Re: Sharing sessions and authentication across sites [SOLVED]

[Oscar Picasso <os...@yahoo.com>]

I finally found a solution.

Sessions and authentication are shared between sites that use a same cocoon
instance. The problems lies in the access to the session id cookie.

Let's say we have:
first.mydomain.org
second.mydomain.org

I just had added the following in web.xml

<context-param>
  <param-name>org.mortbay.jetty.servlet.SessionPath</param-name>
  <param-value>/</param-value>
</context-param>

<context-param>
  <param-name>org.mortbay.jetty.servlet.SessionDomain</param-name>
  <param-value>.mydomain.org</param-value>
</context-param>

Now evevry *.mydomain.org 'site' will get the same session id cookie and
sessions will be shared across these sites.

The configuration above is Jetty specific and there is no need to use Apache.

--- Oscar Picasso <os...@yahoo.com> wrote:

> > If you have "different sites" under the same webserver 
> > installation then sharing the authentication information
> > between cocoon apps should be ok.
> 
> That's my configuration. It should be ok but in my case it's not.
> 
> So let me detail my config.
> 
> Both the server and the client I use to test have the following line in
> /etc/hosts:
> 192.168.1.2 first.org second.org
> 
> On the server I use one application server (Jetty) with one cocoon.war in the
> webapps folder. Its web-jetty.xml has:
> <Configure class="org.mortbay.jetty.servlet.WebApplicationContext">
>   <Set name="ContextPath">/</Set>
> </Configure>
> 
> So if I try to http://first.org or http://second.org it actually point to the
> same cocoon instance and sitemap.
> 
> In the site map I have something like this:
> <map:match pattern="test">
>   <map:act type="auth-protect">
>     <map:parameter name="handler" value="managehandler"/>
>     <map:generate type="serverpages" src="test/test.xsp"/>
>     <map:serialize type="xml"/>
>   </map:act>
> </map:match>
> 
> The first time I try http://first.org, I get the login form and then the test
> page. The second time, I go directly to the test page. So the the
> authentication works fine with this domain.
> 
> If after that, I try http://second.org, I get the login form again. The next
> time, I go directly to the test page. So here again the authentication works
> fine "inside" the second domain.
> 
> The problem is that the authentication done in the first domain is not
> available for the second domain.
> 
> When looking at the cookies manager, I have noticed that it has set one
> JSESSIONID for first.org and a different one for second.org. I guess that the
> problem lies here.
> 
> On the cocoon web.xml file I have noticed the following lines:
> 
> !-- Context Configuration ========================================== -->
> 
> !--+
>    | Set a context property useful to allow you to ProxyPass your
>    | web application mounted to a different URI without loosing the
>    | ability to do cookie-based sessions.
>    | WARNING: this is Jetty specific!
>    +-->
> !--context-param>
>  <param-name>org.mortbay.jetty.servlet.SessionPath</param-name>
>  <param-value>/some/path/to/your/webapp</param-value>
>  <description>An override of the session cookie path</description>
> </context-param-->
> 
> I thought it was somewhat related to my problem and tried to play with this
> param, but without success.
> 
> I think, I have to configure something in Jetty and/or use apache but don't
> know where to start.
> 
> I someone had a working Jetty (and/or apache) configuration example, I would
> greatly appreciate.
> 
> Thanks.
> 
> Oscar
>  
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@cocoon.apache.org
> For additional commands, e-mail: users-help@cocoon.apache.org
> 
> 


		
_______________________________
Do you Yahoo!?
Express yourself with Y! Messenger! Free. Download now. 
http://messenger.yahoo.com

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@cocoon.apache.org
For additional commands, e-mail: users-help@cocoon.apache.org