Authentication Across Multiple Web Applications (Revisited)

Question

          Its been an ongoing battle, but I've made some insight into this situation. The problem stands as it seems impossible to authenticate against one web application deployed as a WAR archive and have that authentication carry across to another web application with the same security constraints. I've been told by BEA that, quote:
          "It seems to me that we are violating section 11.6 of the servlet 2.2 spec which talks about webapps"
          I've also been told that this is fixed in WLS 6.0, reference issue #38732.
          For those of us building production environments using 5.1 instead of 6.0 XML based configuration, this does NOT solve our problem.
          I've dug further into the bowels of 5.1 and found that if you manually set the realm name in the login-config of the security constraint in the web.xml file in each WAR deployment as such:
               <login-config>
                    <auth-method> [whichever method] </auth-method>
                    <realm-name>WebLogic Server</realm-name>
               </login-config>
          Authentication will carry across web applications. However, I've noted that the session management then becomes unpredictable. For example:
          I log into the application TESTAPP1 which contains a protected servlet that outputs the session ID and attempts to get the authenticated principal name from the "_wl_authuser_" session variable. Upon first load of the page (after the login dialog box), the session is null [can be fixed with .getSession(true) call instead] and the "_wl_authuser_" object does not exist. Reload the page and the session appears as well as the "_wl_authuser_" object. Strange.
          I then move to TESTAPP2, which does not prompt me for authentication but also is missing the session in the same manner. Upon browser reload, the session is created with a different ID and the "_wl_authuser_" object is now available with the appropriate principal name.
          Upon moving back to TESTAPP1, I am not prompted for authentication however, I am assigned yet another session ID after browser reload, different from the first.
          So it seems that although authentication is carried across web applications, the session IDs as you move from TESTAPP1 to TESTAPP2 change, and then change again but not back to the original when going back to TESTAPP1.
          This is a particular problem since we are using Vignette's V5 as our main client and tracking sessions through V5 - this would quickly become unmanageable if a single page view access three or four different application components with three or four different session ids.
          I'm wondering if we can expect the same behavior from WLS 6.0?
          Ideally, I'd like to see WebLogic use a single session ID to track users across multiple web applications but still have session independence between applications. So if I store something in session in TESTAPP1, its not available in TESTAPP2. Does this outline the behaviour in WLS 6.0? Can anyone verify this?
          Some food for thought. Thanks!
          ./Chris
          Senior Systems Anaylst
          MassMutual Financial Group
          

Answer 1

Hello! I am searching an answer to this question too!!!
Did you get some news regarding this item?
Regards,
C.M.