Failed to instantiate the JavaCallout Class com.telstra.authorization.pep.ApigeeCalloutPolicy

[#1]

I am trying to add a JavaCallout policy, based on the sample interface

http://docs.apigee.com/api-services/reference/java-callout-policy

When I go to deploy the API Proxy, I get message "The revision is deployed, but traffic cannot flow. Failed to instantiate the JavaCallout Class com.telstra.authorization.pep.ApigeeCalloutPolicy"

I have added expressions-1.0.0.jar and message-flow-1.0.0.jar to the proxys' scripts > java folder. Can't figure out why i'm getting this error. Source for the class below:

/*
 * see apigee documentation at http://docs.apigee.com/api-services/cookbook/use-java-customize-api
 */
package com.telstra.authorization.pep;


import com.apigee.flow.execution.ExecutionContext;
import com.apigee.flow.execution.ExecutionResult;
import com.apigee.flow.execution.spi.Execution;
import com.apigee.flow.message.MessageContext;


public class ApigeeCalloutPolicy implements Execution 
{       
    public ExecutionResult execute(MessageContext messageContext, ExecutionContext executionContext) 
    {
        System.out.println( "reached apigee callout policy" );
        /*
        // call our own stub PEP
        AxiomaticsPolicyEnforcementPoint pep = new AxiomaticsPolicyEnforcementPoint();
        String xacmlResult = pep.callPolicyDescisionPoint(null);
        
        //TODO im not sure how we want to return the permit/deny
        //response. do we set it on the request and give it back,
        // like messageContext.getRequestMessage().setQueryParam("w", 20148584);
        // or return ExecutionResult like below ??
        if (!xacmlResult.equalsIgnoreCase("PERMIT"))    
        {
          return ExecutionResult.ABORT;
        }
        */
        return ExecutionResult.SUCCESS;
    }
}

proxy.gif

[DChiesa · Accepted solution]

Hi

You definitely DO NOT want to include expressions-1.0.0.jar and message-flow-1.0.0.jar in the scripts > java directory. Those JARs are included in Apigee Edge. It's not necessary for you to include them in every Java callout you publish. I don't know if it's harmful, but it might be. Don't do that. Delete those JARs from the api proxy. You DO need to upload your own custom JAR to the PAI proxy.

The most common problem I've seen when Java callouts fail to instantiate is an error in the configuration of the policy. Often, the class name for the class you want Apigee Edge to instantiate, isn't quite right. The second most common problem is a missing dependency. Since your simple callout doesn't have any dependencies (yet!) I'm going to rule that out.

You didn't show your policy config. Can I see it? In any case, check it. By default when you drag in a Java callout policy using the API proxy editor, you will get an incomplete configuration that looks like this:

<JavaCallout name="Java-Callout-1">
    <DisplayName>Java Callout-1</DisplayName>
    <Properties/>
    <ClassName>class</ClassName>
    <ResourceURL>java://the-name-of-your-custom-jar-here.jar</ResourceURL>
</JavaCallout>

Notice the ClassName by default is specified as "class". This is probably wrong. In your case, it ought to be

com.telstra.authorization.pep.ApigeeCalloutPolicy

From the error message you mentioned, it sounds as if you have this part right. Do you have the correct custom JAR specified? And do you have that JAR included in the API Proxy?

What you're doing sounds interesting. PEP - I'm assuming policy-execution-point. I'm guessing it will grant authorization based on some data stored in a backend system (PDP). What's the backend? Whoops! Now I see it: It's Axiomatics. I'd love to be able to see how that works out for you. Will you be open-sourcing that code, sharing with the community?

[#3]

Guys, thank you so much for taking the time to post. Dino’s response appears to have solved it – I have removed expression-1.0.0.jar & message-flow-1.0.0.jar from the API Proxys script resources folder. It now appears to deploy ok; I will test it further today.

Got to say, I find the documentation at http://docs.apigee.com/api-services/cookbook/use-java-customize-api misleading on this. It states:

“Before you can deploy and test this sample, you must first compile the CityLookup.java class and generate a JAR file that contains that class plus the required packages that the custom class requires. The required libraries are expressions-1.0.0.jar and message-flow-1.0.0.jar, and they are located in the doc-samples/java-cookbook/lib folder.”

Perhaps this should state (as you guys have written), these jars are local compile dependencies only, and do not need to be deployed with the JavaCallout class.

Anyhow, i'm happy now 🙂 Dino, yes this callout is intended to call a Policy Enforcement Point client class, which in turn will make a XAMCL request to our Policy server, to determine whether the user is authorised to access the microservice.

[DChiesa]

Ok, thanks for the input. Floyd and our doc team are already on it.

[#5]

Hi @Tom Clague,

As @Dino mentioned you don't need to deploy the API proxy with expressions-1.0.0.jar and message-flow-1.0.0.jar, they are only needed for you to compile your code during build time.

ClassName should be okay but pls cross check if the deployed jar has that file.

BTW looks like you are on a private cloud, check your system.log and, if possible, debug logs to see if you can find anything from the logs?

From the error message, it looks like one or more mps are not healthy which is causing this problem (That's my guess, but pls do check the health of all the routers and mps )

[DChiesa]

Maruti, I don't think the message indicates unhealthy MPs. It indicates merely that the callout class was not instantiated. This is an app error, not a system error.

[#7]

@Dino yes, the Failed to instantiate the JavaCallout Class error indicates its an app error but if you look at the screen capture that was attached it says the "proxy is deployed, but traffic cannot flow" which made me think that Java callout instantiation failed in one or more MPs. Typically I see the message, "proxy is deployed but traffic cannot" when the proxy gets deployed in few but fails in 1 or more MPs.

Glad to know that deploying an API proxy with expressions-1.0.0.jar and message-flow-1.0.0.jar causes the deployments to fail :).

[DChiesa]

Hey Tom, what was the resolution?

[jonesfloyd]

Big apologies for the doc confusion, @Tom Clague. And thanks for the clarification, @Dino. I've updated the topic with a note. Also added a readme to the Github sample.