingleApplet(Unknown Source)
        at no.bbs.bankid.client.gui.ClientApplet.init(Unknown Source)
        at sun.applet.AppletPanel.run(AppletPanel.java:436)
        at java.lang.Thread.run(Thread.java:636)
java.lang.NullPointerException
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.RuntimeException: Failed to handle message: width 396 height 280 for instance 2
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:660)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Caused by: java.lang.NullPointerException
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
        ... 2 more

$ rpm -qa |grep openjdk
java-1.6.0-openjdk-plugin-1.6.0.0-41.b18.fc13.x86_64
java-1.6.0-openjdk-1.6.0.0-41.b18.fc13.x86_64
Comment 13 Omair Majid 2010-07-01 15:44:42 EDT
Created attachment 428537 [details]
path to fix the issue

The problem appears to be in the plugin. The plugin adds a null to its list of panels instead of the actual panel. getApplets() then hits this null.
Comment 14 Terje Røsten 2010-07-01 17:47:19 EDT
I added the patch on top of -41 rpm package and rebuilt the package.
 Instant success! BankID applet works. Thanks guys! Please push a update.
Comment 15 Terje Røsten 2010-07-02 04:59:52 EDT
Tore, if want to test the patch I have done a koji scratch build.

Packages for Fedora 13 are available here:

  http://koji.fedoraproject.org/koji/taskinfo?taskID=2289165

You need at least

java-1.6.0-openjdk-1.6.0.0-42.b18.fc13.x86_64.rpm
java-1.6.0-openjdk-plugin-1.6.0.0-42.b18.fc13.x86_64.rpm
Comment 16 Tore Anderson 2010-07-02 09:22:10 EDT
Thanks Terje, I can confirm that those packages work perfectly!

Tore
Comment 17 Omair Majid 2010-08-10 15:26:59 EDT
Hi,

Can you please test the packages at https://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-42.b18.fc13 and leave feedback?

Thanks
Comment 18 Terje Røsten 2010-08-10 16:02:45 EDT
Done.  Thanks for the updated package!
Comment 19 Ingvar Hagelund 2010-09-02 08:36:57 EDT
Sorry to reopen this, but while BankId now works for some customers, it certainly does not for all, at least not on x86_64. 

I reported this in IcedTea's tracker today, 

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=539

This case is for BankID used with DNBNor's net bank service, http://dnbnor.no/

When using the Iced Tea plugin, the applet loads successfully, but
gives some strange error message, and won't authorize the user.

Short version, snipped from the IcedTea tracker added below.

Ingvar







On accessing the BankID applet, it reports "success", but one does not aqquire
a login ticket or whatever access right mechanism they use.

The nsplugin on firefox reports this to stdout:

*** NSPlugin Viewer  *** WARNING: unhandled variable 18 (<unknown variable>) in
NPN_GetValue()
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8.1) (fedora-42.b18.fc13-x86_64)
OpenJDK 64-Bit Server VM (build 14.0-b16, mixed mode)
Java version       : 1.6.0_18
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 2.6.33.5-124.fc13.x86_64
BankID client version: 4.0.27
java.lang.IllegalMonitorStateException
        at
java.util.concurrent.locks.ReentrantLock$Sync.tryRelease(ReentrantLock.java:155)
        at
java.util.concurrent.locks.AbstractQueuedSynchronizer.release(AbstractQueuedSynchronizer.java:1262)
        at
java.util.concurrent.locks.ReentrantLock.unlock(ReentrantLock.java:459)
        at
java.util.concurrent.PriorityBlockingQueue.take(PriorityBlockingQueue.java:257)
        at no.bbs.bankid.client.gui.by.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:636)
Comment 20 Tore Anderson 2010-09-02 11:52:39 EDT
(In reply to comment #19)
> Sorry to reopen this, but while BankId now works for some customers, it
> certainly does not for all, at least not on x86_64. 
> 
> I reported this in IcedTea's tracker today, 
> 
> http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=539
> 
> This case is for BankID used with DNBNor's net bank service, http://dnbnor.no/
> 
> When using the Iced Tea plugin, the applet loads successfully, but
> gives some strange error message, and won't authorize the user.

Hi Ingvar,

I think this is a different bug.  I have currently no problems logging into Handelsbanken or Sparebanken Møre's BankID-supported solution (both EDB-run), however my Significant Other had problem with DnB NOR.  She got error code 1102 (in the HTML page) after having authenticated with the BankID applet.  It works with Sun's JRE, though.

Tore
Comment 21 Ingvar Hagelund 2010-12-03 07:33:58 EST
With java-1.6.0-openjdk-plugin-1.6.0.0-44.1.9.1.fc14.x86_64, this now seems fixed in Fedora 14 (only x86_64 tested for now).

At least, I can confirm that it works well with DnB NOR's BankID implementation.

Ingvar
Comment 22 Omair Majid 2010-12-09 12:21:01 EST
(In reply to comment #21)
> At least, I can confirm that it works well with DnB NOR's BankID
> implementation.

Thanks for confirming that it works now. Closing as FIXED
Comment 23 Ingvar Hagelund 2012-01-09 16:23:06 EST
I'm afraid I have to reopen this bug, as it's back on my fedora 16 x86_64 laptop running

firefox-9.0.1-1.fc16.x86_64
icedtea-web-1.1.4-4.fc16.x86_64
java-1.6.0-openjdk-1.6.0.0-61.1.10.4.fc16.x86_64

To reproduce, try for example this:

1) Open firefox with the icedtea-web plugin enabled. Open bankID's own test page at url https://bankid.no/Hjelp-og-nyttige-verktoy/Nyttige-verktoy/Test-din-BankID/ . Wait for the bankID java applet to appear.
2) In the "Fødselsnummer (11 siffer)" field in the applet, enter a valid Norwegian social security number*, like 01017049905, and click the "OK" button. 
3) In the "Engangskode" (one time code) field, enter six random numbers, like 123456. Click the OK button.
4) Watch ABRT report that Java has segfaulted.

Firefox outputs the following on stdout, the final error when java segfaults:

java version "1.6.0_22"
OpenJDK Runtime Environment (IcedTea6 1.10.4) (fedora-61.1.10.4.fc16-x86_64)
OpenJDK 64-Bit Server VM (build 20.0-b11, mixed mode)
Java version       : 1.6.0_22
Java vendor        : Sun Microsystems Inc.
Java vendor url    : http://java.sun.com/
Java class version : 50.0
OS NAME            : Linux
OS Arch            : amd64
OS Version         : 3.1.7-1.fc16.x86_64
BankID client version: 5.0.8
java: ../sysdeps/posix/getaddrinfo.c:1662: rfc3484_sort: Assertion `src->results[i].native == -1 || src->results[i].native == a2_native' failed.


*) To generate a valid (though probably non-existant) Norwegian social security number, try this page: http://www.fnrinfo.no/Verktoy/FinnLovlige_Dato.aspx

Ingvar
Comment 24 Ingvar Hagelund 2012-01-09 16:40:16 EST
Doh, forget about it, this last problem is the infamous libnss, or more specific nss-myhostname bug that is trigged by linklocal ipv6 addresses, and is a duplicate at least of #756441 and #739743. CLosing with the previous CLOSED ERRATA.