68479 - The GemfireBasedTicketCache cache locator can fail with the error "ClassCastException" in a clustered SAS® 9.4 middle-tier environment

Problem Note 68479: The GemfireBasedTicketCache cache locator can fail with the error "ClassCastException" in a clustered SAS® 9.4 middle-tier environment

When you use the GemfireBasedTicketCache cache locator in a SAS 9.4 web application to share service tickets, a ClassCastException error can be generated. This error occurs when these conditions are true:

You run the locator in cluster.
Multiple web applications are deployed to the same instance of Apache Tomcat
Service tickets are created and are used in REST API calls rather than in service-to-service calls.

The error that occurs is shown below:

10:02:22,321 | ERROR | [[REST MVC Servlet]] | Servlet.service() for servlet [REST MVC Servlet] in context with path [/SASRiskGovernanceFramework] threw exception

java.lang.ClassCastException: org.springframework.security.cas.authentication.CasAuthenticationToken cannot be cast to org.springframework.security.cas.authentication.CasAuthenticationToken

    at com.sas.svcs.security.authentication.ticket.cache.GemFireBasedTicketCache.getByTicketId(GemFireBasedTicketCache.java:30)

    at org.springframework.security.cas.authentication.CasAuthenticationProvider.authenticate(CasAuthenticationProvider.java:122)

    at com.sas.svcs.security.authentication.provider.AuthenticationProvider.authenticate(AuthenticationProvider.java:85)

    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)

    at org.springframework.security.cas.web.CasAuthenticationFilter.attemptAuthentication(CasAuthenticationFilter.java:242)

    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:194)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)

    at com.sas.svcs.security.authentication.session.jasig.SingleSignOutFilter.doFilterInternal(SingleSignOutFilter.java:60)

    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)

    at com.sas.svcs.security.authentication.web.filters.RevokableTokenLogoutFilter.doFilter(RevokableTokenLogoutFilter.java:38)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)

    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

Product Family	Product	System	Product Release		SAS Release
			Reported	Fixed*	Reported	Fixed*
SAS System	SAS Cache Locator	Microsoft® Windows® for x64	9.4
		Linux for x64	9.4

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

Type:	Problem Note
Priority:	high

Date Modified:	2021-10-06 12:13:56
Date Created:	2021-10-05 09:57:38

Support

Problem Note 68479: The GemfireBasedTicketCache cache locator can fail with the error "ClassCastException" in a clustered SAS® 9.4 middle-tier environment

Operating System and Release Information