Glassfish / Payara javax.ejb.AccessLocalException：客户端未授权在 server.log 中进行此调用

Glassfish / Payara javax.ejb.AccessLocalException: Client not authorized for this invocation in server.log

提问by james

I was trying figure out the cause of another exception for my dynamic web app here - https://github.com/double-whammy/affablebeanI made a small change and I got a new exception - javax.ejb.AccessLocalException: Client not authorized for this invocation

我试图在这里找出我的动态 Web 应用程序的另一个异常的原因 - https://github.com/double-whammy/affablebean我做了一个小的改变，我得到了一个新的异常 - javax.ejb.AccessLocalException: Client not授权此调用

An online answer says that I do the following - http://ask.ozar.net/11/javax-accesslocalexception-client-authorized-invocation

在线答案说我执行以下操作 - http://ask.ozar.net/11/javax-accesslocalexception-client-authorized-invocation

Try deleting the generated policy file(s). You should be able to locate them under C:\glassfish-3\glassfish\domains\domain1\generated\policy. substitute your domain name with domain1

尝试删除生成的策略文件。您应该能够在 C:\glassfish-3\glassfish\domains\domain1\generated\policy 下找到它们。用 domain1 替换您的域名

Another says more - http://glassfish.10926.n7.nabble.com/Persisting-Entity-javax-ejb-AccessLocalException-Client-not-authorized-for-this-invocation-td11197.html

另一个说更多 - http://glassfish.10926.n7.nabble.com/Persisting-Entity-javax-ejb-AccessLocalException-Client-not-authorized-for-this-invocation-td11197.html

you can find the policy file under domains/domainx/generated/policy///{granted.policy,excluded.poliy} positive grants are in granted.policy, negative grants are in excluded.policy (if any). (In domaninx, x =1,2,3 etc...)

您可以在domains/domainx/generated/policy///{granted.policy,excluded.poliy}下找到策略文件，正授权在granted.policy，负授权在excluded.policy（如果有）。（在域中，x = 1,2,3 等...）

look in granted.policy for an "unqualified grant of an EJBMethodPermission, with name = the EJbName of your session bean; which I think may be JpaPersonDao. and with a method spec that applies to the save method.

在 grant.policy 中查找“EJBMethodPermission 的非限定授权，名称 = 会话 bean 的 EJbName；我认为这可能是 JpaPersonDao。并且具有适用于 save 方法的方法规范。

---

---

I tried the second one and I see many folders under my glassfish folder: C:\glassfish4\glassfish\domains\domain1\generated\policy

我尝试了第二个，我在我的 glassfish 文件夹下看到了许多文件夹：C:\glassfish4\glassfish\domains\domain1\generated\policy

C:.
├───AffableBean
│   ├───AffableBean
│   │       granted.policy
│   │
│   └───AffableBean_internal
│           granted.policy
│
├───__admingui
│   └───__admingui
│           excluded.policy
│           granted.policy
│
└───__default-web-module
└───__default-web-module
        granted.policy

As you can see, there are so many granted.policy files. Which one should I fix ? Is it the one under first folder ?

正如您所看到的，有很多 grant.policy 文件。我应该修哪一个？它是第一个文件夹下的那个吗？

回答by Ilario Junior

I think the root problem is because of cache of glassfish server because you make some modification in the existing EJB class.

我认为根本问题是因为 glassfish 服务器的缓存，因为您对现有的 EJB 类进行了一些修改。

To solve this problem you just need to clear folder/directory "generated" in domain folder, and restart your glassfish server to refresh.

要解决此问题，您只需清除域文件夹中“生成”的文件夹/目录，然后重新启动 glassfish 服务器以刷新。

回答by Gilbert Lopez

I resolved this by redeploying the application. In NetBeans, right-click the project and select Clean and Build. Run your application and voila!

我通过重新部署应用程序解决了这个问题。在 NetBeans 中，右键单击该项目并选择 Clean and Build。运行您的应用程序，瞧！

回答by Tinily

I met same issue. And fixed by deleting folder domains/domainx/generated/policy/{appName}/ and restart.

我遇到了同样的问题。并通过删除文件夹 domain/domainx/generated/policy/{appName}/ 并重新启动来修复。

回答by thomasso

llario Junior solution worked for me but I have also deleted all files in the glassfish applications directory. The path is glassfish\domains{domainname}\applications

llario Junior 解决方案对我有用，但我也删除了 glassfish 应用程序目录中的所有文件。路径是 glassfish\domains{domainname}\applications

回答by yesplease

I have also seen the same error after:

之后我也看到了同样的错误：

1. making security changes to the http-listener-2 of the server config: namely, disabling the older TLS protocols and some older Cipher suites, and then
2. restarting glassfish.

1. 对服务器配置的 http-listener-2 进行安全更改：即禁用旧的 TLS 协议和一些旧的密码套件，然后
2. 重新启动 glassfish。

I'm running Payara 4.1.2.174. I likewise found a way to fix the problem was to:

我正在运行 Payara 4.1.2.174。我同样找到了解决问题的方法是：

1. stop the server
2. delete the contents of the domains/DOMAIN_NAME/generatedfolder, then
3. start the server again

1. 停止服务器
2. 删除domains/DOMAIN_NAME/generated文件夹的内容，然后
3. 再次启动服务器

Some documentation for glassfish 3.1.2.2 still seems relevant: according to the Glassfish Server High Availability Administration Guide, section Default Synchronization for files and directories, the folders applicationand generatedfollow these rules:

glassfish 3.1.2.2 的一些文档似乎仍然相关：根据Glassfish 服务器高可用性管理指南，文件和目录的默认同步部分，文件夹application并generated遵循以下规则：

application

By default, only a change to an application's top-level directory within the application directory causes the DAS to synchronize that application's directory. When the DAS resynchronizes the applications directory, all the application's files and all generated content that is related to the application are copied to the instance.

If a file below a top-level subdirectory is changed without a change to a file in the top-level subdirectory, full synchronization is required. In normal operation, files below the top-level subdirectories of these directories are not changed and such files should not be changed by users. If an application is deployed and undeployed, full synchronization is not necessary to update the instance with the change.

generated

This directory contains generated files for Java EE applications and modules, for example, EJB stubs, compiled JSP classes, and security policy files. Do not modify the contents of this directory.

This directory is resynchronized when the applications directory is resynchronized. Therefore, only directories for applications that are deployed to the instance are resynchronized.

application

默认情况下，只有在应用程序目录中更改应用程序的顶级目录才会导致 DAS 同步该应用程序的目录。当 DAS 重新同步应用程序目录时，所有应用程序的文件以及与应用程序相关的所有生成的内容都将复制到实例中。

如果顶级子目录下的文件发生更改，而顶级子目录中的文件没有更改，则需要完全同步。在正常操作中，这些目录的顶级子目录下的文件不会被更改，用户不应更改此类文件。如果部署和取消部署应用程序，则无需完全同步即可使用更改更新实例。

generated

此目录包含为 Java EE 应用程序和模块生成的文件，例如 EJB 存根、编译的 JSP 类和安全策略文件。不要修改此目录的内容。

重新同步应用程序目录时，将重新同步此目录。因此，仅重新同步部署到实例的应用程序的目录。

By which I understand that the generateddirectory will only be re-generated if the applicationdirectory is.

根据我的理解，generated只有在目录存在时才会重新生成application目录。

回答by Paul Wasilewski

To redeploy the application or to restart the server/domain is working but might be the steamroller approach which causes an outage of all deployed applications.

重新部署应用程序或重新启动服务器/域是可行的，但可能是导致所有已部署应用程序中断的压路机方法。

To avoid an outage of the whole server/domain you can simply reload the affected application.

为避免整个服务器/域中断，您只需重新加载受影响的应用程序即可。

You can recognize the affected application by the warning message in the server.logwhich shows the concrete EJB and inaccessible method.

您可以通过 中的警告消息识别受影响的应用程序，server.log其中显示了具体的 EJB 和不可访问的方法。

[#|2009-12-18T20:03:38.788+0100|WARNING|glassfishv3.0|javax.enterprise.system.container.ejb.com.sun.ejb.containers|_ThreadID=25;_ThreadName=http-thread-pool-8080-(2);|A system exception occurred during an invocation on EJB ExampleEJB method public void com.example.ExampleEJB.method(java.lang.String)javax.ejb.AccessLocalException: Client not authorized for this invocation.

[#|2009-12-18T20:03:38.788+0100|警告|glassfishv3.0|javax.enterprise.system.container.ejb.com.sun.ejb.containers|_ThreadID=25;_ThreadName=http-thread-pool -8080-(2);|在调用EJB ExampleEJB 方法时发生系统异常public void com.example.ExampleEJB.method(java.lang.String)javax.ejb.AccessLocalException: 客户端未授权进行此调用。

It's possible to reload an application the admin console (default accessible through <server-ip>:4848) or via the asadmincommand by

可以通过管理控制台（默认可通过<server-ip>:4848）或通过以下asadmin命令重新加载应用程序

asadmin disable <application-name>
asadmin enable <application-name>

If the reload alone doesn't work you have to delete the granted.policyfile of the affected application under <domain-root-dir>/<domain-name>/generated/policy/<application-name>first an then reload the application.

如果单独重新加载不起作用，您必须首先删除granted.policy受影响应用程序的文件，<domain-root-dir>/<domain-name>/generated/policy/<application-name>然后重新加载该应用程序。

Please note, sometimes this is not an error. In case you have setup EJB security and your client has insufficient rights respective an insufficient role to access the EJB method this warning message could be raised as well. If this is the case then you need to ensure that your client has the appropriate roleassigned to execute the method.

请注意，有时这不是错误。如果您已经设置了 EJB 安全性，并且您的客户端没有足够的权限，也没有足够的角色来访问 EJB 方法，也可能会引发此警告消息。如果是这种情况，那么您需要确保您的客户端有适当的role分配来执行该方法。