我正在开发一个客户端-服务器系统，用户使用 RMI（通过 SSL）进行身份验证。
客户端调用 LoginInf.login() 方法：
public interface LoginIntf extends Remote {
Subject login(String username, char[] password) throws RemoteException;
}
而在服务器上，LoginImpl.login() 方法实现为：
@Override
public Subject login(String username, char[] password) throws RemoteException {
logger.debug("I'm going to authenticate:");
logger.debug(" username: {}", username);
logger.debug(" password: {}", String.valueOf(password));
Subject userSubject = null;
try {
LoginContext lc = new LoginContext("AESLogin", new RemoteCallbackHandler(username, String.valueOf(password)));
lc.login();
userSubject = lc.getSubject();
// debug
Set<Principal> pSet = userSubject.getPrincipals();
pSet.stream().forEach((p) -> {
logger.info(p.getName());
});
} catch (LoginException ex) {
logger.warn(ex);
}
return userSubject;
}
但是，在客户端，执行 LoginIntf.login() 方法后，我得到 NullPointerException：
java.lang.NullPointerException
at javax.security.auth.Subject$SecureSet.readObject(Subject.java:1341) ~[?:1.8.0_66]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_66]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_66]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_66]
at java.lang.reflect.Method.invoke(Method.java:497) ~[?:1.8.0_66]
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1058) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1900) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1801) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1351) ~[?:1.8.0_66]
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2000) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1924) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1801) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1351) ~[?:1.8.0_66]
at java.io.ObjectInputStream.access$300(ObjectInputStream.java:206) ~[?:1.8.0_66]
at java.io.ObjectInputStream$GetFieldImpl.readFields(ObjectInputStream.java:2164) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readFields(ObjectInputStream.java:541) ~[?:1.8.0_66]
at javax.security.auth.Subject.readObject(Subject.java:966) ~[?:1.8.0_66]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_66]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_66]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_66]
at java.lang.reflect.Method.invoke(Method.java:497) ~[?:1.8.0_66]
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1058) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1900) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1801) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1351) ~[?:1.8.0_66]
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:371) ~[?:1.8.0_66]
at sun.rmi.server.UnicastRef.unmarshalValue(UnicastRef.java:326) ~[?:1.8.0_66]
at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:175) ~[?:1.8.0_66]
at java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod(RemoteObjectInvocationHandler.java:227) ~[?:1.8.0_66]
at java.rmi.server.RemoteObjectInvocationHandler.invoke(RemoteObjectInvocationHandler.java:179) ~[?:1.8.0_66]
at com.sun.proxy.$Proxy23.login(Unknown Source) ~[?:?]
at tw.com.asanga.aes.ife.core.IFE_MainFrame.submit_ButtonActionPerformed(IFE_MainFrame.java:537) [classes/:?]
at tw.com.asanga.aes.ife.core.IFE_MainFrame.access$100(IFE_MainFrame.java:32) [classes/:?]
at tw.com.asanga.aes.ife.core.IFE_MainFrame$2.actionPerformed(IFE_MainFrame.java:180) [classes/:?]
at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2022) [?:1.8.0_66]
at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2348) [?:1.8.0_66]
at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402) [?:1.8.0_66]
at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259) [?:1.8.0_66]
at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:252) [?:1.8.0_66]
at java.awt.Component.processMouseEvent(Component.java:6535) [?:1.8.0_66]
at javax.swing.JComponent.processMouseEvent(JComponent.java:3324) [?:1.8.0_66]
at java.awt.Component.processEvent(Component.java:6300) [?:1.8.0_66]
at java.awt.Container.processEvent(Container.java:2236) [?:1.8.0_66]
at java.awt.Component.dispatchEventImpl(Component.java:4891) [?:1.8.0_66]
at java.awt.Container.dispatchEventImpl(Container.java:2294) [?:1.8.0_66]
at java.awt.Component.dispatchEvent(Component.java:4713) [?:1.8.0_66]
at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4888) [?:1.8.0_66]
at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4525) [?:1.8.0_66]
at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4466) [?:1.8.0_66]
at java.awt.Container.dispatchEventImpl(Container.java:2280) [?:1.8.0_66]
at java.awt.Window.dispatchEventImpl(Window.java:2750) [?:1.8.0_66]
at java.awt.Component.dispatchEvent(Component.java:4713) [?:1.8.0_66]
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:758) [?:1.8.0_66]
at java.awt.EventQueue.access$500(EventQueue.java:97) [?:1.8.0_66]
at java.awt.EventQueue$3.run(EventQueue.java:709) [?:1.8.0_66]
at java.awt.EventQueue$3.run(EventQueue.java:703) [?:1.8.0_66]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_66]
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76) [?:1.8.0_66]
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) [?:1.8.0_66]
at java.awt.EventQueue$4.run(EventQueue.java:731) [?:1.8.0_66]
at java.awt.EventQueue$4.run(EventQueue.java:729) [?:1.8.0_66]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_66]
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76) [?:1.8.0_66]
at java.awt.EventQueue.dispatchEvent(EventQueue.java:728) [?:1.8.0_66]
at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:201) [?:1.8.0_66]
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116) [?:1.8.0_66]
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105) [?:1.8.0_66]
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) [?:1.8.0_66]
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93) [?:1.8.0_66]
at java.awt.EventDispatchThread.run(EventDispatchThread.java:82) [?:1.8.0_66]
即使没有将返回的 Subject 对象存储在局部变量中并访问它，我也得到了 NPE。
我无法弄清楚NPE的原因。我不相信它与权限相关，因为我处于 DEV 阶段并已在我的策略文件中授予 AllPermission：
grant {
permission java.security.AllPermission;
};
我知道 javax.security.auth.Subject 实现了 Serializable，所以通过 RMI 发送它应该不是问题。
任何帮助将非常感激。提前致谢！