You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Mohammad M. AbuZer" <m....@gmail.com> on 2010/09/13 19:52:41 UTC
How to serialize user principle
Hi All,,,
Is there anyway that force tomcat to serialize user Principle so that when
tomcat webapp get reloaded or even tomcat restarted, logged in users won't
be asked to login again...
Best Regards
Re: How to serialize user principle
Posted by André Warnier <aw...@ice-sa.com>.
Mohammad M. AbuZer wrote:
> Hi All,,,
>
> Is there anyway that force tomcat to serialize user Principle so that when
> tomcat webapp get reloaded or even tomcat restarted, logged in users won't
> be asked to login again...
>
Would this be what you are referring to ?
http://tomcat.apache.org/tomcat-5.5-doc/config/manager.html#Restart_Persistence
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to serialize user principle
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
André,
On 9/13/2010 2:21 PM, André Warnier wrote:
> As far as I know, the Tomcat (container-managed) authentication is based
> on the user session
Per the servlet spec, the HttpSession == "user login" for FORM
authentication.
> and the persistence of a session is linked to the
> JSESSIONID cookie which Tomcat sends to the browser; and as far as I
> know this JSESSIONID cookie, by default, only lasts for the duration of
> a web browser session.
>
> So, independently of whether Tomcat saves and persists the sessions
> across a webapp reload or a Tomcat restart, if the user close and
> re-open their browser, their session will be lost, and so will their
> authentication.
Generally speaking, yes.
> If your goal is that users need to login only once during any day, then
> you should look at some Single-Sign-On mechanism, external to Tomcat.
Or, just change the session expiration time.
I think Mohammad is talking about logins surviving a Tomcat restart
(which they should be able to do, without any additional configuration
from the default).
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyOdmsACgkQ9CaO5/Lv0PB+3QCeMVV+1Y3tKnKMWLgFBwBki/7T
WYAAoIzSo4hu+GuM5ttfgw/EV7qL9J4Z
=7FyR
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to serialize user principle
Posted by André Warnier <aw...@ice-sa.com>.
Caldarale, Charles R wrote:
>> From: Mohammad M. AbuZer [mailto:m.abuzer09@gmail.com]
>> Subject: How to serialize user principle
>
>> Is there anyway that force tomcat to serialize user
>> Principle so that when tomcat webapp get reloaded or
>> even tomcat restarted, logged in users won't be asked
>> to login again...
>
> That normally happens automatically (as long as the session hasn't expired), so the real question is what did you change to disable the standard behavior?
>
> While you're at it, tell us the Tomcat version you're using, and the <Realm> you have configured for authentication.
>
I think that you also should be more clear about what you would really like to achieve.
As far as I know, the Tomcat (container-managed) authentication is based on the user
session, and the persistence of a session is linked to the JSESSIONID cookie which Tomcat
sends to the browser; and as far as I know this JSESSIONID cookie, by default, only lasts
for the duration of a web browser session.
So, independently of whether Tomcat saves and persists the sessions across a webapp reload
or a Tomcat restart, if the user close and re-open their browser, their session will be
lost, and so will their authentication.
If your goal is that users need to login only once during any day, then you should look at
some Single-Sign-On mechanism, external to Tomcat.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to serialize user principal
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Mohammad,
On 9/13/2010 3:29 PM, Mohammad M. AbuZer wrote:
> Thanks to note about disadvantages of using JDBCRealm, but about tomcat
> login-surviving, I still see login-page, after web-app reload or tomcat
> restart... even default configuration presents....
Hmm. What's in the session, then?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyOfOsACgkQ9CaO5/Lv0PBLLACdFQ954KDF5Z27XUO44DsJlyXQ
oWgAoJf4k4atY0UC7L23tMTeuS4+dCQ+
=+ZnD
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to serialize user principal
Posted by "Mohammad M. AbuZer" <m....@gmail.com>.
Thanks to note about disadvantages of using JDBCRealm, but about tomcat
login-surviving, I still see login-page, after web-app reload or tomcat
restart... even default configuration presents....
On Mon, Sep 13, 2010 at 9:20 PM, Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mohammad,
>
> (Note the change in spelling of "principal". Principle is a notion or
> laws or morals.)
>
> On 9/13/2010 2:37 PM, Mohammad M. AbuZer wrote:
> > I'm using tomcat 7.0.2 BETA, I used JDBCRealm, and I think it uses by
> > default GenericPrinciple at org.apache.catalina.realm, which do not
> > implement Serializable interface,
>
> Note that the Principal itself is not stored as a session attribute, and
> is therefore not "serialized" in the way you are thinking. Tomcat should
> be able to persist the user's session information across a Tomcat
> restart. I happen to witness that capability several times per day
> personally (though in Tomcat 5.5 and 6.0, not 7.0).
>
> Also, note that JDBCRealm has long bees associated with poor performance
> due to it's use of a single Connection object for all authentication.
> Consider using DataSourceRealm along with a connection pool instead.
>
> Are you getting any errors in your log files? Usually, when a user's
> session seems to expire "during" a Tomcat restart, it's because the
> session itself is not serializable due to an object that application
> code has carelessly inserted into the session. That usually emits an
> error during session saving or re-loading.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkyOeW0ACgkQ9CaO5/Lv0PBVtQCeI+2STfjSCp3F650XsyL0WX2V
> CnsAoKUJLGCrv+VkMTdcvinr4k+J7Nen
> =J0Vx
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
*
Best Regards
Mohammad M. AbuZer*
Junior Java Developer
Mobile: +962-78-5416416
Re: How to serialize user principal
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Mohammad,
(Note the change in spelling of "principal". Principle is a notion or
laws or morals.)
On 9/13/2010 2:37 PM, Mohammad M. AbuZer wrote:
> I'm using tomcat 7.0.2 BETA, I used JDBCRealm, and I think it uses by
> default GenericPrinciple at org.apache.catalina.realm, which do not
> implement Serializable interface,
Note that the Principal itself is not stored as a session attribute, and
is therefore not "serialized" in the way you are thinking. Tomcat should
be able to persist the user's session information across a Tomcat
restart. I happen to witness that capability several times per day
personally (though in Tomcat 5.5 and 6.0, not 7.0).
Also, note that JDBCRealm has long bees associated with poor performance
due to it's use of a single Connection object for all authentication.
Consider using DataSourceRealm along with a connection pool instead.
Are you getting any errors in your log files? Usually, when a user's
session seems to expire "during" a Tomcat restart, it's because the
session itself is not serializable due to an object that application
code has carelessly inserted into the session. That usually emits an
error during session saving or re-loading.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyOeW0ACgkQ9CaO5/Lv0PBVtQCeI+2STfjSCp3F650XsyL0WX2V
CnsAoKUJLGCrv+VkMTdcvinr4k+J7Nen
=J0Vx
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to serialize user principle
Posted by "Mohammad M. AbuZer" <m....@gmail.com>.
I'm using tomcat 7.0.2 BETA, I used JDBCRealm, and I think it uses by
default GenericPrinciple at org.apache.catalina.realm, which do not
implement Serializable interface,
On Mon, Sep 13, 2010 at 8:04 PM, Caldarale, Charles R <
Chuck.Caldarale@unisys.com> wrote:
> > From: Mohammad M. AbuZer [mailto:m.abuzer09@gmail.com]
> > Subject: How to serialize user principle
>
> > Is there anyway that force tomcat to serialize user
> > Principle so that when tomcat webapp get reloaded or
> > even tomcat restarted, logged in users won't be asked
> > to login again...
>
> That normally happens automatically (as long as the session hasn't
> expired), so the real question is what did you change to disable the
> standard behavior?
>
> While you're at it, tell us the Tomcat version you're using, and the
> <Realm> you have configured for authentication.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
*
Best Regards
Mohammad M. AbuZer*
Junior Java Developer
Mobile: +962-78-5416416
RE: How to serialize user principle
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Mohammad M. AbuZer [mailto:m.abuzer09@gmail.com]
> Subject: How to serialize user principle
> Is there anyway that force tomcat to serialize user
> Principle so that when tomcat webapp get reloaded or
> even tomcat restarted, logged in users won't be asked
> to login again...
That normally happens automatically (as long as the session hasn't expired), so the real question is what did you change to disable the standard behavior?
While you're at it, tell us the Tomcat version you're using, and the <Realm> you have configured for authentication.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org