Concurrency issues in Spring DAOs with 3.0.0.RC1

Question

Hi guys,

After upgrading from Spring 3.0.0.M4 to 3.0.0.RC1 and Spring Security 3.0.0.M2 to 3.0.0.RC1, I've had to use a security:authentication-manager tag instead of defining an _authenticationManager like I used to in M4/M2. I've done my best at defining it, and ended up with this:

<security:authentication-manager alias="authenticationManager">
  <security:authentication-provider user-service-ref="userService">
    <security:password-encoder hash="plaintext"/>
  </security:authentication-provider>
</security:authentication-manager>

When I do my unit tests one at a time, this works great, and for most AJAX requests it works fine as well, but seemingly randomly, I get weird errors in my transactions where my database session seems to get closed midway in the work. The way I can provoke these errors is just sending a lot of different AJAX requests to my different controllers from the same client, then at least one of them will fail at random. Next time I try, that one will work and another will fail.

The error happens most frequently in my userDAO, but also quite frequently in other DAOS, and the exceptions include at least the following:

• "java.sql.SQLException: Operation not allowed after ResultSet closed"
• "org.hibernate.impl.AbstractSessionImpl:errorIfClosed(): Session is closed!"
• "java.lang.NullPointerException at com.mysql.jdbc.PreparedStatement.fillSendPacket(PreparedStatement.java:2439)"
• "java.util.ConcurrentModificationException at java.util.LinkedHashMap$LinkedHashIterator.nextEntry(Unknown Source)"
• "org.hibernate.LazyInitializationException: illegal access to loading collection"
• etc...

Before, I used to define an _authenticationManager bean, and the same requests worked like a charm. But with RC1, I'm no longer allowed to define it. It used to look like this:

<bean id="_authenticationManager" class="org.springframework.security.authentication.ProviderManager">
  <property name="providers">
    <list>
      <bean class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userService"/>
        <property name="passwordEncoder">
          <bean class="org.springframework.security.authentication.encoding.PlaintextPasswordEncoder" />
        </property>
      </bean>
    </list>
  </property>
</bean>

Have I defined my security:authentication-manager incorrectly so that it will share transactions for multiple requests from the same client? Should I define it differently, or should I define some other security: beans?

Is there something I have misunderstood that makes my database sessions close? In my head, each request has its own database connection and transaction. All getters and setters are synchronized methods, so I really shouldn't have any concurrency issues. All the REST controllers that the UI makes requests against are GET-requests and do read-only work. To my knowledge, not a single INSERT/UPDATE/DELETE is done during any of these requests, and I've inspected the database logs to verify this.

I look forward to hearing your suggestions on how to avoid these race-conditions.

Cheers

Nik

PS, my I've updated the question to be more specific that the problem is with the security:authentication-manager (or so it seems to me, if you have tips that it could be something else that would be great) that I'm forced to use instead of my own _authenticationManager starting with 3.0.0.RC1

PPS, here is the thread that made me understand I could no longer define an _authenticationManager: SpringSource Forum Post

Answer 1

It seems that I had a big problem in database session handling in my DAO, so I've made a write-up of my problem and posted the solution in another thread here at StackOverflow and asked for people's opinion on the solution. I hope it doesn't give more issues :-)

Cheers

Nik