No Hibernate Session bound to thread, and configuration does not allow creation of non-transactional

[juniad Ahmed]

Hi Guys,

I know this question has been asked before, but i could not find a solution for my problem.

I am implementing Spring security with database authentication. When i launch the application, login page is displayed, but when i click on submit, it gives No Hibernate Session bound to thread exception.

Please guys help me out.

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:mvc="http://www.springframework.org/schema/mvc"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
	   		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
	   		http://www.springframework.org/schema/context
	   		http://www.springframework.org/schema/context/spring-context-3.0.xsd
			http://www.springframework.org/schema/mvc 
			http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
	
	<!-- Activates various annotations to be detected in bean classes -->
	<context:annotation-config />
	
	<!-- Scans the classpath for annotated components that will be auto-registered as Spring beans.
	 For example @Controller and @Service. Make sure to set the correct base-package-->
	<context:component-scan base-package="org.krams.tutorial" />
	
	<!-- Configures the annotation-driven Spring MVC Controller programming model.
	Note that, with Spring 3.0, this tag works in Servlet MVC only!  -->
	<mvc:annotation-driven /> 
        
        
        <bean id="myDataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
		<property name="driverClassName" value="org.apache.derby.jdbc.ClientDriver"/>
		<property name="url" value="jdbc:derby://localhost:1527/hibernate"/>
		<property name="username" value="root"/>
		<property name="password" value="root"/>
	</bean>
	
	<bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
		<property name="dataSource" ref="myDataSource" />
		<property name="annotatedClasses">
			<list>
				<value>org.krams.tutorial.domain.Person</value>
                                <value>org.krams.tutorial.domain.UserRole</value>
			</list>
		</property>
		<property name="hibernateProperties">
			<props>
				<prop key="hibernate.dialect">org.hibernate.dialect.DerbyDialect</prop>
				<prop key="hibernate.show_sql">true</prop>
				<prop key="hibernate.hbm2ddl.auto">update</prop>
			</props>
		</property>
	</bean>

        
        <bean id="transactionManager" class="org.springframework.orm.hibernate3.HibernateTransactionManager">
          <property name="sessionFactory" ref="sessionFactory" />
        </bean>
    

	
</beans>

========================================================================================================================

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
	   		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
			http://www.springframework.org/schema/security 
			http://www.springframework.org/schema/security/spring-security-3.0.xsd">
	
	<!-- This is where we configure Spring-Security  -->
	<security:http auto-config="true" use-expressions="true" access-denied-page="/krams/auth/denied" >
	
		<security:intercept-url pattern="/krams/auth/login" access="permitAll"/>
		<security:intercept-url pattern="/krams/main/admin" access="hasRole('ROLE_ADMIN')"/>
		<security:intercept-url pattern="/krams/main/common" access="hasRole('ROLE_USER')"/>
		
		<security:form-login
				login-page="/krams/auth/login" 
				authentication-failure-url="/krams/auth/login?error=true" 
				default-target-url="/krams/main/common"/>
			
		<security:logout 
				invalidate-session="true" 
				logout-success-url="/krams/auth/login" 
				logout-url="/krams/auth/logout"/>
	
	</security:http>
	
	<!-- Declare an authentication-manager to use a custom userDetailsService -->
	<bean id="daoAuthenticationProvider"
 class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
  <property name="userDetailsService" ref="userDetailsService"/>
</bean>

<bean id="authenticationManager"
    class="org.springframework.security.authentication.ProviderManager">
  <property name="providers">
    <list>
      <ref local="daoAuthenticationProvider" />
    </list>
  </property>
</bean>

<security:authentication-manager>
  <security:authentication-provider user-service-ref="userDetailsService">
    
  </security:authentication-provider>
</security:authentication-manager>
<bean id="userDetailsService" class="org.krams.tutorial.service.UserDetailsServiceImpl">
 </bean>
	
</beans>

================================================================================================================================
/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package org.krams.tutorial.dao;

import org.hibernate.SessionFactory;
import org.krams.tutorial.domain.Person;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Repository;

/**
 *
 * @author junaidaj
 */
@Repository("personDao")
public class PersonDAOImpl implements PersonDAO {
    
    @Autowired
    private SessionFactory sessionFactory;

    @Override
    public void savePerson(Person person) {
        sessionFactory.getCurrentSession().saveOrUpdate (person);
    }
    
    @Override
    public Person findByName(String name){
        String query = "select * from Person p where p.username='"+name+"'";
        Person person = (Person) sessionFactory.getCurrentSession().createQuery(query);
        return person;
    }
    
}

===============================


/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package org.krams.tutorial.service;

import org.krams.tutorial.dao.PersonDAO;
import org.krams.tutorial.domain.Person;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.dao.DataAccessException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;


/**
 *
 * @author junaidaj
 */
@Service("userService")
@Transactional(propagation=Propagation.SUPPORTS, readOnly=true)
public class PersonServiceImpl implements PersonService{
    
    @Autowired
    private PersonDAO personDao;
    

    @Override
    @Transactional(propagation=Propagation.SUPPORTS, readOnly=false)
    public void savePerson(Person person) {
       personDao.savePerson(person);
    }
    
    @Override
    @Transactional(propagation=Propagation.SUPPORTS, readOnly=true)
    public Person findByName(String name){
        return personDao.findByName(name);
    }

    
}

==============================

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package org.krams.tutorial.service;

import javax.persistence.NoResultException;
import org.krams.tutorial.dao.PersonDAO;
import org.krams.tutorial.domain.Person;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.dao.DataAccessException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;


/**
 *
 * @author junaidaj
 */
@Service("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {

@Autowired
private PersonService userService;

@Autowired
private Assembler assembler;

@Transactional(readOnly = true)
@Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException, DataAccessException {
try {
Person person = userService.findByName(username);
return (UserDetails) assembler.buildUserFromUserEntity(person);
} catch (NoResultException e) {
throw new UsernameNotFoundException(e.getLocalizedMessage());
}
}
}



================================================

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package org.krams.tutorial.service;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;
import java.util.Set;
import org.krams.tutorial.domain.Person;
import org.krams.tutorial.domain.UserRole;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.userdetails.User;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

/**
 *
 * @author junaidaj
 */

@Service("assembler")
public class Assembler {

  @Transactional(readOnly = true)
  User buildUserFromUserEntity(Person person) {

    String username = person.getUsername();
    String password = person.getPassword();
    boolean enabled = person.getActive();
    boolean accountNonExpired = person.getActive();
    boolean credentialsNonExpired = person.getActive();
    boolean accountNonLocked = person.getActive();

    Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    //Set<UserRole> role = (Set<UserRole>) person.getUserRole();
    for (UserRole role : person.getUserRole()) {
      authorities.add(new GrantedAuthorityImpl(role.getUserRole()));
    }
    User user = new User(username, password, enabled,
      accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    return user;
  }
}
============================

/**
 * 
 */
package org.krams.tutorial.controller;

import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;

/**
 * Handles and retrieves the login or denied page depending on the URI template
 */
@Controller
@RequestMapping("/auth")
public class LoginLogoutController {
        

	/**
	 * Handles and retrieves the login JSP page
	 * 
	 * @return the name of the JSP page
	 */
	@RequestMapping(value = "/login", method = RequestMethod.GET)
	public String getLoginPage(@RequestParam(value="error", required=false) boolean error, 
			ModelMap model) {
		

		// Add an error message to the model if login is unsuccessful
		// The 'error' parameter is set to true based on the when the authentication has failed. 
		// We declared this under the authentication-failure-url attribute inside the spring-security.xml
		/* See below:
		 <form-login 
				login-page="/krams/auth/login" 
				authentication-failure-url="/krams/auth/login?error=true" 
				default-target-url="/krams/main/common"/>
		 */
		if (error == true) {
			// Assign an error message
			model.put("error", "You have entered an invalid username or password!");
		} else {
			model.put("error", "");
		}
		
		// This will resolve to /WEB-INF/jsp/loginpage.jsp
		return "loginpage";
	}
	
	/**
	 * Handles and retrieves the denied JSP page. This is shown whenever a regular user
	 * tries to access an admin only page.
	 * 
	 * @return the name of the JSP page
	 */
	@RequestMapping(value = "/denied", method = RequestMethod.GET)
 	public String getDeniedPage() {
		
		// This will resolve to /WEB-INF/jsp/deniedpage.jsp
		return "deniedpage";
	}
}

Please guys help me out

[Mark Spritzler]

Not sure if this is the reason. But in one of your services I see you set @Transactional(propagation=Propagation.SUPPORTS)

SUPPORTS means that that method may or may not run in a Transaction. It depends on the caller if it started a Transaction. If the caller is not already running in a Transaction, then that second service will not run in a Transaction.

So, it means that it is possible that that method is running without a Transaction and Hibernate requires that a Transaction is always running in order to do its work.

Mark