HttpSession on app protected by mod_shib

[Woolf, Carl]

Hold on, we will try “Session On” !



From: users <users-bounces at shibboleth.net> on behalf of Woolf, Carl <Carl_Woolf at hms.harvard.edu>
Date: Thursday, January 26, 2023 at 10:33 AM
To: users at shibboleth.net <users at shibboleth.net>
Subject: HttpSession on app protected by mod_shib

Greetings,



This could be more of an apache question than a Shibboleth question, but perhaps someone could help us out?



We are trying to maintain an HttpSession in our app, in addition to the app being protected within a Shibboleth session. Any guidance about how to get the (I think) standard JSESSIONID cookie to persist and facilitate the HttpSession?



In our apache config, we have a proxy for our app’s url, which goes to a tomcat that is co-located with apache. We also have a LocationMatch which protects our url’s with mod_shib. But even without the mod_shib protection in apache’s config, we are not able to persist an HttpSession. (And even without a LocationMatch, for that matter.) So, e.g., when we run our “sa” locally, without apache, we get a persistent HttpSession. But with the below in our apache config, if we ‘front’ apache on our app, we no longer get the session.



ProxyPass "/sap/" "http://our-host:8080/sa/"

ProxyPass "/sapm/" "http://our-host:8080/sa/"



<LocationMatch "/sapm">

</LocationMatch>

Any guidance would be welcome!

Thanks, - Carl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230126/00a38ad7/attachment.htm>