You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2024/01/05 14:55:39 UTC
[Bug 68449] New: session.maxInactiveInterval() is not working for SSO Users.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
Bug ID: 68449
Summary: session.maxInactiveInterval() is not working for SSO
Users.
Product: Tomcat 9
Version: 9.0.83
Hardware: PC
Status: NEW
Severity: blocker
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: jarkalam@gmail.com
Target Milestone: -----
I am facing issues with setting a User session duration to an arbitrary value.
The exact issue is that even if I set the value to as much as 30 minutes the
session timesout withiin 2 minutes.
Was facing this issue for all Users. Chanced upon
https://bz.apache.org/bugzilla/show_bug.cgi?id=67793 and opted to upgrade to
Tomcat 9.0.83
The update to Tomcat 9.83 resolved this issue for users except SSO enabled
Users.
My default session timeout value is set to 30 in web.xml, so -
<session-timeout>30</session-timeout>
I understand, this should set the timeout interval to 30 minutes and would be
applicable across all user sessions.
Attempting to use -
session.setMaxInactiveInterval(300)
to change a particular User session duration to 5 mins.
<Question>Has this been deprecated and should I be moving this to
context.setMaxInactiveInterval(), instead?</Question>
The issue I face is that the value set through
setMaxInactiveInterval()
does not have appear to have any effect.
<Question>Remember reading that the timeout value will be defaulted to the
value in web.xml, every 2 or 5 minutes (by a Tomcat process?). Is this
correct?</Question>
On checking
localhost_access_log
I do not find any requests hitting Tomcat server. But for some reason the
timeouts just do not work.
What I mean by that is even if the User sets the value to 30 minutes, Tomcat
sesion timesout in 2 minutes.
I repeat right now the issue is for SSO enabled Users and I have set up the
below to this purpose -
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true">
...
<Valve className="SingleSignOn"/>
...
</Host>
SSO authentication works correctly and SingleSignOn.invoke() is also executed
without any error.
I am invoking
session.etMaxInactiveInterval (seconds)
from inside invoke() and I see that this piece of code is being executed as
well.
This happens ever since I moved from Tomcat 9.0.64 to (9.0.76 & 9.0.82 &
9.0.83)
I am left without any idea where/what to look for now.
Kindly advise.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
Please provide detailed, step-by-step instructions to recreate the issue you
are seeing.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
--- Comment #2 from Rajkamal Pillai <ja...@gmail.com> ---
Steps to replicate:
1. Set
[code]
<session-config>
<session-timeout>10</session-timeout>
...
</session-config>
[/code]
2. Start Tomcat (I am on Tomcat 9.0.83).
3. From Java Action execute -
[code]
public void execute (HttpServletRequest request, HttpServletResponse response)
{
request.getSession();
session.setMaxInactiveInterval(30);
}
[/code]
4. Leave the application unattended for a while.
5. The session times out within 2 minutes and the User is redirected to the
login screen.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
--- Comment #3 from Rajkamal Pillai <ja...@gmail.com> ---
Correction: session.setMaxInactiveInterval ( 1800 );
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
Jhone <my...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #1 from Jhone <my...@gmail.com> ---
It seems like you're encountering persistent issues with session timeouts
within Tomcat, particularly for SSO enabled Users even after updating to Tomcat
9.0.83.
The behavior where the session times out prematurely despite setting the
setMaxInactiveInterval() might indeed have multiple underlying causes.
Regarding your first question about whether setMaxInactiveInterval() has been
deprecated and whether context.setMaxInactiveInterval() should be used instead:
No, setMaxInactiveInterval() has not been deprecated. It's the method used to
set the maximum time interval, in seconds, a session can remain inactive before
Tomcat invalidates it. However, context.setMaxInactiveInterval() refers to a
different level of configuration, applicable at the context level, not
specifically for managing individual session timeouts.
Regarding the second question about the defaulting of the timeout value to the
one specified in web.xml every 2 or 5 minutes by a Tomcat process:
Normally, the session timeout value set through web.xml is a default for the
application unless overridden by individual session settings. Tomcat doesn't
forcibly reset session timeouts to the value in web.xml every few minutes; it
should retain the interval you've set unless explicitly changed during runtime.
The absence of requests hitting the Tomcat server in the localhost_access_log
despite session timeouts suggests a potential issue. If sessions are timing out
prematurely without corresponding requests, it might indicate a disconnect
between the user's actions and the server's understanding of their session
activity.
Considering that SSO enabled Users are specifically affected, it might be worth
investigating how the SSO setup interacts with session management in Tomcat.
Ensure that the SSO setup isn't unintentionally affecting or overriding session
configurations.
Additionally, given that the issue arose after migrating from Tomcat 9.0.64 to
newer versions, there could be changes in default behaviors or configurations
in these versions impacting session handling. Reviewing release notes or
documentation for each version might provide insights into any changes that
could influence session management.
Investigating logs or enabling more detailed logging related to session
management and SSO could offer clues about what might be causing this
unexpected behavior. It might be beneficial to consult Tomcat forums or reach
out to the Tomcat community for specific insights or experiences related to SSO
and session management with the newer versions.
Combining a detailed analysis of Tomcat's session management, reviewing SSO
configurations, and potentially seeking community support could help narrow
down and resolve this issue
For More info Visit: https://pigsnames.com/
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |WORKSFORME
Status|NEW |RESOLVED
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
I have tested the provided reproduction steps with Tomcat 9.0.x and I do not
see the behaviour described.
Monitoring session TTL via the Manager web application I can see that the call
to session.setMaxInactiveInterval() has the expected effect and changes the
session TTL.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 68449] session.maxInactiveInterval() is not working for SSO Users.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68449
classpathH5x807.k9mailAP <wo...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |wonhitwsndermyththunder@gma
| |il.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org