Lost session

[Cantor, Scott]

On 9/3/13 9:39 PM, "Xiaoshu Wang" <xiaoshuw at email.unc.edu> wrote:

>Just did a test, hope this might help shine some lights on.

I know nothing about Glassfish, I'm just telling you your basic
interpretation is off in some way.

>I put in these configuration on glassfish-web.xml because without it.
>When sending multiple request, some request is returned back (200 code
>but with an empty response body). My server code never see these requests.

If the SP were trying to cause a session to be created, as you were
suggesting, those would be 302 redirects, not empty responses.

>And all these happens when there is
> a valid shibboleth session. However, turning off these glassfish option,
>then the previous problem is gone.

I guess the glassfish code is doing something then, but that isn't
anything I can speak to.

><session-config>
><session-manager persistence-type="replicated">
><manager-properties>
><property name="relaxCacheVersionSemantics" value="true" />
></manager-properties>
></session-manager>
></session-config> 

As I think you probably understand, the session referred to there is not
anything to do with the SP. It doesn't know about Java and it can't
connect up with that session.

Perhaps there's a Glassfish bug related to header size and populating all
those headers causes it to react badly. If using the environment works, as
it should with any AJP-capable container, then it seems like that's your
workaround.

-- Scott