org.apache.tomcat.session.*

[Oki DZ <ok...@pindad.com>]

Hi,

What is exactly the use of StandardManager class?
I have copied:
<Manager className="org.apache.tomcat.session.StandardManager"
checkInterval="60" maxActiveSessions="-1" maxInactiveInterval="-1" />
to my server.xml (if it's the right way to do it), but I don't know how to
access the instance of the object; there's no static object-ref to
"Manager" (if that's what "Manager" supposed to mean).

I'm thinking about subclassing Tomcat (org.apache.tomcat.startup.Tomcat)
and create a member for StandardManager so that all my servlets can have
access to the session. Is this the Right Thing(tm)?

Thanks in advance,
Oki
--
                                             Glossary:
                                             *M* Memory Leak: (Deprecated)
                                                       -Unwritten JavaBook 101

Re: org.apache.tomcat.session.*

[Oki DZ <ok...@pindad.com>]

On Mon, 19 Jun 2000, Craig R. McClanahan wrote:
> Sessions are *not* shared across servlet contexts (i.e. web
> applications) at all.  If you need to share information across contexts,
> you will need to use some sort of external mechanism. 

RMI and some other "remote-objects" implementations come into mind. Once I
tried to implement the mechanism using Voyager (from ObjectSpace); so that
my object was sitting there had been loaded by a daemonized JVM (eg: 
"java UserList &" and later my servlets communicated with the objects
using Voyager's remote-objects facilities. It was nice and doable. But now
I think that if I could do the same thing in a simpler way, why not? (BTW,
using Voyager was not that difficult, well, easy I should say. I just need
something simpler.) 
 
> It might be possible to do something like this, but you are making
> (IMHO) a very risky business decision -- using a technique that is not
> portable to any other servlet container.  Much as I like Tomcat :-), I
> do not think you should tie yourself to Tomcat any more than you should
> tie yourself to any other particular vendor's server. 

If subclassing the web server is a procedure that should be kept remote,
then IMHO, Tomcat would need a mechanism for loading classes other than
servlets. Suppose that you have servlets that should access a super-duper,
computing-intensive graphics (Java) objects, then preloading the objects
would be a nice feature. Sure, RMI or any other remote-objects facilities
will do the same thing, but I think that they are a bit more
sophisticated (which might need some other things to be concerned).  

> Craig

Oki

Re: org.apache.tomcat.session.*

["Craig R. McClanahan" <Cr...@eng.sun.com>]

Oki DZ wrote:

> On Wed, 14 Jun 2000, Craig R. McClanahan wrote:
> > StandardManager is responsible for "managing" (hence the name) the current active
> > sessions for the current web application.
>
> I see...
> BTW, why was it named StandardManager, and not StandardSessionManager? You
> have SecurityManager afterall.
>

The design pattern here came from Catalina, which has a "Manager.java" interface
defining the session manager capabilities.  "StandardManager.java" is the standard
implementation of this interface.

>
> > Why do you need something special?  The standard way to get a session (if it
> > already exists) or create one (if not) is to call request.getSession() in your
> > doGet() or doPost() method.  The Manager is used internally in responding to this,
> > but that is invisible to your servlets.
>
> Basically, I need to access the session (its attributes, to be exact). In
> a web-based database application, I need to maintain different users with
> different access rights (SQL rights), and I think I have to synchronize
> each session for each user that's currently connected to the database (I'd
> like to leave the connections open on sessions that are active because I
> believe that opening connections could be "costly" in terms of time).

Some connection pool implementations will deal with this scenario for you -- you
basically ask for a connection for a particular user, and it will come back configured
with that user's access rights.

Alternatively, you can just keep a single connection for each user in the user's
session.  This isn't as scalable, but in reality it's no different than your typical
client-server application that used the exact same technique.

If you're using a database like Oracle, you might investigate the option of having a
generic database login so all users can share it, and then execute an ALTER TRANSACTION
SET ROLE command to set the database permissions to those for a particular role.  This
command executes much more quickly than opening a new connection, and allows you to
share generic connections in a normal connection pool.

> So,
> I would need a "UserList" object that maintains usernames/passwords and
> the db-connections. The users in this list would be disconnected from the
> database if the session is not active (timed-out). I think, I need to have
> an access to the active sessions (from my classes).  Question is, how can
> I access each of the session?
>

If you really need this, it should be built into your connection pool implementation so
that the application does not have to worry about it.

>
> BTW, if you have web applications than spans several contexts, I think
> you'd need to have an access to the "session list". Question is, where
> does Tomcat hold the object ref. for the sessions?
>

Sessions are *not* shared across servlet contexts (i.e. web applications) at all.  If
you need to share information across contexts, you will need to use some sort of
external mechanism.

The sessions for a particular context are in fact stored in the "sessions" Hashtable in
StandardManager.  There is no mechanism in the servlet API for you to acquire a
reference to any session other than the one relevant for the current request.

>
> Another thing... suppose that I already have the UserList class. When
> should I load the class? During the servlets run? I don't think so. That's
> why I asked about subclassing Tomcat?  (ie:
> org.apache.tomcat.startup.Tomcat;  btw, what do you call this? FQCN? Fully
> Qualified Class Name.) Anyway, I do really need a way to somehow loading
> my own objects so that they would be available to my servlets (or jsp's).
>

It might be possible to do something like this, but you are making (IMHO) a very risky
business decision -- using a technique that is not portable to any other servlet
container.  Much as I like Tomcat :-), I do not think you should tie yourself to Tomcat
any more than you should tie yourself to any other particular vendor's server.

To go down this path, you really need to start with an in depth understanding of the
current Tomcat source code.  Plan on spending several weeks of intensive study.
Developers who are modifying Tomcat internals for their own use are sort of expected to
be knowledgeable about how it is organized internally.

>
> Long ago, I had headaches caused by that simple problem (I was using a
> non-Java-based webserver); due to the fact that servlets' states are gone
> after the requests are fulfilled. I also needed to preserve states that
> would have been unsuitable to be put on sessions (eg: db connections).
> Now, Tomcat is available, so I believe that subclassing the web server
> would be the answer; and I need some pointers...
>

The more portable approach would be to either find a connection pool that deals with
individual users/passwords, or use role-based security in the database so that you can
use a common username/password.

>
> > Craig McClanahan
>
> Oki
> ps: isn't it cool when you can say: I run MyTomcat as my web server.
> --

It's only cool if you want to be the only person in the world using it -- so you have to
maintain it yourself now and forever more :-).

Craig

Re: org.apache.tomcat.session.*

[Oki DZ <ok...@pindad.com>]

On Wed, 14 Jun 2000, Craig R. McClanahan wrote:
> StandardManager is responsible for "managing" (hence the name) the current active
> sessions for the current web application.

I see...
BTW, why was it named StandardManager, and not StandardSessionManager? You
have SecurityManager afterall.
 
> Why do you need something special?  The standard way to get a session (if it
> already exists) or create one (if not) is to call request.getSession() in your
> doGet() or doPost() method.  The Manager is used internally in responding to this,
> but that is invisible to your servlets.

Basically, I need to access the session (its attributes, to be exact). In
a web-based database application, I need to maintain different users with
different access rights (SQL rights), and I think I have to synchronize
each session for each user that's currently connected to the database (I'd
like to leave the connections open on sessions that are active because I
believe that opening connections could be "costly" in terms of time). So,
I would need a "UserList" object that maintains usernames/passwords and
the db-connections. The users in this list would be disconnected from the
database if the session is not active (timed-out). I think, I need to have
an access to the active sessions (from my classes).  Question is, how can
I access each of the session?

BTW, if you have web applications than spans several contexts, I think
you'd need to have an access to the "session list". Question is, where
does Tomcat hold the object ref. for the sessions?

Another thing... suppose that I already have the UserList class. When
should I load the class? During the servlets run? I don't think so. That's
why I asked about subclassing Tomcat?  (ie:
org.apache.tomcat.startup.Tomcat;  btw, what do you call this? FQCN? Fully
Qualified Class Name.) Anyway, I do really need a way to somehow loading
my own objects so that they would be available to my servlets (or jsp's). 

Long ago, I had headaches caused by that simple problem (I was using a
non-Java-based webserver); due to the fact that servlets' states are gone
after the requests are fulfilled. I also needed to preserve states that
would have been unsuitable to be put on sessions (eg: db connections).
Now, Tomcat is available, so I believe that subclassing the web server
would be the answer; and I need some pointers... 

> Craig McClanahan

Oki
ps: isn't it cool when you can say: I run MyTomcat as my web server.
--
                                             Glossary:
                                             *M* Memory-leak: (Deprecated)
                                                       -Unwritten JavaBook 101

Re: org.apache.tomcat.session.*

["Craig R. McClanahan" <Cr...@eng.sun.com>]

Oki DZ wrote:

> Hi,
>
> What is exactly the use of StandardManager class?
> I have copied:
> <Manager className="org.apache.tomcat.session.StandardManager"
> checkInterval="60" maxActiveSessions="-1" maxInactiveInterval="-1" />
> to my server.xml (if it's the right way to do it), but I don't know how to
> access the instance of the object; there's no static object-ref to
> "Manager" (if that's what "Manager" supposed to mean).
>

StandardManager is responsible for "managing" (hence the name) the current active
sessions for the current web application.

>
> I'm thinking about subclassing Tomcat (org.apache.tomcat.startup.Tomcat)
> and create a member for StandardManager so that all my servlets can have
> access to the session. Is this the Right Thing(tm)?
>

Why do you need something special?  The standard way to get a session (if it
already exists) or create one (if not) is to call request.getSession() in your
doGet() or doPost() method.  The Manager is used internally in responding to this,
but that is invisible to your servlets.

>
> Thanks in advance,
> Oki

Craig McClanahan