I have tried to integrate this add-on, but could not get it to run. Upon st

Directory Spring Boot Security for Vaadin
21

Of course I can remove the NPE, but the point is that the HomeView should never be executed for users that aren’t logged in. That seems to be exactly the kind of security holes that the ConfigureUIServiceInitListener fixes.

That being said, if I remove the NPE, then the HomeView is shown without any Login whatsoever. The log output:

2020-10-22 15:06:40.281 DEBUG 1984 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Checking access to navigation target '' (some.package.HomeView).
2020-10-22 15:06:40.283 DEBUG 1984 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Forwarding to login route 'login'.
22

Re-reading your last answer makes me think I might have been unclear. The NPE is not happening on the LoginView, that view does not use the AppLayout. It is happening on the HomeView, at which point I assume that there will always be an authenticated user.

23

Okay, a misunderstanding then. Now it makes a bit more sense.

This is what I do after logging “Forwarding to login route…”:

event.forwardTo(loginRoute);

// clear any reroute to avoid error when both are set
if (event.hasRerouteTarget())
  event.rerouteTo((NavigationHandler) null, null);

The only possible explanation I can come up with, is that my forward is somehow canceled afterwards? No idea where that might happen, though.

24

I removed org.ilay (which I used for authorisation before) and now I’m getting this:

2020-10-22 17:31:07.704 DEBUG 7759 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Checking access to navigation target '' (some.package.HomeView).
2020-10-22 17:31:07.705 DEBUG 7759 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Forwarding to login route 'login'.
2020-10-22 17:31:07.706 DEBUG 7759 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Checking access to navigation target '' (com.vaadin.flow.router.InternalServerError).
2020-10-22 17:31:07.706 DEBUG 7759 --- [  XNIO-1 task-1]
 d.c.v.s.s.a.DefaultVaadinAccessControl   : Access granted to error view '' (com.vaadin.flow.router.InternalServerError).

That seems weird - the forwarding to the login route simply doesn’t happen and then the application tries to access the HomeView again, which leads to the NPE.

25

Hmm, I don’t really have any new insights for you. You might just have to do some debugging to see why the forward isn’t executed even though I call the method. You could start in DefaultVaadinAccessControl at line 176 where I call forwardTo(…) and look what happens to the BeforeEnterEvent and why Vaadin doesn’t navigate to the login view.