After upgrading to OpenEdge 12.2.15 or later a PASOE web application that uses SAML or OAuth2 fails to start

Existing PASOE instances fail to start after an upgrade to OpenEdge 12.2.15 or later if the PASOE instance has web applications that make use of OAuth2 or SAML authentication.

Aug 31, 2024
Knowledge

Title

URL Name

After-upgrading-to-OpenEdge-12-2-15-or-later-a-PASOE-web-application-that-uses-SAML-or-OAuth2-fails-to-start

Article Number

000262179

Environment

Product: OpenEdge Version: 12.2.15, 12.2.16 OS: All supported platforms Other: Progress Application Server for OpenEdge

Question/Problem Description

After upgrading from OpenEdge 12.2.14 or earlier to OpenEdge 12.2.15 or later, existing PASOE instances fail to start if a web application is configured to use OAuth2 or SAML authentication.

Steps to Reproduce

Clarifying Information

The issue does not occur with new PASOE instances that have been created after the upgrade to OpenEdge 12.2.15 or later.

Error Message

ERROR [Catalina-utility-1] - o.s.web.context.ContextLoader - Context initialization failed org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#0' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#0': Cannot create inner bean '(inner bean)#5242b8f6' while setting constructor argument with key [5]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.config.http.HttpConfigurationBuilder$SecurityContextHolderAwareRequestFilterBeanFactory#0': Initialization of bean failed; nested exception is org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [com.progress.appserv.services.security.OESamlWebSSOProcessingFilter] for bean with name 'samlWebSSOProcessingFilter' defined in ServletContext resource [/WEB-INF/spring/samlFilters.xml]; nested exception is java.lang.ClassNotFoundException: com.progress.appserv.services.security.OESamlWebSSOProcessingFilter ERROR [Catalina-utility-1] o.a.catalina.core.StandardContext.filterStart - Exception starting filter [springSecurityFilterChain] org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from relative location [spring/oauth2LoginModel.xml] Offending resource: ServletContext resource [/WEB-INF/oeablSecurity.xml]; nested exception is org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from relative location [enableOAuth2ResourceServer.xml] Offending resource: ServletContext resource [/WEB-INF/spring/oauth2LoginModel.xml]; nested exception is org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 255 in XML document from ServletContext resource [/WEB-INF/spring/enableOAuth2ResourceServer.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 255; columnNumber: 66; cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'oauth:resource-server'.

Defect Number

Enhancement Number

Cause

This is expected behavior.

OpenEdge 12.2.15 and later ship with Spring Security Framework 5.8.x, which replaces Spring Security Framework 5.3.x that is shipped with OpenEdge 12.2.14 and earlier. Spring Security Framework 5.8.x includes new Spring Security Framework XML configuration files which are not present in Spring Security Framework 5.3.

Existing PASOE instances are still configured to use the Spring Security Framework 5.3.x XML configuration files which are located in the <PASOE instance>\webapps\<webapp>\WEB-INF\spring directory. So this causes failures during startup since the Spring Security Framework 5.3.x XML configuration files are not fully compatible with Spring Security Framework 5.8.x.

Resolution

Refer to the following documentation for instructions on how to update the Spring Security Framework XML configuration files for existing PASOE instances and their related web applications:
https://docs.progress.com/bundle/pas-for-openedge-management-122/page/OpenEdge-12.2.15-Spring-security-changes.html

The documentation has steps for two scenarios:

If the Spring Security XML configuration files within any of the web applications have not been customized, then follow the steps under the "Standard changes" section.
If the Spring Security XML configuration files have been customized, then follow the steps under the "Custom changes" section.

Workaround

Notes

Progress Article(s):
Webapp configured with OAuth2 fails to start
PASOE fails to start after enabling anonymous access in the enableSamlSecurity.xml file

Keyword Phrase

Last Modified Date

9/1/2024 12:12 AM

After upgrading to OpenEdge 12.2.15 or later a PASOE web application that uses SAML or OAuth2 fails to start

Files(0)

Was this article helpful?

Was this article helpful?

After upgrading to OpenEdge 12.2.15 or later a PASOE web application that uses SAML or OAuth2 fails to start

Information

Related Articles