Bug 905074 - JNLP with jnlp.packEnabled and jnlp.versionEnabled results in "Application Error: Cannot grant permissions to unsigned jars."
Summary: JNLP with jnlp.packEnabled and jnlp.versionEnabled results in "Application Er...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: icedtea-web
Version: 18
Hardware: i386
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Andrew Azores
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-28 14:14 UTC by Mike Heller
Modified: 2013-06-19 20:03 UTC (History)
22 users (show)

Fixed In Version:
Clone Of: 753960
Environment:
Last Closed: 2013-06-19 20:03:00 UTC
Type: ---
Embargoed:
aazores: needinfo-


Attachments (Terms of Use)
javaws log (345.51 KB, text/x-log)
2013-01-29 07:27 UTC, Mike Heller
no flags Details
icedtea log (12.98 KB, text/x-log)
2013-01-29 07:28 UTC, Mike Heller
no flags Details
Possible workaround (291 bytes, application/x-shellscript)
2013-02-14 21:36 UTC, Adam Domurad
no flags Details
Possible workaround (425 bytes, application/x-shellscript)
2013-02-15 14:59 UTC, Adam Domurad
no flags Details
Possible workaround2 (313 bytes, text/plain)
2013-02-15 19:02 UTC, Adam Domurad
no flags Details

Description Mike Heller 2013-01-28 14:14:46 UTC
+++ This bug was initially created as a clone of Bug #753960 +++

I'm having a Java application which is not working since a few icedtea-web updates ago. unfortunately also the latest version did not solve the problem. the only working is to install suns java which is not my favorite.


Version-Release number of selected component (if applicable):
icedtea-web-1.3.1-3.fc18.i686

How reproducible:
Always

Steps to Reproduce:
1. try to start the java app.
  
Actual results:
getting the folling error message:

netx: Initialization Error: Could not initialize application. (Fatal: Application Error: Cannot grant permissions to unsigned jars. Application requested security permissions, but jars are not signed.)
net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. 
	at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:797)
	at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:555)
	at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:908)
Caused by: net.sourceforge.jnlp.LaunchException: Fatal: Application Error: Cannot grant permissions to unsigned jars. Application requested security permissions, but jars are not signed.
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.setSecurity(JNLPClassLoader.java:312)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.<init>(JNLPClassLoader.java:232)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:357)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:330)
	at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:789)


Expected results:
open the java app

Comment 1 Deepak Bhole 2013-01-28 14:59:55 UTC
Hi. Which app are you experiencing this with? Would it be possible for us to access it/reproduce this?

Comment 2 Mike Heller 2013-01-28 16:19:19 UTC
the app is called Spectrum Infrastructure Manager supplied by CA.
There is propably a testing website but I need to check with the supplier.

unfortunately I cannot offer such a opportunity.

Comment 3 Deepak Bhole 2013-01-28 20:09:58 UTC
I understand. Can you please follow the steps here and post the plugin.log and java.std* files then? Thanks!

http://icedtea.classpath.org/wiki/IcedTea-Web#Filing_bugs

Comment 4 Mike Heller 2013-01-29 07:27:19 UTC
Created attachment 689604 [details]
javaws log

Comment 5 Mike Heller 2013-01-29 07:28:30 UTC
Created attachment 689605 [details]
icedtea log

Comment 6 Mike Heller 2013-01-29 07:29:27 UTC
I've uploaded the requested logs.
do not hesitate to ask for further information.

Comment 7 Deepak Bhole 2013-01-29 20:27:56 UTC
Thanks. I am not sure what the ;no_javaws_cheat means, but it might be to blame here.

Can you please paste the output of:

wget -O /dev/null http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar%3Bno_javaws_cheat

and

wget -O /dev/null http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar

? Thanks.

Comment 8 Mike Heller 2013-01-29 20:54:45 UTC
wget -O /dev/null
http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar%3Bno_javaws_cheat

--2013-01-29 21:53:30--  http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar%3Bno_javaws_cheat
Auflösen des Hostnamen »zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)«... 10.66.5.72
Verbindungsaufbau zu zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)|10.66.5.72|:8080... verbunden.
HTTP-Anforderung gesendet, warte auf Antwort... 404 /spectrum/lib/contrib/clientforti.jar%3Bno_javaws_cheat
2013-01-29 21:53:30 FEHLER 404: /spectrum/lib/contrib/clientforti.jar%3Bno_javaws_cheat.

------

wget -O /dev/null http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar

wget -O /dev/null http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar
--2013-01-29 21:54:02--  http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/contrib/clientforti.jar
Auflösen des Hostnamen »zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)«... 10.66.5.72
Verbindungsaufbau zu zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)|10.66.5.72|:8080... verbunden.
HTTP-Anforderung gesendet, warte auf Antwort... 200 OK
Länge: 5865 (5.7K) [application/java-archive]
In »»/dev/null«« speichern.

100%[======================================================================================>] 5'865       --.-K/s   in 0.08s   

2013-01-29 21:54:03 (70.9 KB/s) - »»/dev/null«« gespeichert [5865/5865]

Comment 9 Mike Heller 2013-02-11 09:10:52 UTC
any clues?
need more info?

Comment 10 Deepak Bhole 2013-02-14 20:38:36 UTC
Sorry for the delay Mike; the last few weeks have been quite hectic.

I've asked Adam (just added to cc) to take a look into this.

Comment 11 Adam Domurad 2013-02-14 21:36:41 UTC
Created attachment 697415 [details]
Possible workaround

Comment 12 Adam Domurad 2013-02-14 21:39:20 UTC
I have attached a possible workaround, please run the shell script in some arbitrary folder.

I have no way of testing it but hopefully it'll work, but even if it doesn't hopefully it will give us more information.

The cause is almost definitely the added ;no_javaws_cheat. We can work towards stripping this from the URL but at this point it is not clear what it is intended to do. Hopefully running the workaround (which simply strips this and makes sure the JNLP is not redownloaded) will give us more information.


Thanks.

Comment 13 Mike Heller 2013-02-15 06:40:55 UTC
No worry about the delay.

Unfortunately the script does not work finally.
However, it starts downloading the jar jar files actually without the error message before. But I got a new one.
Here is the console output of the workaround script:

HTTP-Anforderung gesendet, warte auf Antwort... 200 OK
Länge: nicht spezifiziert [application/x-java-jnlp-file]
In »»oneclick.jnlp.4«« speichern.

    [ <=>                                                                                     ] 7'523       --.-K/s   in 0.02s   

2013-02-15 07:33:07 (376 KB/s) - »»oneclick.jnlp.4«« gespeichert [7523]

JAR http://zhbapssp-spsv01.bwns.ch:8080/spectrum/lib/jsafeJCEFIPS.jar;no_javaws_cheat not found. Continuing.
net.sourceforge.jnlp.LaunchException: Fatal: Application Error: Cannot grant permissions to unsigned jars. Application requested security permissions, but jars are not signed.
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.setSecurity(JNLPClassLoader.java:312)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.<init>(JNLPClassLoader.java:232)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:357)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:421)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.initializeExtensions(JNLPClassLoader.java:453)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.<init>(JNLPClassLoader.java:225)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:357)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:330)
	at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:789)
	at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:555)
	at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:908)
java.lang.NoClassDefFoundError: com/rsa/jsafe/provider/JsafeJCE
	at com.aprisma.spectrum.app.swing.window.LoginPrompt.getInformation(LoginPrompt.java:476)
	at com.aprisma.spectrum.app.swing.window.LoginPrompt.<init>(LoginPrompt.java:314)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase$HttpAuthenticator.getPasswordAuthentication(ClientAppBase.java:314)
	at com.aprisma.util.net.http.Authenticator.getCredentials(Authenticator.java:338)
	at com.aprisma.util.net.http.Authenticator.basic(Authenticator.java:374)
	at com.aprisma.util.net.http.Authenticator.authenticate(Authenticator.java:248)
	at com.aprisma.util.net.http.Authenticator.authenticate(Authenticator.java:113)
	at com.aprisma.util.net.http.HttpMethod.processAuthenticationResponse(HttpMethod.java:697)
	at com.aprisma.util.net.http.HttpMethod.execute(HttpMethod.java:940)
	at com.aprisma.util.net.http.HttpMethod.execute(HttpMethod.java:818)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.authenticateUser(ClientAppBase.java:1636)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.initialize(ClientAppBase.java:732)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.<init>(ClientAppBase.java:551)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.<init>(ClientAppBase.java:521)
	at com.aprisma.spectrum.app.console.client.ConsoleApp.<init>(ConsoleApp.java:252)
	at com.aprisma.spectrum.app.console.client.ConsoleApp.main(ConsoleApp.java:465)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:597)
	at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:908)
Caused by: java.lang.ClassNotFoundException: com.rsa.jsafe.provider.JsafeJCE
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.loadClass(JNLPClassLoader.java:1609)
	... 22 more


after downloading the jar file a login window should pop up.

Comment 14 Adam Domurad 2013-02-15 14:59:16 UTC
Created attachment 697837 [details]
Possible workaround

Comment 15 Adam Domurad 2013-02-15 15:01:05 UTC
OK looks like we're getting closer, its pulling in another jnlp that has the weird ';no_javaws_cheat' stuff. 

Try this new workaround, hopefully it will get further.

Cheers.

Comment 16 Mike Heller 2013-02-15 15:49:12 UTC
unfortunately I get the same error.
But I made probably something wrong. When I start the new script I got the error "could not find cryptoj.jnlp or oneclick.jnlp". So I wget those files into a directory and start the script again. But in this case I'm not sure if this is the proper way. I guess that the modified crypto file will not be used because the error is still the same?

--2013-02-15 16:43:11--  http://zhbapssp-spsv01.bwns.ch:8080/spectrum/cryptoj.jnlp
Auflösen des Hostnamen »zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)«... 10.66.5.72
Verbindungsaufbau zu zhbapssp-spsv01.bwns.ch (zhbapssp-spsv01.bwns.ch)|<ip-adress>|:8080... verbunden.
HTTP-Anforderung gesendet, warte auf Antwort... 200 OK
Länge: nicht spezifiziert [application/x-java-jnlp-file]
In »»cryptoj.jnlp.1«« speichern.

    [ <=>                                                                                            ] 1'219       --.-K/s   in 0s      

2013-02-15 16:43:11 (71.5 MB/s) - »»cryptoj.jnlp.1«« gespeichert [1219]

java.io.IOException: http://zhbapssp-spsv01.bwns.ch:8080/home/michael/spectrum/cryptoj2.jnlp
	at net.sourceforge.jnlp.JNLPFile.openURL(JNLPFile.java:284)
	at net.sourceforge.jnlp.JNLPFile.<init>(JNLPFile.java:206)
	at net.sourceforge.jnlp.JNLPFile.<init>(JNLPFile.java:190)
	at net.sourceforge.jnlp.JNLPFile.<init>(JNLPFile.java:240)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:419)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.initializeExtensions(JNLPClassLoader.java:453)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.<init>(JNLPClassLoader.java:225)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:357)
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.getInstance(JNLPClassLoader.java:330)
	at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:789)
	at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:555)
	at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:908)
java.lang.NoClassDefFoundError: com/rsa/jsafe/provider/JsafeJCE
	at com.aprisma.spectrum.app.swing.window.LoginPrompt.getInformation(LoginPrompt.java:476)
	at com.aprisma.spectrum.app.swing.window.LoginPrompt.<init>(LoginPrompt.java:314)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase$HttpAuthenticator.getPasswordAuthentication(ClientAppBase.java:314)
	at com.aprisma.util.net.http.Authenticator.getCredentials(Authenticator.java:338)
	at com.aprisma.util.net.http.Authenticator.basic(Authenticator.java:374)
	at com.aprisma.util.net.http.Authenticator.authenticate(Authenticator.java:248)
	at com.aprisma.util.net.http.Authenticator.authenticate(Authenticator.java:113)
	at com.aprisma.util.net.http.HttpMethod.processAuthenticationResponse(HttpMethod.java:697)
	at com.aprisma.util.net.http.HttpMethod.execute(HttpMethod.java:940)
	at com.aprisma.util.net.http.HttpMethod.execute(HttpMethod.java:818)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.authenticateUser(ClientAppBase.java:1636)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.initialize(ClientAppBase.java:732)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.<init>(ClientAppBase.java:551)
	at com.aprisma.spectrum.app.client.jnlp.ClientAppBase.<init>(ClientAppBase.java:521)
	at com.aprisma.spectrum.app.console.client.ConsoleApp.<init>(ConsoleApp.java:252)
	at com.aprisma.spectrum.app.console.client.ConsoleApp.main(ConsoleApp.java:465)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:597)
	at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:908)
Caused by: java.lang.ClassNotFoundException: com.rsa.jsafe.provider.JsafeJCE
	at net.sourceforge.jnlp.runtime.JNLPClassLoader.loadClass(JNLPClassLoader.java:1609)
	... 22 more

Comment 17 Adam Domurad 2013-02-15 19:02:37 UTC
Created attachment 697947 [details]
Possible workaround2

Comment 18 Adam Domurad 2013-02-15 19:03:37 UTC
"http://zhbapssp-spsv01.bwns.ch:8080/home/michael/spectrum/cryptoj2.jnlp" didnt work out as planned. OK heres another try. This one tries to 'inline' the extension JNLP so its not needed. Worth a shot :-).

Cheers.

Comment 19 Mike Heller 2013-02-15 19:27:57 UTC
God job man.
This one is working!

Comment 20 Adam Domurad 2013-02-15 20:38:10 UTC
Great! :-)

So it seems we need to ignore anything after ';' in a jar URL. I still have to wonder why they added it in the first place. On that note, let us know if you run into further bugs, because their could be some obscure use for this ';no_javaws_cheat' string... 

I'll get around to a 'proper fix' sometime.

Cheers.

Comment 21 Andrew Azores 2013-06-04 20:34:11 UTC
Mike,

Can you try to reproduce this bug with the latest version of icedtea-web? We've tried to reproduce it with some mockup JNLPs here and this bug seems to have been fixed.

Comment 22 Mike Heller 2013-06-17 12:58:09 UTC
sorry for the late reply but I was off a few weeks.

But wohoo, this works perfectly!
Thanks, no longer a work around needed!


Note You need to log in before you can comment on or make changes to this bug.