1:37 p.m.
Hello. I'm not sure if this is the right place to post this question but if it's
not you can direct me to the correct message board. I'm having some difficulty using
form based authentication in a JBoss cluster. Sorry in advance for the long post I just
want to get enough information down for you to be able to diagnose the problem.
I have a small Java application that I?m deploying to a JBoss Cluster. There are
currently 2 JBoss servers running in the cluster (I'll refer to them as JBossServer1
and JBossServer2). They are running on two different machines (actually they are running
on two separate VM ware instances on the same machine but to the outside world they appear
to be two totally separate machines). Both JBoss servers are version 4.0.5 and they are
both running on computers running FreeBSD version 6.2. The JBoss cluster is fronted by an
Apache Server. The Apache Server is doing some URL rewriting so that requests to multiple
URLs (about 10) will be directed to the same JBoss cluster. The Apache server also
performs load balancing using the RoundRobbin method. We do NOT have sticky sessions
setup.
The web application contains several different servlets (SignupServlet, CustAdminServlet,
AdminServlet, etc.) Each of these would be accessed through URL's such as
(http://hostname/MyApp/SignupServlet, http://hostname/MyApp/CustAdminServlet,
http://hostname/MyApp/AdminServlet) where "hostname" is one of the 10 URL's
that the Apache Server maps to the actual JBoss Servers. All of the servlets EXCEPT for
the AdminServlet are completely open and don't require a username or password to
access. The AdminServlet however requires the user to login. I?m using form based
authentication as my authentication method (set in the web.xml file that gets deployed in
my applications ear file).
I have made several JBoss configuration changes to try and get everything working. I have
read through the JBoss clustering section of the JBoss documentation
(http://docs.jboss.org/jbossas/jboss4guide/r4/html/cluster.chapt.html) and have followed
the instructions in section 16.5 (the HTTP Services section). I configured HTTP session
state replication and this seems to be working correctly. When I go my server's jmx
console and invoke the printDetails operation on the TomcatClusteringCache I can see that
there is session information that is being replicated. I've also gone into the file
jbossweb-tomcat5x.sar/server.xml and setup the ClusteredSingleSignOn valve as shown on the
SingleSignOn Wiki page (http://www.jboss.org/wiki/Wiki.jsp?page=SingleSignOn):
I thought that maybe I just had single sign-on or clustering configured wrong on one of
the servers so I did some testing to find out. Note: I was using Mozilla Firefox as my
browser.
Test 1: (Success)
First I started up ONLY JBossServer1. I entered the URL
http://hostname/MyApp/AdminServlet in my browser and was taken to the login page as I
would suspect. I checked my cookies and there was a JSESSIONID cookie for this site. I
invoked the printDetails operation on the TomcatClusteringCache and saw there was nothing
replicated yet.
Then I enter my username and password and press the login button. I'm logged into my
application as I should be. I checked my cookies and there was a JSESSIONID cookie AND a
JSESSIONIDSSO cookie for this site. I invoked the printDetails operation on the
TomcatClusteringCache and saw there was information replicated (for a sample of what this
looked like see the bottom of my post).
Everything worked the way I would expect it.
Test 2: (Success)
For the next test I started up ONLY JBossServer2. I entered the URL
http://hostname/MyApp/AdminServlet in my browser and was taken to the login page. I
checked my cookies and there was a JSESSIONID cookie for this site. I invoked the
printDetails operation on the TomcatClusteringCache and saw there was nothing replicated
yet.
Then I entered my username and password and pressed the login button. I got logged into
my application as I should be. I checked my cookies and there was a JSESSIONID cookie AND
a JSESSIONIDSSO cookie for this site. I invoked the printDetails operation on the
TomcatClusteringCache and saw there was information replicated (for a sample of what this
looked like see the bottom of my post).
Everything worked the way I would expect it.
Test 3: (Fail)
This is the test where I started having problems. I started up both of the JBoss servers.
I again entered the URL http://hostname/MyApp/AdminServlet in my browser and was taken to
the login page. I checked the cookies and there as a JSESSIONID cookie for this site.
The invoked the printDetails operation on the TomcatClusteringCache (on both JBossServer1
and JBossServer2) and saw that nothing was replicated yet.
I entered my username and password and pressed the login button. But instead of being
logged into the application like I should have been I was simply sent back to the login
page! I checked the cookies and there was still just a JSESSIONID cookie for this site.
I then invoked the printDetails operation on the TomcatClusteringCache (on both
JBossServer1 and JBossServer2) and saw that nothing was replicated yet.
I entered my username and password for the second time and again pressed the login button.
Again I was NOT logged into my application. Instead I got HTTP error 404 (the requested
resource is not available). In the address bar I saw
http://hostname/MyApp/j_security_check. I check the cookies in my browser and this time
there was both the JSESSIONID and JSESSIONIDSSO cookies. I invoked the printDetails
operation on the TomcatClusteringCache on both JBossServer1 and JBossServer2 and saw there
was information replicated (for a sample of what this looked like see the bottom of my
post).
Now if I hit my browsers back button (to get back to the login page) and hit the refresh
button I get logged into my application and everything works fine!
Here is something even stranger. I shutdown both JBoss Servers and bring them both back
up. I entered the URL http://hostname/MyApp/AdminServlet and got taken to the login page.
I entered my username and password and pressed login and again I was not logged in. But
if I press the refresh button I do get successfully logged in! At first I thought this
indicated that when I was logging in I was only being logged into one of the JBoss
servers. However when I get to the admin servlet I can perform many actions without any
problem. Since I am using RoundRobbin load balancing with no sticky sessions I would
expect that every operation would hit a different JBoss server and thus I would expect
that every other operation would challenge me for my login credentials but this never
happens!
I also thought that maybe my session information wasn't replicating fast enough and
that was why I was being shown the second login screen. To try and rule out this
possibility I changed the session replication to be synchronous and still got the same
results.
Another idea I had was that the apache server wasn't passing along the cookies
properly but then I would expect I wouldn't be able to view them from within my
browser and I would also expect that I wouldn?t be able to login when I only used a single
JBoss server (which was not the case).
I have searched everywhere for an answer to this problem but so far have come up with
nothing. I'm sure it's just a configuration problem but I don't know what.
If anyone has any ideas I would really appreciate it because I'm stumped.
Thanks in advance for your help!
Jesse
Sample of the output from invoking the printDetails operation on the
TomcatClusteringCache
/SSO
/27972A1982A8087F39CC1AAF8E9707EA
/sessions
key: [org.jboss.web.tomcat.tc5.sso.TreeCacheSSOClusterManager$SessionAddress@c0c5d546]
/credentials
key: org.jboss.web.tomcat.tc5.sso.TreeCacheSSOClusterManager$SSOCredentials@4a7629
/JSESSION
/localhost
/RecipientSignups
/Ho8xjWEb06K4-AFiMLfVHw**
VERSION: 2
Ho8xjWEb06K4-AFiMLfVHw**: [B@1635a89
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4055347#...
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...