Re: Potential bug in StandardSession and DeltaSession

2020-02-13 Thread Klein, Carsten
Hi, forget about the potential bug. Sorry for taking your time. Seems like that WriteAbortedException is thrown when reading object data occasionally. AFAIK I understand it, it's just like a container exception; the actual error is stored in the exception's cause. Uh... that's odd...

Potential bug in StandardSession and DeltaSession

2020-02-13 Thread Klein, Carsten
Hi there, Chris, thanks for your fast GIT introduction :) I took this as a (mental) starting point for developing the new 'persistAuthentication' option of the Managers (Standard and Persistent). Almost there... I will push this branch to my GitHub fork as soon as possible (tomorrow?). Maybe

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
ESSAGE- Hash: SHA256 Carsten, On 2/12/20 10:54 AM, Klein, Carsten wrote: actually, Tomcat just does not serialize authentication information, that is AuthType (BASIC, DIGEST etc.) and the Principal, during session serialization. That affects session persistence across restarts (no> ma

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
Hi there, actually, Tomcat just does not serialize authentication information, that is AuthType (BASIC, DIGEST etc.) and the Principal, during session serialization. That affects session persistence across restarts (no matter what manager is used) as well as session transfer between cluster

Re: Tomcat 7.x.x, 8.x.x, 8.5.x and 9.x.x: Session serialization w/o authentication related information

2019-11-29 Thread Klein, Carsten
On 28/11/2019 10:20, Mark Thomas wrote: On 28/11/2019 08:03, Klein, Carsten wrote: Hi there, Thanks for answering my questions. See my remarks inline: in all recent Tomcat versions the standard session implementation declares authentication related fields as 'transient', so both

Tomcat 7.x.x, 8.x.x, 8.5.x and 9.x.x: Session serialization w/o authentication related information

2019-11-28 Thread Klein, Carsten
Hi there, in all recent Tomcat versions the standard session implementation declares authentication related fields as 'transient', so both the session's authType as well as it's authenticated Principal is not saved and restored across restarts. On those fields there is a comment that