Clustering - session replication vs SSO

[dantheman46]

Hello everyone,

I have got one fundamental question:

Do I need to enable SSO in order to not have to login on every node in clustered environment?

Environment:

JBoss AS 7.2

Started as a domain:  master + one slave host

Application is secured using JEE6 JAAS mechanism using security-domain(database)

The problem is that when I don't enable SSO I have to reauthenticate on every node.

Session is replicated correctly - when I put something on one node I see it on another

The problem dissappears when I enable SSO.

JBoss replicates sso cache and using JSESSIONIDSSO cookie authenticate me

14:45:44,707 TRACE [org.jboss.as.clustering.web.sso.infinispan.SSOClusterManager] (http-/178.255.41.179:8080-4) addSession(): adding Session S516oUsjgydH173HSd9Yafar to cached session set for SSO 7sCW+DIxyxr+CEooLhowqp4U

In my oppinion SSO should be used to authenticate once and have an access to other applications (not clustered) using special token(JSESSIONIDSSO in JBoss)

When I login into App A I could have access to App B without login again. App A and B are completely different applications - in that case we should use SSO

In clustered environment AS should take care of session replication with authentication data - and there shouldn't be need to reauthenticate on every node or use SSO.

I'll be grateful if someone clarify why authentication data is not replicated with session.

Maybe I've missed something.

Thanks

[adrianoschmidt]

Hello,

I had this problem.. The documentation is not complete..

I solved this problem and I documented it on my blog: http://localhost8080.blogspot.com.br/2013/07/jboss-as-7-cluster-sso.html

My blog is in portuguese.. if you have any trouble, let me know.

Regards,

Adriano Schmidt

www.localhost8080.com.br

[dantheman46]

Adriano,

thanks you for quick response, but my problem is:

do we have to use SSO when we cluster servers, without sticky session and when application is secured?

It looks like authentication data is not replicated with session without SSO.

[rhusar]

Try this documentation:

https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.1/html/Development_Guide/Use_Single_Sign_On_SSO_In_A_Web_Application.html

[dantheman46]

The problem is not with SSO configuration.

I'm asking if there is possibility to replicate authentication data without SSO.

[rodrigo.parede]

Hi Daniel,

I'm having the same difficulty, found a solution?