Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/12/20 12:34 PM, Jonathan S. Fisher wrote: > So the manager would be this, I've noticed it uses the > StandardSession, which explicitly prevents serialization of the > user principal and auth type: >

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
Jonathan, So the manager would be this, I've noticed it uses the StandardSession, which explicitly prevents serialization of the user principal and auth type: org.redisson.tomcat.RedissonSessionManager Two questions, on org.apache.catalina.Session, do the values getNote and setNote replicate

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Jonathan S. Fisher
So the manager would be this, I've noticed it uses the StandardSession, which explicitly prevents serialization of the user principal and auth type: org.redisson.tomcat.RedissonSessionManager Two questions, on org.apache.catalina.Session, do the values getNote and setNote replicate across the

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Carsten, On 2/12/20 10:54 AM, Klein, Carsten wrote: > actually, Tomcat just does not serialize authentication > information, that is AuthType (BASIC, DIGEST etc.) and the > Principal, during session serialization. That affects session > persistence

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Rémy Maucherat
On Wed, Feb 12, 2020 at 4:55 PM Klein, Carsten wrote: > Hi there, > > actually, Tomcat just does not serialize authentication information, > that is AuthType (BASIC, DIGEST etc.) and the Principal, during session > serialization. That affects session persistence across restarts (no > matter what

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Klein, Carsten
Hi there, actually, Tomcat just does not serialize authentication information, that is AuthType (BASIC, DIGEST etc.) and the Principal, during session serialization. That affects session persistence across restarts (no matter what manager is used) as well as session transfer between cluster

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/11/20 9:33 PM, Jonathan S. Fisher wrote: > Apologies, I'm not seeing how this helps, I don't see where > authentication information is transmitted No, seriously, what session manager are you using? - -chris > On Tue, Feb 11, 2020 at

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-11 Thread Jonathan S. Fisher
Apologies, I'm not seeing how this helps, I don't see where authentication information is transmitted On Tue, Feb 11, 2020 at 5:39 PM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Jon, > > On 2/11/20 5:36 PM, Jonathan S. Fisher

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/11/20 5:36 PM, Jonathan S. Fisher wrote: >> What do you mean by logged out If it's one from Redisson, then >> you should look at their code and not > Tomcat's code. > > So you have two tomcat nodes: A & B, clustered in any fashion >

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-11 Thread Jonathan S. Fisher
> What do you mean by logged out > If it's one from Redisson, then you should look at their code and not Tomcat's code. So you have two tomcat nodes: A & B, clustered in any fashion (forget I mentioned redisson) of your choosing; let's say they're clustered using the built in tcp point-to-point

Re: Tomcat doesn't propogate Security Credentials during session failover

2020-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jon, On 2/11/20 2:35 PM, exabrial wrote: > https://stackoverflow.com/questions/59833043/tomcat-logs-user-out-duri ng-session-failover-event-and-restarts > > > > We've implemented session replication using Redisson, but we noticed > that if we

Tomcat doesn't propogate Security Credentials during session failover

2020-02-11 Thread exabrial
https://stackoverflow.com/questions/59833043/tomcat-logs-user-out-during-session-failover-event-and-restarts We've implemented session replication using Redisson, but we noticed that if we intentionally fail a node, the user's sessions do get replicated, but they're logged out when they're