Livesite session among mutliple LSDS servers in a cluster

Hi ,

We are using Loadbalancer on our website which has three webservers & three LSDS servers . We are using Livesite login facility to protect some pages by setting them private.
We have a login controller which after user authentication , establishes the Livesite session for 2 hours by using following function ::

context.getSession().setLoggedIn(true);
context.getSession().getHttpSession().setMaxInactiveInterval(7200);

This establishes the Livesite session so that if a protected page is requested again , login is not required.

In the loadbalancer , if a session is established by say LSDS 1 server , it should be valid across all 3 LSDS servers and no matter whichever LSDS server is servicing the request, login should not be required again . This functionality seems to be working fine in Firefox but in IE & Chrome , Livesite session doesn't remain valid across all LSDS servers and if a request is sent to a LSDS server which has not established the session, it asks for a Login again .

Please can you suggest me how to maintain a constant Livesite session across all LSDS servers in a cluster that works on all browsers ??

Thanks !

Regards,
Ankit

Find more posts tagged with

Comments

Rick Poulin

Please can you suggest me how to maintain a constant Livesite session across all LSDS servers in a cluster that works on all browsers ??

What you're talking about is "session affinity" (if you're asking what to search on google). It's usually a function of the application container that is hosting the web applications, and is therefore specific to the container you're using. I believe the default container (tomcat) can achieve this, possibly in conjunction with some Apache wizardry, but you'd have a much easier time of it if you went with an enterprise container (WebSphere/WebLogic/JBoss/Geronimo/etc).

sheikh1

Hi ,

Please can you suggest me how to maintain a constant Livesite session across all LSDS servers in a cluster that works on all browsers ??

Thanks !

Regards,
Ankit

In the lines of rick..we had similar issue in the past with weblogic servers and it turned out that the webserver which delegates the requests were not maintaining the session cookie, generall for java apps it will be JSESSIONID,

if your webserver is apache make sure your proxypass has your cookie name mentioned.
ProxyPass /example http://www.yourserverOrHostname.com stickysession=JSESSIONID
There is link which has answer for balancer proxyset tag here http://stackoverflow.com/questions/6018428/sticky-session-with-apache-web-server-and-tomcat-servers

nipper

Also make certain your loadbalancer (typically an F5 or something) is set to maintain session affinity.

TeamsiteDev

Hi ,
Thanks guys for your replies.

The Sticky session setting is done and seems the session is being maintained across servers.

But I am facing a issue specifically on Chrome & IE. I have protected a page in Sitepublisher by setting it as private, when this page is accessed , livesite goes to the login page mentioned in default.site . The login page in turn goes to a authorization management tool link called OAM, after the authentication is done, the login controller is livesite uses the params to set login cookie and establish a livesite session using below functions ::

context.getSession().setLoggedIn(true);
context.getSession().getHttpSession().setMaxInacti veInterval(7200);

Once this is done , livesite should not send the request to Login page if a protected page is accessed again . This thing is working perfectly in Firefox but in Chrome & IE , it seems that "context.getSession().setLoggedIn(true); " is not having any affect. The login controller executes this function and does a Forward action to protected page, but since this function is not able to setup the logged-in session , control again goes to Login page - then to Login controller and goes into a loop.

I am not able to understand how it is working in Firefox but failing in Chrome & IE. Could it be that the JSESSIONID cookie is not being rewritten after "context.getSession().setLoggedIn(true); " is called ??

Thanks !

Regards,
Ankit

Rick Poulin

I am not able to understand how it is working in Firefox but failing in Chrome & IE. Could it be that the JSESSIONID cookie is not being rewritten after "context.getSession().setLoggedIn(true); " is called ??

Your server side calls couldn't care less which browser you're using, so some browsers are not passing/receiving the information the way you're expecting it to. Unless you've extended/replaced the default UserSession object, its "isLoggedIn" value is a simple boolean, so there's no reason for funny business. However, if this not actually related to the browser but rather how the LB decided to switch servers on you, it's possible that your session affinity isn't working quite right. The containers will trade HttpSession information, but isLoggedIn is a property of the UserSession wrapper, so it may not be exchanged between runtimes. Be careful about how and when you reference it. You might be better off using get/setAttribute, which actually writes to the underlying HttpSession object.

BTW, I don't know how your access manager works, but some browsers (notably certain versions of WebKit) do not read cookies set on a HTTP 301/302 response, so that could have something to do with it.