Tomcat ClassCastException 由于 ClassLoaders

Question

I am having some trouble implementing my own authentication filter in Tomcat. When I deploy the project I get the following log:

Caused by: java.lang.ClassCastException: class com.somename.sec.sso.camunda.KeycloakSSOAuthenticationProvider cannot be cast to class org.camunda.bpm.engine.rest.security.auth.AuthenticationProvider (com.somename.sec.sso.camunda.KeycloakSSOAuthenticationProvider is in unnamed module of loader java.net.URLClassLoader @6fc6f14e; org.camunda.bpm.engine.rest.security.auth.AuthenticationProvider is in unnamed module of loader org.apache.catalina.loader.ParallelWebappClassLoader @7a498efa)

Which is weird, since my KeycloakSSOAuthenticationProvider implements AuthenticationProvider. Apparently the casting fails due to the different Class Loaders. I suppose the casting fails in my web.xml file when I define the Authentication Filter:

<!-- Container Based Authentication filter -->
  <filter>
    <filter-name>Container Based Authentication Filter</filter-name>
    <filter-class>org.camunda.bpm.webapp.impl.security.auth.ContainerBasedAuthenticationFilter</filter-class>
    <init-param>
      <param-name>authentication-provider</param-name>
      <param-value>com.somename.sec.sso.camunda.KeycloakSSOAuthenticationProvider</param-value>
    </init-param>
  </filter>

Is there a way to force KeycloakSSOAuthenticationProvider to be loaded with the same class loader as AuthenticationProvider ? Or how should I approach this problem?

Answer 1

I was having similar casting errors with Keycloak. The issue for me was that part of the set up for running keycloak on Tomcat (not embedded tomcat) you have to copy a number of keycloak library files into the tomcat_home/lib directory. You then also need those libs available to your java code, so they were included in the POM file as well.

The solution was to set the <scope>provided</scope> for the keycloak dependencies in the pom file. That way the code would compile, but there wouldn't be two versions of the class on the classpath while running.