CSS sticky session when source ip changes

I work for an ASP and am having problems with customers dropping their ssl connection to our app across the internet on wireless connections. The customer was using a verizon wireless card and the ip assigned to his computer was a 70.x.x.x (ipconfig) but I had the user go to http://myipaddress.com because I could not see the ip on the sniff trace. The ip changed in the verizon network to a 66.x.x.x. I was able to trace the 66 ip and found that when the user was dropped his 66 ip changed. Has anyone experienced this?? I am looking for a long term fix. Currently SSL is termingation at the server farm and I am using a sticky source ip at 4 hours. I would be willing to move the ssl to the content switch if needed but what can i do to keep the same session after a source ip change?
Thanks,
Steve
CSSIP
CSSP

by terminating ssl on the css, you could use cookie stickyness which is independent of the ip address.
This would solve your problem for sure.
Without the SSL module, you don't have much option.
If you can't use IP address, you also can't use TCP ports, so the only thing left is the SSL ID.
You could 'advanced-balance ssl' with 'application ssl'.
However, IE browsers are known to change frequently the SSLID even during a single session.
So, by using this optin, you may fix the problem of this particular client but create more issues with other customer.
Unfortunately that's the only choices available.
Gilles.

Similar Messages

Start scenario when source data change

Hi,
is it possible to start a scenario when a data on one table changes on the source DB ?
For example, an application change a timestamp on a table in the source db, this change triggers the start of the ODI scenario.
Many thanks,
Olivier

Olivier,
Can you create a database trigger on that table and populate a row in another table indicating that the timestamp on the table has changed.
Then, you can use OdiWaitForData tool from toolbox in the package as a Starting step and connect its OK with odiStartScen tool which further invokes the scenario that you want to execute.

What steps required in OWB when source gets changed?

Hi,
I have a project with source module and target module with different mappings. Everything is working fine. Now I need to change my source database connection and execute the same mappings. What steps are required to implement this changes. Im very new OWB. Kindly give your suggestions.
Regards
Kishan

Patrick,
To the solution you suggested, I understand after re-registering the source location, we would need to redploy the connector from the target to that source and also all the mappings which are using that source object.
I was wondering what would be the implications if one drops and recreates the DBLINK in the target schema to point the new source. The only which I am aware of would be to re-compile all the packages which are using that dblinks.

CSS Browse Tab When Refresh Page Changes Size and Jumps to Right Size

I'm styling a site and I must have changed something I shouldn't have.
Issue: When I click on the refresh page, the "Browse" tabe in the ribbon on the home page jumps smaller and then back to right size when the page loads. Anyone have any ideas what could be the culprit?
If I click on the tabs the size remains static, this only happens when I refresh the page.
It's really bugging me, any help much appreciated.

This could be related to the "caret browsing" feature, which moves the cursor through the page when you scroll with the arrow key. Or maybe in this case skips around things in the page.
You can turn that using either:
* F7 key
* "3-bar" menu button (or Tools menu) > Options > Advanced > General mini-tab > ''uncheck'' the box for "Always use the cursor keys to navigate within pages"
Any luck?

Sticky sessions

Do any one know what happens to a sticky session when the service goes down? Does the session get removed from the flow table immediately or does it need to age out in line with the sticky-inactivity-timer value.
thanks
Tony Barnett

This link may be of help:
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_500/advcfggd/sticky.htm#xtocid7
That is from WebNS v5.0 docs, there may be some differences in other versions.

Error 100000004 Unknown Session when Company change on Addon

I am experiencing in some customers error "100000004 unknown session", when customer changes company, and Addon has to be reloaded in automatic mode.
Addon is developed under VB.Net running B1 SP00 and SP01 version.
error is aleatory, do not occur always.
Error is trigged when trying to connect DI-API under single sign on mode.
Somebody has any information of what can be causing this error ??
Thanks in advance,
WIllie Ballesty

Hi!
I don't know what may be causing this error to you, I eventually get it once in a month or something. When it appears more than three or four times in a row, reinstalling the SBO client helps a lot.
By the way, have you tried to remove the temp folder the diapi is creating? maybe it has gotten corrupted
Hope it helps;
Jon Arranz

Finding the handler host in cluster when using sticky sessions

          Our design is like this: we have Apache front-ending the WL cluster. The session
          is not replicated across WL hosts in cluster. However, the Apache-weblogic bridge
          takes care of handling sticky - sessions ( i.e. forwarding requests in same session
          to one host in cluster )
          Now, we have some code running on Apache itself , in Perl.
          The requirement is as follows : In the Perl code, we trap certain requests which
          are NOT forwarded to Weblogic. However, in the Perl code, we do trap the JSESSIONID
          cookie. Now, using this cookie value, is it possible to know which WL host in
          cluster is handling its corresponding session ??
          This is required, since the Perl module is supposed to make an explicit HTTP request
          to that WL host - passing the JSESSIONID as a parameter - for authentication.
          Thanks,
          Subodh


can the perl module send this request to the apache webserver itself and set
          the cookie the same? That would allow apache plugin to send it to the right
          node.
          "Subodh" <[email protected]> wrote in message
          news:[email protected]..
          >
          > Our design is like this: we have Apache front-ending the WL cluster. The
          session
          > is not replicated across WL hosts in cluster. However, the Apache-weblogic
          bridge
          > takes care of handling sticky - sessions ( i.e. forwarding requests in
          same session
          > to one host in cluster )
          >
          > Now, we have some code running on Apache itself , in Perl.
          >
          > The requirement is as follows : In the Perl code, we trap certain requests
          which
          > are NOT forwarded to Weblogic. However, in the Perl code, we do trap the
          JSESSIONID
          > cookie. Now, using this cookie value, is it possible to know which WL host
          in
          > cluster is handling its corresponding session ??
          >
          > This is required, since the Perl module is supposed to make an explicit
          HTTP request
          > to that WL host - passing the JSESSIONID as a parameter - for
          authentication.
          >
          >
          > Thanks,
          > Subodh
          >

CSS Sticky-table analysis

We have a CSS 11503 at 7.4.2.02.
It has a number of L3 Sticky rules.
The users or rather their workstations are working 24 x 7.
We would like to work out what is the best sticky-inact-timeout value to use so that we can gracefully close a server (weight = 0) and drain the sticky entries for that backend server.
It would be good to have more information about the life of the sticky-entry in the table. For example when it was first loaded and perhaps the maximum elapsed time value.
Are there any debug commands that can get more information on the sticky-table entries?
Or has anyone got any other ideas on how to find out how long it would take to drain a server without actually setting the weight to zero and seeing what happens?
My last thought is to change the sticky-inact-timeout value on the rule. As I understand it this change, which appears to be dynamic will only impact new sticky sessions. So a show sticky-table should show the new value for new entries where previous sessions elapsed time has exceeded the old value. Measuring the time taken from the change to the rule to the time that the majority of sessions have shifted to the new timeout value should give an indication of the time it would take to drain the majority of users off the server to be closed.
If this is true then the only problem is how to interrogate the sticky-table which can only be paged at 100 entries a time and does not seem to be filterable in normal CLI. Hence the request for more info on Debug mode.

Gilles,
thanks for the response.
However, what I am trying to acheive is a little more than see the sticky-entries as they are displayed using the standard show sticky-table command.
For Layer three sticky entries even if you filter on IP address, you get a single entry in the standard 1 line format. I actually would like to see all entries with a given set of characteristics.
Also for SSL sticky entries there is a Hash argument that allows the ability to see much more information for an individual entry. I cannot find an equivalent for Layer 3 sticky entries.
The inability to search the whole table for certain characteristics without devizing a script with a loop on page count is giving us some interesting challenges. The abscence of information about statistics/timers on each flow is also a bit of a barrier for diagnosis.
Hence the request for more information about the sticky-table debug facilities.
regards
Andrew T

Authentication in clustered web application without sticky session

I have built JSP/Servlet/Struts application in the past on a cluster of app servers. Each app server has its own JVM running the Servlel Container. All of the HTTP requests come into a hardware load balancer, which directs the requests to one of the app servers in the cluster.
I have wanted to use the Java HttpSession management without any kind of distributed session provided by the app server. We have used "sticky" sessions. The application writes a cookie to the client on the first request. The load balancer looks for that cookie on subsequent requests and directs the request to the server that originally wrote the cookie. This ensures that all requests within the same session are handled by the same application server. This also means that if I do request.getSession().setAttribute("authenticated",true) on one request, when I do request.getSession().getAttribute(authenticated) on subsequent requests in the same session, I can be sure the value will not be null. This allows me to create a filter that checks for that session attribute on each request, and if it is false or null, redirect the request to some sort of login page. Otherwise I can be sure the user has logged in.
I want to build a stateless/non-session based application that can still handle authentication. What I mean by that is that I don't want the load balancer to have to send requests for the same session all to the same server. I would like the load balancer to send each request where ever it wants. That means the simple authentication example I explained in the last paragraph would not work. The user could login on server A, but then on a subsequent request during the same "session", the user's request could be handled by server B. In that case, the session attribute would be null, and the app would think that the user has not logged in.
My application can require that users have cookies enabled, so therefore I can assume the user is accepting cookies (I would have something to check that and redirect the user to an error page saying "turn cookies on" if cookies weren't on). I think one thing that I could do is use encrpytion with a key that is shared between all the servers in the cluster. For example, user logins in on server A, server A writes a cookie with the contents "username,1109272102009". The first part being the username that the user successfully authenticated as and the second part being a timestamp for when the cookie was created. The contents of the actual cookie would be encrypted and I would send the ciphertext as the value of the cookie. When server B gets the cookie, it can decrypt the ciphertext (using the same key as was used to encrypt the data on server A), and check that the username is valid and that the timestamp does not exceed some timeout. The timestamp in the cookie would then have to be updated for the next request.
So my question is (thanks for sticking with me and reading this really long post), has anyone done anything like this before? Is what I have described totally ridiculous or insecure? Are there any books or articles that describe a pattern similar to this that has been know to work well?

I have worked on a web site that did exactly that.
The cookie contained a little bit more information - there was a small amount of user data that were needed on heavily accessed pages.
You'll have a problem if your web application uses attributes. We solved this by keeping most stuff in hidden inputs (backed up by hidden input cryptographic checksums in places where forgery was a concern.) HttpSession attributes have some problems and gotchas.
A few possible fine tunings:
Add a random number to the cookie. Should make known plaintext attacks harder.
Add some extra stuff to the cookie, so that any random hex string that happens to decode to "xZoiyqw,15" isn't accepted. It's easy to try a million cookies until you get "<something>,<integer>" but getting "<something>,<integer>,HelloHowAreYou" is a lot harder.
Be paranoid in checking the format of the cookie. If you add a random number, check that it is all digits etc. Belt and suspenders: also check that the time stamp isn't in the future (allow e.g. 15 seconds future time, in case different servers' clocks are a bit off.)
Don't update the cookie at every hit, only if the time stamp is older than a couple of minutes. Saves encryption CPU power.
After encrypting, prepend a short version number to the cookie. E.g. if the hex cookie is ABCDEF, make it 1ABCDEF. If you later e.g. change the encryption algorithm, change version to 2 and you can easily skip any obviously non-decipherable cookies. A second version number within the cookie might or might not be useful.
Even though you can make random load balancing, consider not doing that. E.g. a server might pull the user's name from the database into memory cache. You get less database traffic and smaller caches if the user still goes to the same server. If a server goes down, only then switch him elsewhere. Downside though: if one server is "half alive" (doesn't respond to requests but alive enough so the load balancer doesn't notice the malfunction), all users bound to that server see a 100% failure.
Benchmark cookie decryption time when selecting the crypto algorithm. How many hits per second you can get and how many you need.
Guard your crypto keys like the crown jewels. Change them periodically and whenever someone in your company (especially IT department) gets the pink slip.

Sticky sessions and Load Balancing in WL Clusters

We are using iPlanet Web Server 4.1 with WebLogic App Server; and would like
to implement load balancing with sticky sessions and in-memory state
replication.
The documentation in Weblogic says that -
When using in-memory state replication, your WebLogic Server Cluster must
live behind one or more proxy servers. The proxy servers are smart enough to
send servlet requests, belonging to the same HTTP session, back to the same
server in the cluster that holds the session data.
(Ref: http://www.weblogic.com/docs51/cluster/setup.html)
Does this mean that the sticky session configuration has to be done on the
iPlanet Web Server itself ?
Also, if WebLogic is used as the Web server, does WebLogic provide any
support for sticky sessions?
Any help, suggestions or links to useful info are welcome.
Regards,
Milind.

Mike,
im curious as to why you would recomend using weblogic as a web server in 6.1?
I would not for the following reasons:
- it costs 10x more per cpu list
- it doesnt support hardware accell cards (afaik, please let me know if this has
changed)
iplanet is really good a serving up static html and gif's, especially in ssl if you
have a hardware accell card. So if you have a site with lots of graphics and you use
ssl a lot, I think its still a better solution.
-Joel
Mike Reiche wrote:
You get sticky round-robin by default.
You need to have session tracking turned on (i think it is on by default). You
need to have the WL plugin configured in iPlanet.
When WL creates an httpSession, it writes a cookie (or rewrites the URL) back
to the browser. On subsequent requests, the browser sends the cookie and iPlanet
plug-in directs the request to the correct WL instance based on the ip address
of the WL server embedded in the cookie.
If you are using WLS 6.1, I would recommend using it as a web server (and not
using iPlanet). I imagine that it supports stickly load balancing as well.
Mike
Joel Nylund <[email protected]> wrote:
you get round robin by default, if you want a different scheme you can
use one
of the other 3 options (weight, random or parameter).
-Joel
I think weight can be set in weblogic properties. I havent used any other
than
round robin.
Milind Prabhu wrote:
We are using iPlanet Web Server 4.1 with WebLogic App Server; and wouldlike
to implement load balancing with sticky sessions and in-memory state
replication.
The documentation in Weblogic says that -
When using in-memory state replication, your WebLogic Server Clustermust
live behind one or more proxy servers. The proxy servers are smartenough to
send servlet requests, belonging to the same HTTP session, back tothe same
server in the cluster that holds the session data.
(Ref: http://www.weblogic.com/docs51/cluster/setup.html)
Does this mean that the sticky session configuration has to be doneon the
iPlanet Web Server itself ?
Also, if WebLogic is used as the Web server, does WebLogic provideany
support for sticky sessions?
Any help, suggestions or links to useful info are welcome.
Regards,
Milind.

Error message severity not translated correct when locale is changed

We have a shell page displaying different task flows within a dynamic region. The shell page f:view tag has locale="#{LocaleManager.currentLocale}" to allow programmatic change of locale. Most of the flows uses the locale from the browser request (e.g. Danish) but some pages has fixed locale (en_US) and will always be rendered with this locale (don't ask me why. It's a requirement). For those fixed locale pages, the expression #{LocaleManager.currentLocale} always returns "en_US". It works nice, but we have a strange problem with the translation of error messages displayed by validators/converters. E.g. if a character is entered in a number field, the user will see the usual popup error message like "*Error:* The value is not a number". The message part of the error message is translated but the severity message prefix ("Error:" in the example), seems to be translated and cached once per session. If the error message popup has been displayed once in a different locale, then after change of locale, the severity message prefix continues to use the translation from the first display. The message part of the message is translated perfectly.
Let me give an example:
1) User enters da_DK page and enters a invalid number. Error message displayed: "*Fejl:* Værdien er ikke et tal"
2) User enters en_US page and enters a invalid number. Error message displayed: "*Fejl:* The value is not a number"
If the examples is reversed, then the error messages will be:
2) "*Error:* The value is not a number"
1) "*Error:* Værdien er ikke et tal"
Do anyone know how to clear this translated severity message prefix, when locale is changed? Or is there a better way to overcome this issue?
We're using JDeveloper and ADF 11.1.2.2 and are able to reproduce the issue on the embedded weblogic.

Hi again
ok I added another locale that ships with flash builder, and encoutered the same problem
whenever I change the locale, the error tooltips are gone
I was even able to fix both new locales by assigning the the validators custom error messages using resourceManager.getString() like i assign a value to all other UI strings in the application
the default locale which is specified in the project compiler's parameters is en_US
and my final question to you is:
is there a best practice regarding localizing & managing the error massages Flex SDK uses?
what is the internal path to the resource bundles that flex uses to display errors?
it seems like it makes more sense to copy and edit an existing list of errors, rather then blow up the application code...
can you please share your view on the matter
thank you for your help
Yariv

Connection is not following the Sticky database when one router is comming to up state.

Dear Team,
We have 2 routers configured in Cisco ACE.( Router 1: 10.250.226.4,Router 2: 10.250.226.6) and VIP 10.250.226.19. In a normal scenario all the client connections are perfectly handled by ACE and Its sending to client request to router as per the sticky database. When the router 10.250.226.4 is down, ACE cleared all the sticky database entry belongs to the 10.250.226.4. All the client connections are shifted to router 10.250.226.6.
when router 10.250.226.4 is comes, backup connections are not loadbalance properly. That is connection not following sticky database for second connections of the same ip and giving issue in establishing IPSEC connectivity. Please find the below output.
switch/RRI# sh sticky database client 10.239.10.86
sticky group : STIK-RRI-FRM
type         : IP
timeout      : 1440          timeout-activeconns : FALSE
sticky-entry          rserver-instance                 time-to-expire flags
---------------------+--------------------------------+--------------+-------+
10.239.10.86          CISCO-7206-06:0                  65274          -
switch/RRI# show conn | i 10.239.10.86
1517152    2 in UDP   90   10.239.10.86:4500     10.250.226.19:4500    --
1427552    2 out UDP   9    10.250.226.4:4500     10.239.10.86:1637     --
3051606    2 in UDP   90   10.239.10.86:500      10.250.226.19:500     --
3049659    2 out UDP   9    10.250.226.6:500      10.239.10.86:44977    --
Please find the below sample configuration we are done in ACE.
parameter-map type connection UDP_PARAM_MAP
set timeout inactivity 86450
sticky ip-netmask 255.255.255.255 address source STIK-RRI-FRM
replicate sticky
serverfarm RRI-FRM
class-map match-all RRI-VIP
2 match virtual-address 10.250.226.19 any
policy-map type loadbalance first-match RRI-VIP-l7slb
class class-default
    sticky-serverfarm STIK-RRI-FRM
policy-map multi-match RRI
class RRI-VIP
    loadbalance vip inservice
    loadbalance policy RRI-VIP-l7slb
    loadbalance vip icmp-reply
    connection advanced-options UDP_PARAM_MAP
interface vlan 90
ip address 10.250.226.17 255.255.255.240
peer ip address 10.250.226.18 255.255.255.240
access-group input ALL
access-group output ALL
service-policy input REMOTE_MGMT
service-policy input RRI
no shutdown
As per the analysis its looks seems to be tthe bug CSCsv63364, CSCsu95356. Kindly suggest how we can resolve this issue.
Image version: A2(3.4)
Thanks in advance.
Regards,
Ranjith

Hi,
Its important to know whether there was a sticky entry when the router went down and the time it came back up. Leastconnection shouldn't be a problem here.
If the IPSEC connection is active but not the UDP 500 connections, after timeout the UDP 500 connections will be removed as well as the sticky entry. If the current active IPSEC connection suddently needs to refresh SA's a new UDP 500 connection will be open and it could be sent to a different server. There is no evidence that this is the problem but want to try a higher sticky timeout has a fix for this.
Siva

DAC Physical Data Source password change - invalid username/password

We are using DAC/Informatica for loading Peoplesoft data into the warehouse. The password for the peoplesoft source was changed recently. I changed the password in DAC under setup, Type source for the Peoplesoft DB. When I select 'Test Connection' I receive the message connection established successfully. When I restart the execution plan I still get the same error - invalid username/password for obi_infa_ps, which is the account we use for accessing the Peoplesoft DB. All of the DAC and Informatica services on the server have been shutdown and restarted - still getting the invalid username/password error.
Do I need to rebuild the execution plan? If I do, can I manually put in the needed refresh dates?

You will also need to update the username/password in the Informatica Workflow Manager.
Under Connections > Relational
EDIT: First post, welcome to BI Apps!
Edited by: birchy on Nov 17, 2011 9:00 AM

How to transport FM retraction configuration if source-system changes?

Hi experts,
I have configured FM retraction in ERP through SPRO connecting it to my Dev source system in my Dev ERP. What do I need to do to transport this configuration to my production ERP and make sure the BI source-system changes from Dev to Prod as well? Is there some kind of souce-system mapping as there is in the BI side for the extraction?
For example, I have everything set-up for source-system BWD and I want it to change to BWP when I transport the configuration from ERP dev to ERP prod.
Thanks
Edited by: Pedro Fontes Pais on Dec 2, 2008 6:36 PM

Hi Christian,
Thanks for your reply, but I didn't get anywhere in OKE7 & OKE8 to include the credit records I made in KSAZ in a Transport.
Can you elaborate it more.
Thanks
Amit Goyal

Dim. SCD2 issue, when parent value change. The child loses parent history.

oracle DB: 10.2
owb: 10.2.0.4
Create a SCD2 type dimension with six levels in it. Alle levels have the same columns, see below (change the nr for the level)
L1_KPL_PK
L1_DATA_TILL
L1_SLEUTEL
L1_DESC
L1_DATA_FROM
L1
When running the mapping, the hierachie is perfectly inserted into the table. When changing the
value of the L1 parent in te source and running the mapping again the following
is happend:
He closed the parent record with the old value and insert a till date.
He update alle child record with the new value
He inserts a new record with the new value of the parent.
What i should expect wat would happen was:
He closed the parent record with the old value and insert a till date.
He close alle child records with the old value and insert a till date.
He inserts new records for all child with the new value of the parent.
He inserts a new record with the new value of the parent.
I searched on the net for this issue and i found oracle fixed it in a patch 10.2.04 The bug is know under nr 6004133
"Child looses parent reference when SCD2 attribute change in parant.
Installed the patch(7005587) and renewed my dimension, table, and mapping in the repository. Ran the mapping, but the result is not what i expexted as
descriped above.
Help needed to fix this issue. So alle histoy is beeing saved.

Hi
There was a change in OWB 10.2.0.3 (I think it was this patch) to support this scenario.
If you go to the SCD settings panel for your dimension, each level also has the parent level's identifying column (this is the new bit) and you can set the Record History property for the parent identifier in order that a change in this will trigger history in the level (so the hierarchy can be versioned). So if you set this and synchronize the dimension operator in your map and redeploy the map, you should be in shape.
So for example if you had L1, L2, L3 with attributes ID, NAME, ATT, EFF_DATE and EXP_DATE then the SCD panel would have;
*L1
ID
NAME
EFF_DATE eff date
EXP_DATE exp date
ATT trigger history
*L2
ID
NAME
EFF_DATE eff date
EXP_DATE exp date
ATT trigger history
L1_ID trigger history
*L3
ID
NAME
EFF_DATE eff date
EXP_DATE exp date
ATT trigger history
L2_ID trigger history
Let me know if its unclear.
Cheers
David

CSS sticky session when source ip changes

Similar Messages

Maybe you are looking for