[ http://jira.jboss.com/jira/browse/JBAS-4424?page=all ] Anil Saldhana reassigned JBAS-4424: ----------------------------------- Assignee: Stefan Guilhen (was: Anil Saldhana) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBAS-4424?page=comments#action_12385404 ] Stefan Guilhen commented on JBAS-4424: -------------------------------------- The SSO cookie is now generated by the WebAuthentication class as part of the login process when a SSO valve has been set in the jboss-web.deployer/server.xml. On Branch_4_2, the org.jboss.web.tomcat.security.ExtendedSingleSignOn valve has to be used instead of the standard SingleSignOn valve, because the ExtendedSSO valve exposes some of the SSO methods as public, allowing the WebAuthentication to delegate sso behaviour to the proper valve. As no upgrade of the jbossweb is planned for Branch_4_2, we had to come up with this workaround. The SSO behaviour of the WebAuthentication has been tested on Branch_4_2, and the code has already been commited. This new valve is not necessary on Trunk, as Remy is setting the necessary methods to public on SingleSignOn valve. Version 2.1.0.CR7 of jbossweb already sets some of the methods to public but one of them (update) still needs to be changed. As soon as we have the changes we need, I'll test this implementation on Trunk using the standard SSO valve, commit, and resolve the issue. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira