HttpSession NullPointerException on Apache Tomcat 8.5.4

[Domingues, Michael D]

> And it's presumably not happening with that version. What about earlier versions of 8.5?

Correct, no similar issues occur on Tomcat 8.0.36. Tomcat 8.5.3 had a regression which removed the entire org.apache.juli package from the embedded JARs [1], which led to a whole host of other issues, which also necessitated a rollback. No NullPointerException issues were noted, however.

> You need to be clearer about your storage configuration, but I'm guessing it's using client-side. 
> That still leaves options open, but I doubt it matters whether local storage is on.

We are using client-side storage, specifically,  HTML Local Storage, to support SLO flows.

> You need to file a bug, because I want to reproduce the error handling behavior and see
> if that's a bug or not, but the session thing is very likely not our bug.

Will do. I should have one filed by early this afternoon.

>> We made no changes to our IdP configuration during the Tomcat upgrade,
>> and only updated Tomcat's server.xml to explicitly use the JSSE-based HTTP
>> connector, to maintain parity with our Tomcat 8.0.36 deployment.

> Did you try it without that change? What's the default?

I did not try on 8.5.4 without the JSSE-based HTTP connector (org.apache.tomcat.util.net.jsse.JSSEImplementation). In 8.5.3, it defaulted to org.apache.tomcat.util.net.openssl.OpenSSLImplementation.

> There really isn't much we can do either way but track it. It's something we need to be able
> to reproduce, and it sounds like that requires load (so it's likely a race condition in their code).
> Can you reproduce it under some load?

I'll rig up a couple of test scenarios this afternoon with both SSL implementations and try to reproduce the issue under load using the technique described here [2].

Michael

[1] http://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.4_(markt)
[2] https://wiki.shibboleth.net/confluence/display/IDP30/Capacity+Planning

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net