# \[Elasticsearch Plugin\] AccessControlException on jackson.databind

**URL:** https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813
**Category:** Elasticsearch
**Created:** [January 24, 2018, 6:46am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813 "2018-01-24T06:46:25Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![varundbest](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varundbest/32/48066_2.png) [@varundbest](https://discuss.elastic.co/u/varundbest)
#### Post date: [January 24, 2018, 6:46am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/1 "2018-01-24T06:46:25Z")

</div>

So as I understand, com.fasterxml.jackson.databind is provided by elasticsearch and we cannot add it in our plugins as it'll lead to jarhell. Now my application is trying to parse JWT tokens but when I try to do so in doPrivileged block, I get greeted with:-

```
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:1.8.0_131]
at java.security.AccessController.checkPermission(AccessController.java:884) ~[?:1.8.0_131]
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) ~[?:1.8.0_131]
at java.lang.Class.checkMemberAccess(Class.java:2348) ~[?:1.8.0_131]
at java.lang.Class.getDeclaredConstructors(Class.java:2019) ~[?:1.8.0_131]
at com.fasterxml.jackson.databind.util.ClassUtil.getConstructors(ClassUtil.java:966) ~[?:?]
at com.fasterxml.jackson.databind.introspect.AnnotatedClass.resolveCreators(AnnotatedClass.java:443) ~[?:?]
at com.fasterxml.jackson.databind.introspect.AnnotatedClass.getStaticMethods(AnnotatedClass.java:314) ~[?:?]
at com.fasterxml.jackson.databind.introspect.BasicBeanDescription.getFactoryMethods(BasicBeanDescription.java:486) ~[?:?]
at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory._addDeserializerFactoryMethods(BasicDeserializerFactory.java:669) ~[?:?]
at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory._constructDefaultValueInstantiator(BasicDeserializerFactory.java:320) ~[?:?]
at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory.findValueInstantiator(BasicDeserializerFactory.java:253) ~[?:?]
at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory.createMapDeserializer(BasicDeserializerFactory.java:1159) ~[?:?]
at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer2(DeserializerCache.java:377) ~[?:?]
at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer(DeserializerCache.java:349) ~[?:?]
at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCache2(DeserializerCache.java:264) ~[?:?]
at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCacheValueDeserializer(DeserializerCache.java:244) ~[?:?]
at com.fasterxml.jackson.databind.deser.DeserializerCache.findValueDeserializer(DeserializerCache.java:142) ~[?:?]
at com.fasterxml.jackson.databind.DeserializationContext.findRootValueDeserializer(DeserializationContext.java:476) ~[?:?]
at com.fasterxml.jackson.databind.ObjectMapper._findRootDeserializer(ObjectMapper.java:3899) ~[?:?]
at com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3765) ~[?:?]
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2123) ~[?:?]
at com.fasterxml.jackson.core.JsonParser.readValueAs(JsonParser.java:1650) ~[jackson-core-2.8.6.jar:2.8.6]
at com.auth0.jwt.impl.JsonNodeClaim.asMap(JsonNodeClaim.java:109) ~[?:?]
at com.fico.elasticsearch.authenticate.accesscontrol.User.lambda$fetchRolesFromToken$0(User.java:23) ~[?:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_131]

```

Code :-

```
Map<String, Object> someMap = AccessController.doPrivileged((PrivilegedAction<Map<String, Object>>) () -> {
  Map<String, Object> temp1 = ((Claim) token.getClaim("some_claim")).asMap();
  return temp1 ;
});

```

Now I do have,  
`permission java.lang.RuntimePermission "accessDeclaredMembers";`

In my plugin-security.policy and other code which relies on "accessDeclaredMembers" works fine but this one doesn't.  
**I suppose this is because the package is not loaded by my Classloader but the parent one. Any insight on this would be great.**

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [January 24, 2018, 7:39am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/2 "2018-01-24T07:39:30Z")

</div>

Can't you use the one (jackson lib I mean) provided in elasticsearch core?

---

<div class="post-metadata">

### Author: ![varundbest](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varundbest/32/48066_2.png) [@varundbest](https://discuss.elastic.co/u/varundbest)
#### Post date: [January 24, 2018, 8:59am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/3 "2018-01-24T08:59:53Z")

</div>

The main issue is that:- The library is being referenced by Auth0's java-jwt and I'm running into AccessControlException despite being inside doPrivileged block.

Edit:  
Btw, if I exclude jackson.databind while building by plugin. I run into :-

> java.lang.NoClassDefFoundError: com/fasterxml/jackson/databind/JsonDeserializer  
> at com.auth0.jwt.JWTDecoder.(JWTDecoder.java:28) ~[?:?]  
> at com.auth0.jwt.JWT.decode(JWT.java:21) ~[?:?]  
> at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:352) ~[?:?]

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [January 24, 2018, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/4 "2018-01-24T09:55:49Z")

</div>

Did you check that `plugin-security.policy` is correctly packaged within your plugin zip?

---

<div class="post-metadata">

### Author: ![varundbest](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varundbest/32/48066_2.png) [@varundbest](https://discuss.elastic.co/u/varundbest)
#### Post date: [January 24, 2018, 12:13pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/5 "2018-01-24T12:13:00Z")

</div>

> [@varundbest](#):
>
> Now I do have,
> 
> permission java.lang.RuntimePermission "accessDeclaredMembers";
> 
> In my plugin-security.policy and other code which relies on "accessDeclaredMembers" works fine but this one doesn't.

I do have,  
`permission java.lang.RuntimePermission "accessDeclaredMembers";`

In my plugin-security.policy and other code which relies on "accessDeclaredMembers" works fine but this one doesn't.

For now, I have found a workaround to using .asMap() method so I don't need any solution anymore but "accessDeclaredMembers" issue still exists.

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [January 24, 2018, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/6 "2018-01-24T12:49:48Z")

</div>

Here is an example where we are doing that:

> <https://github.com/elastic/elasticsearch/blob/ee802ad63c0f21d697a5095dd05dc6f94626ee4d/plugins/discovery-gce/src/main/plugin-metadata/plugin-security.policy#L20-L28>

And a call here:

> <https://github.com/elastic/elasticsearch/blob/ee802ad63c0f21d697a5095dd05dc6f94626ee4d/plugins/discovery-gce/src/main/java/org/elasticsearch/cloud/gce/GceInstancesServiceImpl.java#L150>

Which uses:

> <https://github.com/elastic/elasticsearch/blob/ee802ad63c0f21d697a5095dd05dc6f94626ee4d/plugins/discovery-gce/src/main/java/org/elasticsearch/cloud/gce/util/Access.java#L53-L60>

May be it could help...

---

<div class="post-metadata">

### Author: ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [January 25, 2018, 7:01pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/7 "2018-01-25T19:01:23Z")

</div>

You need to check the entire stack trace for the AccessControlException very carefully. If there is anything on the stack which does not have the accessDeclaredMembers permission, it will fail.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2018, 7:01pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-accesscontrolexception-on-jackson-databind/116813/8 "2018-02-22T19:01:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.