public user SecurityViolation

will-moore commented 3 years ago

See https://www.openmicroscopy.org/qa2/qa/feedback/29697/

Similar issue to previous "public user workflow crash" (https://github.com/ome/omero-web/pull/154) but this is with load_template() rather than populating jsTree.

In that case, we avoid the SecurityViolation by checking the group in the URL query string. But in the examples below, the failure is coming from admin.getEventContext().

From https://www.openmicroscopy.org/qa2/qa/feedback/30611/

active_group = request.session.get("active_group") or conn.getEventContext().groupId

There is no "active_group" in the Django session, so where is the group ID coming from in User 114 is not a member of group 3 and cannot login? I don't know if this is a public group or not.

Trying to reproduce, using steps on #154 above, but can't get the exceptions below:

File "/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 502, in load_template
url=url, **kwargs)

File "/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 426, in _load_template
conn.getEventContext().groupId)

File "/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2322, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4749, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2126, in handle_exception
e, *args, **kwargs)

File "/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4746, in __call__
return self.f(*args, **kwargs)

File "/omero/web/venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 114 is not a member of group 3 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:535)
at ome.security.basic.EventHandler.doLogin(EventHandler.java:210)

will-moore commented 3 years ago

And https://www.openmicroscopy.org/qa2/qa/feedback/29699/

will-moore commented 3 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/29717/ https://www.openmicroscopy.org/qa2/qa/feedback/29716/ and https://www.openmicroscopy.org/qa2/qa/feedback/29723/ These 3 are all User * is not a member of group 503 and cannot login and don't include web stack trace, just the OMERO exception.

will-moore commented 3 years ago

http://openmicroscopy.org/qa2/qa/feedback/29724/ User 604 is not a member of group 655 and cannot login

will-moore commented 3 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30047/

ome.conditions.SecurityViolation: User 402 is not a member of group 356 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:437)

But don't know what caused this.

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30611/ and https://www.openmicroscopy.org/qa2/qa/feedback/30614/ ome.conditions.SecurityViolation: User 263 is not a member of group 3 and cannot login and 30614 has e-mail address.

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30613/ and https://www.openmicroscopy.org/qa2/qa/feedback/30612/ too!

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30618/ and https://www.openmicroscopy.org/qa2/qa/feedback/30619/ All these are "group 3" and have the same IP address. 30619 Also 30619 has e-mail address.

will-moore commented 2 years ago

SecurityViolation: User 256 is not a member of group 53 and cannot login "This after a reload; in the middle, the group for the user changed."

https://www.openmicroscopy.org/qa2/qa/feedback/30633/

will-moore commented 2 years ago

ome.conditions.SecurityViolation: User 1808 is not a member of group 204 and cannot login in load_template() https://www.openmicroscopy.org/qa2/qa/feedback/30649/. omero-web 5.9.2

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30845/ message = User 1863 is not a member of group 204 and cannot login 5.9.2 ... https://www.openmicroscopy.org/qa2/qa/feedback/30847/ (with e-mail address) message = User 1863 is not a member of group 204 and cannot login

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/30875/ serverStackTrace = ome.conditions.SecurityViolation: User 52 is not a member of group 53 and cannot login

will-moore commented 2 years ago

User 3 is not a member of group 0 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/30900/

will-moore commented 2 years ago


at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)```

https://www.openmicroscopy.org/qa2/qa/feedback/31004/

will-moore commented 2 years ago

See https://www.openmicroscopy.org/qa2/qa/feedback/31078/ (asked for info)

serverExceptionClass = ome.conditions.SecurityViolation
message = User 5961 is not a member of group 2853 and cannot login

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/31095/

File "/home/admin/omerowebvenv/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 5952 is not a member of group 3 and cannot login

Same error from https://www.openmicroscopy.org/qa2/qa/feedback/31096/ (with e-mail address) and https://www.openmicroscopy.org/qa2/qa/feedback/31097/

will-moore commented 2 years ago

I'm not sure whether these errors are due to Public User, or something else (like user being removed from a group while they are logged-in). I tried to remove a user from a group while they were logged-in, but didn't see any of these errors. Also asked the users (for whom we have contact details above) if they have public user configured on their servers.

will-moore commented 2 years ago

https://www.openmicroscopy.org/qa2/qa/feedback/31124/ (no email)

serverExceptionClass = ome.conditions.SecurityViolation
message = User 902 is not a member of group 3 and cannot login

will-moore commented 1 year ago

serverStackTrace = ome.conditions.SecurityViolation: User 3009 is not a member of group 53 and cannot login

https://www.openmicroscopy.org/qa2/qa/feedback/31275/ and https://www.openmicroscopy.org/qa2/qa/feedback/31276/ (same error) and https://www.openmicroscopy.org/qa2/qa/feedback/31277/ (with e-mail address)

will-moore commented 1 year ago

serverStackTrace = ome.conditions.SecurityViolation: User 378 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/31320/

serverStackTrace = ome.conditions.SecurityViolation: User 377 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/31319/

serverStackTrace = ome.conditions.SecurityViolation: User 377 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/31318/

will-moore commented 1 year ago

serverStackTrace = ome.conditions.SecurityViolation: User 367 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/31326/

serverStackTrace = ome.conditions.SecurityViolation: User 377 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/31319/

will-moore commented 1 year ago

serverStackTrace = ome.conditions.SecurityViolation: User 204 is not a member of group 3 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/32532/ https://www.openmicroscopy.org/qa2/qa/feedback/32531/ https://www.openmicroscopy.org/qa2/qa/feedback/32530/

will-moore commented 1 year ago

unknown = ome.conditions.SecurityViolation: User 560 is not a member of group 53 and cannot login

https://www.openmicroscopy.org/qa2/qa/feedback/32941/ https://www.openmicroscopy.org/qa2/qa/feedback/32942/

unknown = ome.conditions.SecurityViolation: User 565 is not a member of group 53 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/32943/

unknown = ome.conditions.SecurityViolation: User 565 is not a member of group 53 and cannot login https://www.openmicroscopy.org/qa2/qa/feedback/32944/

jburel commented 1 year ago

This should be prioritised

will-moore commented 1 year ago

I don't know how to reproduce the bug so it's hard to address. One idea is to improve the QA reporting from webclient so that we have more info on what caused the problem (if that's possible) since we only have stacktrace above, not URL etc.

will-moore commented 1 year ago

So, I can reproduce the exception above by logging-in as Admin in a different Browser when also logged-in as a regular user and removing that user from a group that they are currently working in. This doesn't seem to break the ability for them to load data (queries use group -1) but if they try to create e.g. a Project then or add Comment to Dataset etc we get the SecurityViolation above.

Exceptions

Create Project ``` Traceback (most recent call last): File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner response = get_response(request) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 181, in _get_response response = wrapped_callback(request, *callback_args, **callback_kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 538, in wrapped retval = f(request, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 597, in wrapper context = f(request, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 2902, in manage_action_containers folder_type, name, description, owner=owner File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 747, in createContainer oid = self.saveAndReturnId(c, owner=owner) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 1685, in saveAndReturnId res = u.saveAndReturnObject(obj, ctx) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4866, in __call__ return self.handle_exception(e, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2127, in handle_exception super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4863, in __call__ return self.f(*args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero_api_IUpdate_ice.py", line 163, in saveAndReturnObject return _M_omero.api.IUpdate._op_saveAndReturnObject.invoke(self, ((obj, ), _ctx)) omero.SecurityViolation: exception ::omero::SecurityViolation { serverStackTrace = ome.conditions.SecurityViolation: User 454 is not a member of group 2553 and cannot login at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514) at ome.security.basic.EventHandler.doLogin(EventHandler.java:210) at ome.security.basic.EventHandler.invoke(EventHandler.java:146) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.orm.hibernate3.HibernateInterceptor.invoke(HibernateInterceptor.java:119) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282) at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.tools.hibernate.ProxyCleanupFilter$Interceptor.invoke(ProxyCleanupFilter.java:249) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.services.util.ServiceHandler.invoke(ServiceHandler.java:121) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy99.saveAndReturnObject(Unknown Source) at sun.reflect.GeneratedMethodAccessor435.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) at ome.security.basic.BasicSecurityWiring.invoke(BasicSecurityWiring.java:93) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.services.blitz.fire.AopContextInitializer.invoke(AopContextInitializer.java:43) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy99.saveAndReturnObject(Unknown Source) at sun.reflect.GeneratedMethodAccessor459.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at ome.services.blitz.util.IceMethodInvoker.invoke(IceMethodInvoker.java:172) at ome.services.throttling.Callback.run(Callback.java:56) at ome.services.throttling.InThreadThrottlingStrategy.callInvokerOnRawArgs(InThreadThrottlingStrategy.java:56) at ome.services.blitz.impl.AbstractAmdServant.callInvokerOnRawArgs(AbstractAmdServant.java:140) at ome.services.blitz.impl.UpdateI.saveAndReturnObject_async(UpdateI.java:62) at sun.reflect.GeneratedMethodAccessor458.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) at omero.cmd.CallContext.invoke(CallContext.java:85) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy100.saveAndReturnObject_async(Unknown Source) at omero.api._IUpdateTie.saveAndReturnObject_async(_IUpdateTie.java:92) at omero.api._IUpdateDisp.___saveAndReturnObject(_IUpdateDisp.java:227) at omero.api._IUpdateDisp.__dispatch(_IUpdateDisp.java:422) at IceInternal.Incoming.invoke(Incoming.java:221) at Ice.ConnectionI.invokeAll(ConnectionI.java:2536) at Ice.ConnectionI.dispatch(ConnectionI.java:1145) at Ice.ConnectionI.message(ConnectionI.java:1056) at IceInternal.ThreadPool.run(ThreadPool.java:395) at IceInternal.ThreadPool.access$300(ThreadPool.java:12) at IceInternal.ThreadPool$EventHandlerThread.run(ThreadPool.java:832) at java.lang.Thread.run(Thread.java:748) serverExceptionClass = ome.conditions.SecurityViolation message = User 454 is not a member of group 2553 and cannot login } ``` Add Comment ``` Traceback (most recent call last): File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner response = get_response(request) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 181, in _get_response response = wrapped_callback(request, *callback_args, **callback_kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 538, in wrapped retval = f(request, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 597, in wrapper context = f(request, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 2507, in annotate_comment annId = manager.createCommentAnnotations(content, oids) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/controller/container.py", line 604, in createCommentAnnotations ann = self.conn.saveAndReturnObject(ann) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 1661, in saveAndReturnObject res = u.saveAndReturnObject(obj, ctx) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4866, in __call__ return self.handle_exception(e, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2127, in handle_exception super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4863, in __call__ return self.f(*args, **kwargs) File "/home/omero/workspace/OMERO-web/.venv3/lib64/python3.6/site-packages/omero_api_IUpdate_ice.py", line 163, in saveAndReturnObject return _M_omero.api.IUpdate._op_saveAndReturnObject.invoke(self, ((obj, ), _ctx)) omero.SecurityViolation: exception ::omero::SecurityViolation { serverStackTrace = ome.conditions.SecurityViolation: User 454 is not a member of group 2553 and cannot login at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514) at ome.security.basic.EventHandler.doLogin(EventHandler.java:210) at ome.security.basic.EventHandler.invoke(EventHandler.java:146) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.orm.hibernate3.HibernateInterceptor.invoke(HibernateInterceptor.java:119) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:282) at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.tools.hibernate.ProxyCleanupFilter$Interceptor.invoke(ProxyCleanupFilter.java:249) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.services.util.ServiceHandler.invoke(ServiceHandler.java:121) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy99.saveAndReturnObject(Unknown Source) at sun.reflect.GeneratedMethodAccessor435.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) at ome.security.basic.BasicSecurityWiring.invoke(BasicSecurityWiring.java:93) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at ome.services.blitz.fire.AopContextInitializer.invoke(AopContextInitializer.java:43) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy99.saveAndReturnObject(Unknown Source) at sun.reflect.GeneratedMethodAccessor459.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at ome.services.blitz.util.IceMethodInvoker.invoke(IceMethodInvoker.java:172) at ome.services.throttling.Callback.run(Callback.java:56) at ome.services.throttling.InThreadThrottlingStrategy.callInvokerOnRawArgs(InThreadThrottlingStrategy.java:56) at ome.services.blitz.impl.AbstractAmdServant.callInvokerOnRawArgs(AbstractAmdServant.java:140) at ome.services.blitz.impl.UpdateI.saveAndReturnObject_async(UpdateI.java:62) at sun.reflect.GeneratedMethodAccessor458.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) at omero.cmd.CallContext.invoke(CallContext.java:85) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy100.saveAndReturnObject_async(Unknown Source) at omero.api._IUpdateTie.saveAndReturnObject_async(_IUpdateTie.java:92) at omero.api._IUpdateDisp.___saveAndReturnObject(_IUpdateDisp.java:227) at omero.api._IUpdateDisp.__dispatch(_IUpdateDisp.java:422) at IceInternal.Incoming.invoke(Incoming.java:221) at Ice.ConnectionI.invokeAll(ConnectionI.java:2536) at Ice.ConnectionI.dispatch(ConnectionI.java:1145) at Ice.ConnectionI.message(ConnectionI.java:1056) at IceInternal.ThreadPool.run(ThreadPool.java:395) at IceInternal.ThreadPool.access$300(ThreadPool.java:12) at IceInternal.ThreadPool$EventHandlerThread.run(ThreadPool.java:832) at java.lang.Thread.run(Thread.java:748) serverExceptionClass = ome.conditions.SecurityViolation message = User 454 is not a member of group 2553 and cannot login } ```

So, if this is representative of the errors above, how do we fix it?

When creating a new top level object, e.g. Project, we use @login_required(setGroupContext=True) to know which group to add this to. In this case we could teach the decorator to check that the user is currently a member of that group.
For adding e.g. a Comment the first object to be annotated is used to set the context: conn.SERVICE_OPTS.setOmeroGroup(obs[0].getDetails().group.id.val) so at this point we could check group.

In both cases, if user isn't a member of the group, we could return HttpResponseForbidden as we do in a related fix at https://github.com/ome/omero-web/pull/154

However, when I refresh the page for regular user in the scenario above, it simply tries to re-load the group that they've just been removed from (I guess setGroupContext is still set to the group they've been removed from). This in turn returns a 403 trying to load the tree and the page refreshes -> infinite loop! So we need to also update the session group before returning HttpResponseForbidden.

will-moore commented 1 year ago

I also see the SecurityViolation coming from load_template() at 32941

https://www.openmicroscopy.org/qa2/qa/feedback/30613/

https://github.com/ome/omero-web/blob/ac66db9274b1ab80b270c8b8fe36dfa55b0e9a75/omeroweb/webclient/views.py#L495

https://www.openmicroscopy.org/qa2/qa/feedback/30611

https://github.com/ome/omero-web/blob/ac66db9274b1ab80b270c8b8fe36dfa55b0e9a75/omeroweb/webclient/views.py#L493

will-moore commented 1 year ago

Quite a few errors come from the conn.getEventContext() (L493 above), which is possibly due to their context changing on the server (being removed from group) but their session still remembers a previous group?

Haven't been able to reproduce this.

will-moore commented 1 year ago

@joshmoore Any idea how to reproduce admin.getEventContext() throwing serverStackTrace = ome.conditions.SecurityViolation: User 257 is not a member of group 3 and cannot login ?

joshmoore commented 1 year ago

The relevant code is:

https://github.com/ome/omero-server/blob/master/src/main/java/ome/security/basic/BasicSecuritySystem.java#L511-L518

            // tickets:2950, 1940, 3529
            if (!isAdmin && !ec.getMemberOfGroupsList().contains(groupId)) {
                if (!callPerms.isGranted(Role.WORLD, Right.READ)) {
                    throw new SecurityViolation(String.format(
                        "User %s is not a member of group %s and cannot login",
                                ec.getCurrentUserId(), groupId));
                }
            }

so there is the additional code path of the group not being world readable. Note: higher up the group is positive so this should be a group=-1 code path ... unless a switch happened in the middle of this call?!

will-moore commented 1 year ago

From that code I see:

ec = cd.getCurrentEventContext(); // Replace with callContext
final long groupId = ec.getCurrentGroupId();

so we're getting this bug when ec.getCurrentGroupId() returns a group that the user isn't a member of. Presumably this must be because they've just been removed from that group? Is there any other way that could happen? It seems that we're seeing that error quite a bit, and it can't be very often that a user is removed from a group while logged-in. Also, I didn't manage to reproduce that error above by removing user from a group while they were logged-in. I only got an error on u.saveAndReturnObject(obj, ctx).

will-moore commented 1 year ago

https://www.openmicroscopy.org/qa2/qa/feedback/32950/ unknown = ome.conditions.SecurityViolation: User 3475 is not a member of group 53 and cannot login

will-moore commented 1 year ago

https://www.openmicroscopy.org/qa2/qa/feedback/32951/

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 496, in _load_template
leaders, members = conn.getObject("ExperimenterGroup", active_group).groupSummary()

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 3271, in getObject
result = self.getQueryService().findByQuery(

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5101, in __getattr__
obj = self._obj or self._getObj()

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5032, in _getObj
self._obj = self._create_func()

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5008, in cf
obj = getattr(self._conn.c.sf, self._func_str)()

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero_API_ice.py", line 758, in getQueryService
return _M_omero.api.ServiceFactory._op_getQueryService.invoke(self, ((), _ctx))

Ice.UnknownException: exception ::Ice::UnknownException
{
unknown = ome.conditions.SecurityViolation: User 3475 is not a member of group 53 and cannot login

will-moore commented 1 year ago

https://www.openmicroscopy.org/qa2/qa/feedback/32954/

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 3476 is not a member of group 53 and cannot login

will-moore commented 1 year ago

https://www.openmicroscopy.org/qa2/qa/feedback/33045/

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 3663 is not a member of group 53 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)

will-moore commented 1 year ago

unknown = ome.conditions.SecurityViolation: User 3303 is not a member of group 53 and cannot login

https://www.openmicroscopy.org/qa2/qa/feedback/33451/

will-moore commented 9 months ago

https://www.openmicroscopy.org/qa2/qa/feedback/40290/

Traceback (most recent call last):
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 41, in inner
response = get_response(request)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 187, in _get_response
response = self.process_exception_by_middleware(e, request)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 185, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 560, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 480, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2323, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4796, in __call__
return self.handle_exception(e, *args, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2222, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4793, in __call__
return self.f(*args, **kwargs)
File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))
omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 7161 is not a member of group 3 and cannot login

will-moore commented 9 months ago

https://www.openmicroscopy.org/qa2/qa/feedback/40300/

Traceback (most recent call last):

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner
response = get_response(request)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 181, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 577, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 497, in _load_template
leaders, members = conn.getObject("ExperimenterGroup", active_group).groupSummary()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 3271, in getObject
result = self.getQueryService().findByQuery(

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5102, in __getattr__
obj = self._obj or self._getObj()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5033, in _getObj
self._obj = self._create_func()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5009, in cf
obj = getattr(self._conn.c.sf, self._func_str)()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero_API_ice.py", line 758, in getQueryService
return _M_omero.api.ServiceFactory._op_getQueryService.invoke(self, ((), _ctx))

Ice.UnknownException: exception ::Ice::UnknownException
{
unknown = ome.conditions.SecurityViolation: User 102 is not a member of group 53 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)

will-moore commented 5 months ago

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 560, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 480, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2323, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4796, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2222, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4793, in __call__
return self.f(*args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 7704 is not a member of group 3 and cannot login

https://www.openmicroscopy.org/qa2/qa/feedback/41312/

will-moore commented 3 months ago

Web 5.24.0

Traceback (most recent call last):

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/exception.py", line 55, in inner
response = get_response(request)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/base.py", line 197, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/views.py", line 591, in group_user_content
myGroups = list(conn.getGroupsMemberOf())

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 2953, in getGroupsMemberOf
for g in self.getObjects("ExperimenterGroup",

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 3306, in getObjects
result = qs.findAllByQuery(query, params, self.SERVICE_OPTS)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5102, in __getattr__
obj = self._obj or self._getObj()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5033, in _getObj
self._obj = self._create_func()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5009, in cf
obj = getattr(self._conn.c.sf, self._func_str)()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero_API_ice.py", line 758, in getQueryService
return _M_omero.api.ServiceFactory._op_getQueryService.invoke(self, ((), _ctx))

Ice.UnknownException: exception ::Ice::UnknownException
{
unknown = ome.conditions.SecurityViolation: User 2 is not a member of group 0 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)

https://www.openmicroscopy.org/qa2/qa/feedback/41506/

will-moore commented 2 months ago

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 578, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 496, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2323, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4859, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2123, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4856, in __call__
return self.f(*args, **kwargs)

File "/mnt/data/OMERO.venv/web_venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 4103 is not a member of group 53 and cannot login

https://www.openmicroscopy.org/qa2/qa/feedback/41577/

will-moore commented 2 months ago

https://www.openmicroscopy.org/qa2/qa/feedback/41634/

Traceback (most recent call last):

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 41, in inner
response = get_response(request)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 187, in _get_response
response = self.process_exception_by_middleware(e, request)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/django/core/handlers/base.py", line 185, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 560, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 480, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2323, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4796, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2222, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4793, in __call__
return self.f(*args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 8053 is not a member of group 3 and cannot login

will-moore commented 1 month ago

https://www.openmicroscopy.org/qa2/qa/feedback/41658/


File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 577, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 497, in _load_template
leaders, members = conn.getObject("ExperimenterGroup", active_group).groupSummary()

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 3271, in getObject
result = self.getQueryService().findByQuery(

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5102, in __getattr__
obj = self._obj or self._getObj()

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5033, in _getObj
self._obj = self._create_func()

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 5009, in cf
obj = getattr(self._conn.c.sf, self._func_str)()

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero_API_ice.py", line 758, in getQueryService
return _M_omero.api.ServiceFactory._op_getQueryService.invoke(self, ((), _ctx))

Ice.UnknownException: exception ::Ice::UnknownException
{
unknown = ome.conditions.SecurityViolation: User 3410 is not a member of group 204 and cannot login

will-moore commented 3 weeks ago

https://www.openmicroscopy.org/qa2/qa/feedback/41700/

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 577, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/views.py", line 495, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 2323, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4859, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omeroweb/webclient/webclient_gateway.py", line 2123, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero/gateway/__init__.py", line 4856, in __call__
return self.f(*args, **kwargs)

File "/luci/data0/omero/web/venv3/lib64/python3.6/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 862 is not a member of group 3 and cannot login

will-moore commented 1 week ago

https://www.openmicroscopy.org/qa2/qa/feedback/41740/ - with contact details

Traceback (most recent call last):

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/exception.py", line 55, in inner
response = get_response(request)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/base.py", line 197, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/views.py", line 572, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/views.py", line 490, in _load_template
active_group = request.session.get("active_group") or conn.getEventContext().groupId

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 2326, in getEventContext
self._ctx = self._proxies['admin'].getEventContext()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 4862, in __call__
return self.handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/webclient_gateway.py", line 2106, in handle_exception
super(OmeroWebSafeCallWrapper, self).handle_exception(e, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 4859, in __call__
return self.f(*args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero_api_IAdmin_ice.py", line 2655, in getEventContext
return _M_omero.api.IAdmin._op_getEventContext.invoke(self, ((), _ctx))

omero.SecurityViolation: exception ::omero::SecurityViolation
{
serverStackTrace = ome.conditions.SecurityViolation: User 1254 is not a member of group 154 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)

will-moore commented 5 days ago

https://www.openmicroscopy.org/qa2/qa/feedback/41742/

Traceback (most recent call last):

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/exception.py", line 55, in inner
response = get_response(request)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/django/core/handlers/base.py", line 197, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 538, in wrapped
retval = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/decorators.py", line 597, in wrapper
context = f(request, *args, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/views.py", line 572, in load_template
return _load_template(request=request, menu=menu, conn=conn, url=url, **kwargs)

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omeroweb/webclient/views.py", line 492, in _load_template
leaders, members = conn.getObject("ExperimenterGroup", active_group).groupSummary()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 3274, in getObject
result = self.getQueryService().findByQuery(

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5105, in __getattr__
obj = self._obj or self._getObj()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5036, in _getObj
self._obj = self._create_func()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero/gateway/__init__.py", line 5012, in cf
obj = getattr(self._conn.c.sf, self._func_str)()

File "/opt/omero/web/venv3/lib64/python3.9/site-packages/omero_API_ice.py", line 758, in getQueryService
return _M_omero.api.ServiceFactory._op_getQueryService.invoke(self, ((), _ctx))

Ice.UnknownException: exception ::Ice::UnknownException
{
unknown = ome.conditions.SecurityViolation: User 4259 is not a member of group 53 and cannot login
at ome.security.basic.BasicSecuritySystem.loadEventContext(BasicSecuritySystem.java:514)

ome / omero-web

public user SecurityViolation #242