<div style="font-family: Helvetica; font-size: 17px; ">Right, part of the activities requires Shib, but other not. That is why it is configured like that so when there is Shib session, the attributes will be passed. <div><br></div><div>The problem takes place when there is no valid Shibboleth session. I thought in that case, Shibboleth should just hand out what it gets to Glassfish. But apparently it does not. I have done the control.</div><div><br></div><div>No Shib --> O.K.</div><div>ShibUseEnvironment --> O.K.</div><div>ShibUseHeader --> No.</div><div><br></div><div>It is the same application run in each of these setting. So, it shows that somehow ShibUserHeader has interfered. Otherwise, it shouldn't give me the above result, right? But I do not know what so hope your guys can give me some insight. It is not difficult to duplicate the problem as I have tested both on my local machine setup and our school's cluster. In both cases, the above result stand. </div></div>
<div><div><br></div><div>-- </div><div>Xiaoshu Wang</div><div>Sent with <a href="http://www.sparrowmailapp.com/?sig">Sparrow</a></div><div><br></div></div>
<p style="color: #A0A0A8;">On Tuesday, September 3, 2013 at 8:50 PM, Cantor, Scott wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>On 9/3/13 8:27 PM, "Xiaoshu Wang" <<a href="mailto:xiaoshuw@email.unc.edu">xiaoshuw@email.unc.edu</a>> wrote:</div><blockquote type="cite"><div><div>My application is configured as such.</div><div><br></div><div><Location /myapp></div><div> AuthType shibboleth</div><div> ShibRequestSetting requireSession 0</div><div> ShibUseHeaders On</div><div> Require shibboleth</div><div></Location></div><div><br></div><div>The strange behavior is that when I send multiple requests (typical AJAX</div><div>behavior) simultaneously to the server, it will result a session loss.</div><div>That is the request leads to the creation of a new session, instead of</div><div>holding on to the previously created session, on the server side.</div></div></blockquote><div><br></div><div>You have no requirement for a session above, so I don't understand your</div><div>statement here, but you're going to have to diagnose the cookie issue</div><div>involved if you have a session problem.</div><div><br></div><blockquote type="cite"><div><div>If I took off the Shibboleth, then things work fine. If I change the</div><div>ShibUserHeaders to ShibUseEnvironment, then it will also work. I wonder</div><div>what has caused this and is there anyway to get around it?</div></div></blockquote><div><br></div><div>The header vs. environment difference is solely in how you access the data</div><div>on the server side and cannot have any effect on session behavior.</div><div><br></div><div>-- Scott</div><div><br></div><div><br></div><div>--</div><div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>