Session.clone()

[Thomas Mueller <mu...@adobe.com>]

Hi,

Use case:

a) I have a web application where a user can login to Jackrabbit.

b) There is a (Jackrabbit-) session timeout of 30 minutes (which is required to avoid out of memory).

c) Now some operations potentially take longer than 30 minutes, for example data store garbage collection.

d) For those operations, I would like to use a new session, but don't want that the user has to login again (it would be a usability problem).

e) Therefore, I would like to clone the existing session (create a additional, new session with the exact same user and access rights).


Currently there is no 'official' way to clone a session (create a new session for the same user). There is a way that works / worked for some cases:


SimpleCredentials sc = new SimpleCredentials(null, "".toCharArray());

(or ew SimpleCredentials(session.getUserID(), "".toCharArray());)

session.impersonate(sc);

But this feels kind of 'hacky' (the spec doesn't explicitly state this is allowed, and the method name is weird). I wonder if we should add a new method:

JackrabbitSession JackrabbitSession.clone();

What do you think? If yes, should I also add an issue for JSR-333?

Regards,
Thomas

Re: Session.clone()

[Thomas Mueller <mu...@adobe.com>]

Hi,

> keep the original credentials around

This would be a security issue.

Regards,
Thomas

Re: Session.clone()

[Jukka Zitting <jz...@adobe.com>]

Hi,

On 24.03.2011 16:03, Thomas Mueller wrote:
> Currently there is no 'official' way to clone a session
> (create a new session for the same user).

The simplest solution is probably to keep the original credentials
around and use Repository.login() again to get the new session.

-- 
Jukka Zitting

Re: Session.clone()

[Thomas Mueller <mu...@adobe.com>]

Hi,

>For the timeout issue

Actually Jackrabbit doesn't have a session timeout, it's the web
application. So the timeout only applies to the first session, not the
cloned session.

Regards,
Thomas

Re: Session.clone()

[Michael Dürig <mi...@gmail.com>]

>> Wouldn't it be
>> better to prevent the session from timing out? Probably by pinging it
>> somehow?
>
> Yes, pinging is an option (it's the current workaround). Timeout is
> actually not the only problem: sharing a session for distinct operations
> is generally a problem.

Ok this is a different problem where cloning a session might make sense.
For the timeout issue I'd rather suggest to add a refresh() method. Like 
there is for the Lock class for preventing locks from timing out.

Michael

Re: Session.clone()

[Thomas Mueller <mu...@adobe.com>]

Hi,

>Wouldn't it be 
>better to prevent the session from timing out? Probably by pinging it
>somehow?

Yes, pinging is an option (it's the current workaround). Timeout is
actually not the only problem: sharing a session for distinct operations
is generally a problem.

Regards,
Thomas

Re: Session.clone()

[Michael Dürig <md...@apache.org>]

Why do you want to clone the session in the first place? Wouldn't it be 
better to prevent the session from timing out? Probably by pinging it 
somehow?

Michael

On 24.3.11 16:03, Thomas Mueller wrote:
> Hi,
>
> Use case:
>
> a) I have a web application where a user can login to Jackrabbit.
>
> b) There is a (Jackrabbit-) session timeout of 30 minutes (which is
> required to avoid out of memory).
>
> c) Now some operations potentially take longer than 30 minutes, for
> example data store garbage collection.
>
> d) For those operations, I would like to use a new session, but don't
> want that the user has to login again (it would be a usability problem).
>
> e) Therefore, I would like to clone the existing session (create a
> additional, new session with the exact same user and access rights).
>
>
> Currently there is no 'official' way to clone a session (create a new
> session for the same user). There is a way that works / worked for some
> cases:
>
> SimpleCredentials sc = new SimpleCredentials(null, "".toCharArray());
>
> (or ew SimpleCredentials(session.getUserID(), "".toCharArray());)
>
> session.impersonate(sc);
>
> But this feels kind of 'hacky' (the spec doesn't explicitly state this
> is allowed, and the method name is weird). I wonder if we should add a
> new method:
>
> JackrabbitSession JackrabbitSession.clone();
>
> What do you think? If yes, should I also add an issue for JSR-333?
>
> Regards,
> Thomas
>