Liferay 7.4 程序化添加角色后角色页面报错求助

问题描述 #

在Liferay 7.4中通过代码程序化添加角色，数据库能查询到该角色记录，但管理员登录门户访问角色页面时，出现“角色暂时不可用”的错误。

原添加角色代码 #

Date now = new Date();
Long defaultCompanyId = PortalUtil.getDefaultCompanyId();
Long defaultUserId = (long) 20123;
Long roleClassNameId = ClassNameLocalServiceUtil.getClassNameId(Role.class);
Long roleId = CounterLocalServiceUtil.increment();

Role role = RoleLocalServiceUtil.createRole(roleId);
role.setName("ERIC_TEST_ROLE");
role.setDescription("This is Erics Test Role from Java Portlet");
role.setTitle("ERIC_TEST_ROLE");
role.setType(1); // role type. 1=regular, 2=site, 3=organization
role.setUserId(defaultUserId);
role.setCompanyId(defaultCompanyId);
role.setClassNameId(roleClassNameId);
role.setClassPK(roleId);
role.setCreateDate(now);
role.setModifiedDate(now);

RoleLocalServiceUtil.addRole(role);

错误日志（catalina.out） #

2023-11-29 15:42:03.150 ERROR [https-jsse-nio-8443-exec-9][PortletRequestDispatcherImpl:295] Unable to dispatch request: java.lang.IllegalArgumentException: Someone may be trying to circumvent the permission checker: {companyId=20095, name=com.liferay.portal.kernel.model.Role, primKey=33020, scope=4}
2023-11-29 15:42:03.151 ERROR [https-jsse-nio-8443-exec-9][PortletServlet:109] Unable to process portlet com_liferay_roles_admin_web_portlet_RolesAdminPortlet: org.apache.jasper.JasperException: java.lang.IllegalArgumentException: Someone may be trying to circumvent the permission checker: {companyId=20095, name=com.liferay.portal.kernel.model.Role, primKey=33020, scope=4}
javax.portlet.PortletException: org.apache.jasper.JasperException: java.lang.IllegalArgumentException: Someone may be trying to circumvent the permission checker: {companyId=20095, name=com.liferay.portal.kernel.model.Role, primKey=33020, scope=4}
        at com.liferay.portlet.internal.PortletRequestDispatcherImpl.dispatch(PortletRequestDispatcherImpl.java:298) ~[portal-impl.jar:?]
        at com.liferay.portlet.internal.PortletRequestDispatcherImpl.include(PortletRequestDispatcherImpl.java:114) ~[portal-impl.jar:?]
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.include(MVCPortlet.java:611) ~[portal-kernel.jar:?]
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.include(MVCPortlet.java:627) ~[portal-kernel.jar:?]
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.doView(MVCPortlet.java:172) ~[portal-kernel.jar:?]
        at com.liferay.portal.kernel.portlet.LiferayPortlet.doDispatch(LiferayPortlet.java:278) ~[portal-kernel.jar:?]
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.doDispatch(MVCPortlet.java:500) ~[portal-kernel.jar:?]
        at com.liferay.roles.admin.web.internal.portlet.RolesAdminPortlet.doDispatch(RolesAdminPortlet.java:562) ~[bundleFile:?]
        at javax.portlet.GenericPortlet.render(GenericPortlet.java:291) ~[portlet.jar:3.0.1]
        at com.liferay.portal.kernel.portlet.bridges.mvc.MVCPortlet.render(MVCPortlet.java:300) ~[portal-kernel.jar:?]

解决方案 #

核心问题 #

错误设置了classPK的值。Liferay中不同类型的角色对classPK有明确规则：

• 常规角色（type=1）：classPK必须为0，代表全局范围
• 站点角色（type=2）：classPK对应站点ID（GroupId）
• 组织角色（type=3）：classPK对应组织ID（OrganizationId）

原代码中把常规角色的classPK设为角色ID，导致权限检查时无法匹配有效资源，触发“规避权限检查”的异常。

修正代码 #

将role.setClassPK(roleId);修改为：

role.setClassPK(0L);

完整修正后的代码：

Date now = new Date();
Long defaultCompanyId = PortalUtil.getDefaultCompanyId();
Long defaultUserId = (long) 20123;
Long roleClassNameId = ClassNameLocalServiceUtil.getClassNameId(Role.class);
Long roleId = CounterLocalServiceUtil.increment();

Role role = RoleLocalServiceUtil.createRole(roleId);
role.setName("ERIC_TEST_ROLE");
role.setDescription("This is Erics Test Role from Java Portlet");
role.setTitle("ERIC_TEST_ROLE");
role.setType(1); // role type. 1=regular, 2=site, 3=organization
role.setUserId(defaultUserId);
role.setCompanyId(defaultCompanyId);
role.setClassNameId(roleClassNameId);
role.setClassPK(0L); // 修正为0，符合常规角色的规则
role.setCreateDate(now);
role.setModifiedDate(now);

RoleLocalServiceUtil.addRole(role);

后续操作 #

1. 删除数据库中已创建的错误角色记录（通过roleId找到Role表对应条目删除）
2. 运行修正后的代码重新创建角色
3. 刷新门户角色页面，即可正常查看该角色

内容的提问来源于stack exchange，提问作者Eric Olsen