You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lenya.apache.org by Andreas Hartmann <an...@apache.org> on 2009/04/15 13:59:29 UTC
Isolating publication sessions
Hi Lenya devs,
as you might be aware, Lenya's session management is quite unusual.
Typically, web applications use a dedicated session per "authentication
unit". E.g., usually you authenticate against a complete web
application, and the application session reflects this authentication.
In contrast to that, Lenya uses a single session for multiple
"authentication units" (i.e., accreditable managers or, in other words,
user bases). For instance, if publication A and publication B use
different accreditable managers, you have to log in every time you
switch between A and B in the same browser.
At best, this is annoying. But if you access a page in publication A
which contains an image from publication B, you are actually logged out
of A since the identity is reset when the request to publication B is
processed.
IMO the only reasonable solution to this problem is to isolate the
sessions for each accreditable manager and allow multiple parallel
authenticated identities. The cleanest solution might be to use a
dedicated servlet for each publication, but this would probably make the
application deployment and management much more complicated. A simpler
approach would be to use the accreditable manager ID as part of the
session attribute name, e.g.:
String accrMgrId = accreditableManager.getId();
String key = Identity.class.getName() + "/" + accrMgrId;
session.setAttribute(key, identity);
When a request is processed, only the identity for the corresponding
accreditable manager is taken into account. This looks a bit strange,
though – we're kind-of replicating the servlet engine's session
management on the application level.
Do you think this makes sense? Or are there better solutions?
BTW, I filed a bug for this issue:
https://issues.apache.org/bugzilla/show_bug.cgi?id=47023
-- Andreas
--
Andreas Hartmann, CTO
BeCompany GmbH
http://www.becompany.ch
Tel.: +41 (0) 43 818 57 01
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: Isolating publication sessions
Posted by Richard Frovarp <Ri...@ndsu.edu>.
Andreas Hartmann wrote:
> Richard Frovarp schrieb:
>> Andreas Hartmann wrote:
>>> Hi Lenya devs,
>>>
>>>
>>> IMO the only reasonable solution to this problem is to isolate the
>>> sessions for each accreditable manager and allow multiple parallel
>>> authenticated identities. The cleanest solution might be to use a
>>> dedicated servlet for each publication, but this would probably make
>>> the application deployment and management much more complicated. A
>>> simpler approach would be to use the accreditable manager ID as part
>>> of the session attribute name, e.g.:
>>>
>>> String accrMgrId = accreditableManager.getId();
>>> String key = Identity.class.getName() + "/" + accrMgrId;
>>> session.setAttribute(key, identity);
>>>
>>> When a request is processed, only the identity for the corresponding
>>> accreditable manager is taken into account. This looks a bit
>>> strange, though – we're kind-of replicating the servlet engine's
>>> session management on the application level.
>>>
>> Separate servlets would be a killer and should be avoided. Pairing
>> the accreditable manager with the ID works for me.
>
>
>> Do we still have a problem with the sessions growing out of control?
>
> I hope we could mitigate it by changing most of the tab usecases not
> to use continuations. Does anybody still run into memory issues?
>
> -- Andreas
>
>
The version that my old job uses is quite old. I did go through and
modify several of the usecases to not use continuations and I think it
helped some. They probably won't have good data until next August
though. It was really bad when we had about 100 people logged in for 4
hours straight. I probably should do some testing.
Richard
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: Isolating publication sessions
Posted by Andreas Hartmann <an...@apache.org>.
Richard Frovarp schrieb:
> Andreas Hartmann wrote:
>> Hi Lenya devs,
>>
>>
>> IMO the only reasonable solution to this problem is to isolate the
>> sessions for each accreditable manager and allow multiple parallel
>> authenticated identities. The cleanest solution might be to use a
>> dedicated servlet for each publication, but this would probably make
>> the application deployment and management much more complicated. A
>> simpler approach would be to use the accreditable manager ID as part
>> of the session attribute name, e.g.:
>>
>> String accrMgrId = accreditableManager.getId();
>> String key = Identity.class.getName() + "/" + accrMgrId;
>> session.setAttribute(key, identity);
>>
>> When a request is processed, only the identity for the corresponding
>> accreditable manager is taken into account. This looks a bit strange,
>> though – we're kind-of replicating the servlet engine's session
>> management on the application level.
>>
> Separate servlets would be a killer and should be avoided. Pairing the
> accreditable manager with the ID works for me.
> Do we still have a problem with the sessions growing out of control?
I hope we could mitigate it by changing most of the tab usecases not to
use continuations. Does anybody still run into memory issues?
-- Andreas
--
Andreas Hartmann, CTO
BeCompany GmbH
http://www.becompany.ch
Tel.: +41 (0) 43 818 57 01
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: Isolating publication sessions
Posted by Richard Frovarp <rf...@apache.org>.
Andreas Hartmann wrote:
> Hi Lenya devs,
>
>
> IMO the only reasonable solution to this problem is to isolate the
> sessions for each accreditable manager and allow multiple parallel
> authenticated identities. The cleanest solution might be to use a
> dedicated servlet for each publication, but this would probably make
> the application deployment and management much more complicated. A
> simpler approach would be to use the accreditable manager ID as part
> of the session attribute name, e.g.:
>
> String accrMgrId = accreditableManager.getId();
> String key = Identity.class.getName() + "/" + accrMgrId;
> session.setAttribute(key, identity);
>
> When a request is processed, only the identity for the corresponding
> accreditable manager is taken into account. This looks a bit strange,
> though – we're kind-of replicating the servlet engine's session
> management on the application level.
>
Separate servlets would be a killer and should be avoided. Pairing the
accreditable manager with the ID works for me. Do we still have a
problem with the sessions growing out of control?
Richard
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org