new session id with new browser window with tomcat 6.0.29

[mrfixit440]

I have a webapp deployed to jboss 4.2.3.GA(including tomcat 6.0.20) with a IIS frontend using AJP 1.3.  IIS is using CAC authentication and will forward to jboss when successfull.  The first jsp that is hit after login, saves request.getRemoteUser() to session, creates a user object and saves that to session, and then it opens a new window to load a second jsp.  This second jsp reads the user object from session and begins to populate page with user specific info.  This setup works good.

However, when I upgrade jbossweb.jar to tomcat 6.0.29, the session id is different between the 2 jsp pages, so I never can get the user object out of session in the second jsp and it fails to populate.  Both jsp's are in the same web context.  I tried firefox and IE 7.  It seems like the new browser window is causing the second jsp to report a different session id than the first jsp.

Is there a configuration setting that I need to set for 6.0.29?

Here is my server.xml snippet:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
  maxThreads="150" scheme="https" secure="true" clientAuth="false"
  strategy="ms" address="${jboss.bind.address}"
  keyAlias="foossl"
        ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,
  TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
  SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
  SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"
  keystoreFile="${jboss.server.home.dir}/conf/Certificates/FOO-server.keystore"
        keystorePass="123456"
        truststoreFile="${jboss.server.home.dir}/conf/Certificates/FOO-client.truststore"
        truststorePass="123456" algorithm="SunX509" sslProtocol="TLS"
  URIEncoding="UTF-8" />
          
    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" address="${jboss.bind.address}" protocol="AJP/1.3"
         emptySessionPath="true" enableLookups="false" redirectPort="8443"
   URIEncoding="UTF-8" />

      <Engine name="jboss.web" defaultHost="localhost">

Here is my jboss-web.deployer/context.xml:

<Context cookies="true" crossContext="true" useHttpOnly="true">
   <!-- Session persistence is disable by default. To enable for all web
   apps set the pathname to a non-empty value:
   <Manager pathname="SESSIONS.ser" />

   To enable session persistence for a single web app, add a
   WEB-INF/context.xml
   -->
   <Manager pathname="" />

   <!-- Install an InstanceListener to handle the establishment of the run-as
   role for servlet init/destroy events.
   -->
   <InstanceListener>org.jboss.web.tomcat.security.RunAsListener</InstanceListener>
  
</Context>

[jfclere]

Dan Rush wrote:

However, when I upgrade jbossweb.jar to tomcat 6.0.29,

What did you do?

[mrfixit440]

i built tomcat 6.0.29 and replaced the org packages in jbossweb.jar.  I just built 6.0.20 and 6.0.24 and tested them. 6.0.20 works and 6.0.24 has the same symptoms as 6.0.29.  Is there some detailed release notes for 6.0.24 that I can look at?

[mrfixit440]

I found my problem.  In my web app, I extended AuthenticatorBase and in my authenticate method, I do this:

Principal principal = context.getRealm().authenticate(username, password);

if (principal != null) {

    register(request, response, principal, "EXTERNAL", username, password);

}

EXTERNAL is defined as an Authenticator in jboss-web.deployer/META-INF/jboss-service.xml

EXTERNAL is also set in web.xml, like this:

<login-config>
      <auth-method>EXTERNAL</auth-method>

The register method in AuthenticatorBase does this:

if (session != null && changeSessionIdOnAuthentication) {
            Manager manager = request.getContext().getManager();
            manager.changeSessionId(session);
            request.changeSessionId(session.getId());
}

My authenticate method is getting called by AuthenticatorBase.invoke method for every page and session id is getting changed by request.changeSessionId(session.getId()); in AuthenicatorBase which was introduced in 6.0.24.

What can I do to stop this?

[jfclere]

Dan Rush wrote:

i built tomcat 6.0.29 and replaced the org packages in jbossweb.jar.  I just built 6.0.20 and 6.0.24 and tested them. 6.0.20 works and 6.0.24 has the same symptoms as 6.0.29.  Is there some detailed release notes for 6.0.24 that I can look at?

That won't work the jbossweb.jar should be build from http://anonsvn.jboss.org/repos/jbossweb/branches/JBOSSWEB_2_0_0_GA_CP/

[jfclere]

Dan Rush wrote:

I found my problem.  In my web app, I extended AuthenticatorBase and in my authenticate method,

the code in jbossweb is different to Tomcat....

[mrfixit440]

-----  That won't work the jbossweb.jar should be build from

------ http://anonsvn.jboss.org/repos/jbossweb/branches/JBOSSWEB_2_0_0_GA_CP/

Reading about jbossweb versions, the latest jbossweb version corresponds to the latest tomcat version.  Do I get this one for tomcat 6.0.29?

http://anonsvn.jboss.org/repos/jbossweb/branches/JBOSSWEB_2_1_7_GA_JBPAPP-5170/

[jfclere]

Reading about jbossweb versions, the latest jbossweb version corresponds to the latest tomcat version.

jbossweb is a fork of tomcat 6 we only port the security issues, selected issues and the issues reported by our customers or our user.

http://anonsvn.jboss.org/repos/jbossweb/tags/JBOSSWEB_2_0_0_GA_CP15/ corresponds to tomcat 6.0.29 we will/may do a CP16 once 6.0.30 will be out.

[mrfixit440]

Thanks, you've been a great help!