{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-session/issues/373","repository_url":"https://api.github.com/repos/spring-projects/spring-session","labels_url":"https://api.github.com/repos/spring-projects/spring-session/issues/373/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-session/issues/373/comments","events_url":"https://api.github.com/repos/spring-projects/spring-session/issues/373/events","html_url":"https://github.com/spring-projects/spring-session/issues/373","id":135290337,"number":373,"title":"ClassCastException in AbstractGemFireOperationsSessionRepository.afterCreate","user":{"login":"sshcherbakov","id":3210551,"avatar_url":"https://avatars.githubusercontent.com/u/3210551?v=3","gravatar_id":"","url":"https://api.github.com/users/sshcherbakov","html_url":"https://github.com/sshcherbakov","followers_url":"https://api.github.com/users/sshcherbakov/followers","following_url":"https://api.github.com/users/sshcherbakov/following{/other_user}","gists_url":"https://api.github.com/users/sshcherbakov/gists{/gist_id}","starred_url":"https://api.github.com/users/sshcherbakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sshcherbakov/subscriptions","organizations_url":"https://api.github.com/users/sshcherbakov/orgs","repos_url":"https://api.github.com/users/sshcherbakov/repos","events_url":"https://api.github.com/users/sshcherbakov/events{/privacy}","received_events_url":"https://api.github.com/users/sshcherbakov/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-session/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/spring-projects/spring-session/labels/GemFire","name":"GemFire","color":"000000"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-session/milestones/8","html_url":"https://github.com/spring-projects/spring-session/milestones/1.1.0","labels_url":"https://api.github.com/repos/spring-projects/spring-session/milestones/8/labels","id":1564061,"number":8,"title":"1.1.0","description":"","creator":{"login":"rwinch","id":362503,"avatar_url":"https://avatars.githubusercontent.com/u/362503?v=3","gravatar_id":"","url":"https://api.github.com/users/rwinch","html_url":"https://github.com/rwinch","followers_url":"https://api.github.com/users/rwinch/followers","following_url":"https://api.github.com/users/rwinch/following{/other_user}","gists_url":"https://api.github.com/users/rwinch/gists{/gist_id}","starred_url":"https://api.github.com/users/rwinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwinch/subscriptions","organizations_url":"https://api.github.com/users/rwinch/orgs","repos_url":"https://api.github.com/users/rwinch/repos","events_url":"https://api.github.com/users/rwinch/events{/privacy}","received_events_url":"https://api.github.com/users/rwinch/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":12,"state":"closed","created_at":"2016-02-04T18:41:53Z","updated_at":"2016-02-25T20:12:55Z","due_on":"2016-02-25T06:00:00Z","closed_at":"2016-02-25T20:12:55Z"},"comments":11,"created_at":"2016-02-22T01:45:15Z","updated_at":"2016-03-03T22:35:49Z","closed_at":"2016-02-24T23:04:22Z","body":"I'm trying to setup a simple Spring security session sharing using spring-session and Gemfire.\r\nI've added following dependencies to my webapp project:\r\n````\r\n\t\tcompile('org.springframework.session:spring-session-data-gemfire:1.1.0.RC1')\r\n\t\tcompile('org.springframework.session:spring-session:1.1.0.RC1')\r\n\t\tcompile('org.springframework.security:spring-security-web')\r\n\t\tcompile('org.springframework.security:spring-security-config')\r\n````\r\nand almost succeeded to setup session sharing. \r\nI had to add several Spring dependencies to the Gemfire classpath because the spring-session-data-gemfire doesn't use PDX and thus some classes need to be present on the server side as well:\r\n`spring-session-1.1.0.RC1.jar`,`spring-expression-4.2.4.RELEASE.jar`, `spring-security-web-4.0.3.RELEASE.jar`, `spring-security-core-4.0.3.RELEASE.jar`\r\nThe session gets stored in my Gemfire cluster and I don't get server side ClassNotFoundExceptions any more.\r\nI also get a simple authentication prompt asking to login to my application:\r\n````\r\n@EnableWebSecurity\r\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\r\n\r\n\t@Autowired\r\n\tpublic void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {\r\n\t\tauth\r\n\t\t\t.inMemoryAuthentication()\r\n\t\t\t\t.withUser(\"user\").password(\"password\").roles(\"USER\");\r\n\t}\r\n}\r\n````\r\nOn the application side after I try to login with the those credentials I get the following exception:\r\n````\r\n[error 2016/02/22 02:29:59.823 CET <http-nio-8080-exec-2> tid=0x31] Exception occurred in CacheListener\r\njava.lang.ClassCastException: com.gemstone.gemfire.internal.cache.Token$Tombstone cannot be cast to org.springframework.session.ExpiringSession\r\n\tat org.springframework.session.data.gemfire.AbstractGemFireOperationsSessionRepository.afterCreate(AbstractGemFireOperationsSessionRepository.java:212)\r\n\tat com.gemstone.gemfire.internal.cache.EnumListenerEvent$AFTER_CREATE.dispatchEvent(EnumListenerEvent.java:97)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.dispatchEvent(LocalRegion.java:8820)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.dispatchListenerEvent(LocalRegion.java:7311)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.invokePutCallbacks(LocalRegion.java:6133)\r\n\tat com.gemstone.gemfire.internal.cache.EntryEventImpl.invokeCallbacks(EntryEventImpl.java:1919)\r\n\tat com.gemstone.gemfire.internal.cache.ProxyRegionMap$ProxyRegionEntry.dispatchListenerEvents(ProxyRegionMap.java:544)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.basicPutPart2(LocalRegion.java:5987)\r\n\tat com.gemstone.gemfire.internal.cache.ProxyRegionMap.basicPut(ProxyRegionMap.java:228)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.basicPutEntry(LocalRegion.java:5919)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.findObjectInSystem(LocalRegion.java:2808)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.nonTxnFindObject(LocalRegion.java:1464)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegionDataView.findObject(LocalRegionDataView.java:133)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.get(LocalRegion.java:1348)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.get(LocalRegion.java:1311)\r\n\tat com.gemstone.gemfire.internal.cache.LocalRegion.get(LocalRegion.java:1298)\r\n\tat com.gemstone.gemfire.internal.cache.AbstractRegion.get(AbstractRegion.java:321)\r\n\tat org.springframework.data.gemfire.GemfireTemplate.get(GemfireTemplate.java:161)\r\n\tat org.springframework.session.data.gemfire.GemFireOperationsSessionRepository.getSession(GemFireOperationsSessionRepository.java:117)\r\n\tat org.springframework.session.data.gemfire.GemFireOperationsSessionRepository.getSession(GemFireOperationsSessionRepository.java:38)\r\n\tat org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:270)\r\n\tat org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:286)\r\n\tat org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:170)\r\n\tat javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:231)\r\n\tat javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:231)\r\n\tat org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.loadToken(HttpSessionCsrfTokenRepository.java:77)\r\n\tat org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:85)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\r\n\tat org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\r\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\r\n\tat org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.session.web.http.SessionRepositoryFilter.doFilterInternal(SessionRepositoryFilter.java:126)\r\n\tat org.springframework.session.web.http.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:65)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:103)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)\r\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)\r\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)\r\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)\r\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)\r\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)\r\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)\r\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:521)\r\n\tat org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1096)\r\n\tat org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:674)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\n````\r\nThe session is not being recognized after that and app's page says after that\r\n````\r\nThere was an unexpected error (type=Forbidden, status=403).\r\nExpected CSRF token not found. Has your session expired?\r\n````\r\n\r\nThat looks like something unexpected for the spring-session code.\r\nAm I missing anything, or this is a spring-session issue indeed?"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-session/issues/comments/191998055","html_url":"https://github.com/spring-projects/spring-session/issues/373#issuecomment-191998055","issue_url":"https://api.github.com/repos/spring-projects/spring-session/issues/373","id":191998055,"user":{"login":"sshcherbakov","id":3210551,"avatar_url":"https://avatars.githubusercontent.com/u/3210551?v=3","gravatar_id":"","url":"https://api.github.com/users/sshcherbakov","html_url":"https://github.com/sshcherbakov","followers_url":"https://api.github.com/users/sshcherbakov/followers","following_url":"https://api.github.com/users/sshcherbakov/following{/other_user}","gists_url":"https://api.github.com/users/sshcherbakov/gists{/gist_id}","starred_url":"https://api.github.com/users/sshcherbakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sshcherbakov/subscriptions","organizations_url":"https://api.github.com/users/sshcherbakov/orgs","repos_url":"https://api.github.com/users/sshcherbakov/repos","events_url":"https://api.github.com/users/sshcherbakov/events{/privacy}","received_events_url":"https://api.github.com/users/sshcherbakov/received_events","type":"User","site_admin":false},"created_at":"2016-03-03T22:35:48Z","updated_at":"2016-03-03T22:35:48Z","body":"Thank you @jxblum !\r\n\r\nSetting the `--enable-concurrency-checks=false` on the server side fixed the ClassCastException problem. I hope that disabling consistency check won't remain requirement for using spring-session eventually though.\r\n\r\nThe error during authentication was caused by my incorrect spring-security configuration.\r\nIt all works very well now!"}}