JSESSIONID handling

Hi all, I am using Weblogic 10.3.3. I have some confusion regarding authentication and web applications.
I have two test web applications deployed on the same managed server (NO cluster). One web application's login-config is set for form based and the other's CLIENT_CERT. On accessing the login form for the first application, I notice that JSESSIONID is generated. Then on authentication, the JSESSIONID is rewritten.
Then, using the same browser, when I access my second application (with login-config set to CLIENT_CERT), I find that the log on is automatic. Please note that I have NOT configured any Identity Asserters. I have only a single default authorization provider.
I am just trying to figure out why did it work this way. Why didnt WLS complain about the lack of the identity asserter? I understand that CLIENT_CERT kicks off identity assertion instead of the normal authentication. Does the default authentication provider handle this identity assertion by looking at JSESSIONID?
Whats the actual internal storage relationship between Subject and Session. How does JSESSIONID help in dereferencing application specific session data. Is it actually the context path + JSESSIONID that deferences the session data?
Thanks and regards.

Hi,
In this scenario the best option will be to change the default Cookie-Name for the Application. By defeult the CookieName will be "JSESSIONID" so you can chose a different cookie name for your different applications to avoid this issue.
To change the <cookie-name> of your Application you will need to add the <cookie-name> tag inside the "weblogic.xml" like following:
<?xml version=”1.0″ encoding=”ISO-8859-1″?>
<weblogic-web-app xmlns=”http://www.bea.com/ns/weblogic/90“>
    <session-descriptor>
            <cookie-name>XSESSIONID</cookie-name>
            <timeout-secs>900</timeout-secs>
            <invalidation-interval-secs>30</invalidation-interval-secs>
    </session-descriptor>
</weblogic-web-app>If your application is already running in production and if you donot want to change the Deployment descriptors then you can do it using "plan.xml" feature of WebLogic which will on the fly change the Cookie Name of your Application.
http://middlewaremagic.com/weblogic/?p=336
Thanks
Jay SenSharma
http://middlewaremagic.com/weblogic (Middleware magic Is Here)

Similar Messages

PI 7.11 - Capacity to handle maximum load/size per transaction

Experts,
What is the SAP Benchmark testing for PI 7.11 ..regarding load / huge data, that is what was the maximum size PI 7.11 can handle in one transaction.
Any SAP / OSS document Please.
Thanks
Edward

Hi Edward,
Check the below links
http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/00982670-748c-2a10-3985-cdd42fb43e50;jsessionid=
/people/aayush.dubey2/blog/2007/10/10/zip-transfer-unzip-increase-the-performance-of-your-java-abap-applications
/people/pooja.pandey/blog/2005/10/17/number-formatting-to-handle-large-numbers
/people/alessandro.guarneri/blog/2007/02/21/sap-xi-acting-as-a-huge-file-mover
/people/alessandro.guarneri/blog/2006/03/05/managing-bulky-flat-messages-with-sap-xi-tunneling-once-again--updated
Regards
Ramesh

Session timeouts or JsessionIds.

I am having a problem with my login page. Users are able to login without any problems under normal circumstances. When a user logs out and does not close the window and then comes back some time later and tries to login again the page simply reloads. The second time the user tries to login everything is back to normal. It is only after the login page (what you get to after logging out) has sat for a while that it behaves in this strange way.
When this refresh occurs on the first login try the submit button action is not called. Also the back button lets the user repeat that first login that just refreshes the page. So if the user tries to login and the page refreshes and the user clicks back and then enters login information again and clicks submit page refreshes again. Sometimes after the page refreshes the jsessionid is printed in the address bar after the page address.
Any insight appreciated or please ask me for more information I do not know what exactly would help. thanks

I think that what is happening here is that the session has timed out and thus the JSF engine fails to find the view for the login page during the Restore View phase. Then the request cannot be handled like a postback and is treated like a fresh request for that view. So the Update Model, Invoke Application, etc. phases are skipped.
I think that we addressed this by creating an <error-page> entry in the web.xml for the ViewExpiredException.

How can I accomodate for JSessionId in my dynamic links?

Hey,
I have dynamic links that are producing "Page not found" errors because of the appended jsessionid.
Example:
desired url = http://www.allhonours.ie/Ask/viewq.do?qId=52
actual url = http://www.allhonours.ie/Ask/viewq.do;jsessionid=2333E4463870ED22CEB657D8DF2380CD?qId=52
I'm using JBoss/Tomcat and struts.
I understand that jsessionid is appended when cookies are disabled on the client side.
Is there any solution to this problem? I know if the page is refreshed, I get the desired url!!
Ideally I want a session as I store certain info on the session but I dont want jsessionid disrupting my links!
Any ideas?
Cheers in advance
-pb

You would have to stop tracking the session with cookies and start
tracking the session on the server.um. how?
The whole point of the cookie/url rewriting is for the client to identify itself uniquely to the server. HTTP is a stateless protocol. The only way you can run a session, is if each request sends along extra information identifying itself as belonging to a particular session - the jsessionid.
If cookies are enabled, it sends this data as a SESSION cookie (one that disappears when your browser closes - ie it is not saved to your hard disk) Otherwise it has to use URL rewriting.
I have dynamic links that are producing "Page not found" errors
because of the appended jsessionid.Appending the jsessionid should not disrupt your links, unless you are doing something funny with them. Do you process the URL yourself in anyway?
What version of Tomcat/Struts are you using? Are you putting the jsessionid in there, or is it coming automatically?
Basically I don't see any way around your problem, short of writing your own session handling mechanism. (bad idea)

Mod_jk load balancing and JSESSIONID

I'm not very good with servers, in fact i'm a total newbie.
So I had someone explain to me how things work...
What I understood is this:
Apache runs on machine "Zeus" and it handles all the incoming http requests, mod_jk runs on that machine also.
mod_jk checks to see your sessionID if you've got one, and sends you to one of the 2 machine beneath it where tomcat runs. So if its the first time you log on it'll send you to the one with least load. Subsequent requests apache/mod_jk will check your JSESSIONID and send you to the corresponent machine. CORRECT?
Problem is, that in my case it doesnt.
It sends you randomly (or seemingly random) from one machine to the other thereby setting you a new SessionID each time you switch server. And this can be a nuisance.
Now I dont know if there is a problem with the server or with the JSP pages.
The only way, that i see, the JSP pages could cause this is if there is a method called to delete the sessionID. the only one I could see in the api is "session.invalidate()"
This however is nowhere to be found int JSP pages.
From the programming point of view what else could be causing it?
would session.removeAttribute("foo") do it?

The mod_jk has two methods of load balencing: round robin and sticky session
What you are seeing is the round robin where the mod_jk sends the request to the next server without looking at the session.
What you are looking for is sticky session and you need to configure this in the workers.properties file like this:
# Define workers using ajp13
worker.list=worker1,worker2,loadbalancer
worker.loadbalancer.type=lb
worker.loadbalancer.balanced_workers=worker1,worker2
worker.loadbalancer.sticky_session=true
# Set properties for worker1 (ajp13)
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=9009
worker.worker1.lbfactor=50
worker.worker1.cachesize=10
worker.worker1.cache_timeout=600
worker.worker1.socket_keepalive=1
worker.worker1.reclycle_timeout=300
# Set properties for worker2 (ajp13)
worker.worker2.type=ajp13
worker.worker2.host=localhost
worker.worker2.port=10009
worker.worker2.lbfactor=50
worker.worker2.cachesize=10
worker.worker2.cache_timeout=600
worker.worker2.socket_keepalive=1
worker.worker2.reclycle_timeout=300

LocalDirector 417 and JSESSIONID url argument

I am installing a LD417 in front of a cluster of WebLogic servers.
The LD417 will passively inspect the JSESSIONID cookie in order to keep the connections from a particular client going to the same WebLogic server (WLS). If that WLS goes down, it will send on to a different server, and the new WLS will request the session information from whichever WLS has the backup.
Some times the client device might not support cookies, in which case the WLS will use url rewriting (appending ;JSESSIONID=A6B2... to the url) instead. Can the LD417 use this url argument as a key for stickiness, instead of the cookie? Quite a lot of documentation hints to this possibility, but I have not found anything concrete.
Thanks,
Nick

Hi Nick,
LD is not capable of doing what you want to accomplish .Sticky based on cookie in url.The LD scans the HTTP GET request for a cookie (cookie-passive) it cannot scan the URL for cookie .
The Content service switch (CSS) which is the advanced Load balancer can handle this .
Tanveer

Finding the handler host in cluster when using sticky sessions

          Our design is like this: we have Apache front-ending the WL cluster. The session
          is not replicated across WL hosts in cluster. However, the Apache-weblogic bridge
          takes care of handling sticky - sessions ( i.e. forwarding requests in same session
          to one host in cluster )
          Now, we have some code running on Apache itself , in Perl.
          The requirement is as follows : In the Perl code, we trap certain requests which
          are NOT forwarded to Weblogic. However, in the Perl code, we do trap the JSESSIONID
          cookie. Now, using this cookie value, is it possible to know which WL host in
          cluster is handling its corresponding session ??
          This is required, since the Perl module is supposed to make an explicit HTTP request
          to that WL host - passing the JSESSIONID as a parameter - for authentication.
          Thanks,
          Subodh


can the perl module send this request to the apache webserver itself and set
          the cookie the same? That would allow apache plugin to send it to the right
          node.
          "Subodh" <[email protected]> wrote in message
          news:[email protected]..
          >
          > Our design is like this: we have Apache front-ending the WL cluster. The
          session
          > is not replicated across WL hosts in cluster. However, the Apache-weblogic
          bridge
          > takes care of handling sticky - sessions ( i.e. forwarding requests in
          same session
          > to one host in cluster )
          >
          > Now, we have some code running on Apache itself , in Perl.
          >
          > The requirement is as follows : In the Perl code, we trap certain requests
          which
          > are NOT forwarded to Weblogic. However, in the Perl code, we do trap the
          JSESSIONID
          > cookie. Now, using this cookie value, is it possible to know which WL host
          in
          > cluster is handling its corresponding session ??
          >
          > This is required, since the Perl module is supposed to make an explicit
          HTTP request
          > to that WL host - passing the JSESSIONID as a parameter - for
          authentication.
          >
          >
          > Thanks,
          > Subodh
          >

;jsessionid instead of ?jsessionid on Linuxcauses HTTP 404 - Page not found

Hi,
I'm using traditional Struts in my app. Initial index.jsp page has HTML:link statements that are initially referencable along with the :jsessionid - to handle URL re-write etc.
I understand why this happens on the first page interaction. Trouble is all works fine on my Tomcat/MySQL/JSP combo running on Windows XP but always causes a 404 runing on the hosting site under Linux. If I manually change the semi-colon to a ? then all is fine,
Your help greatly appreciated - I'm sure (hoping) it's something simple!
Cheers, Paul.

the same verion of tomcat won't be any different on Linux vs Windows. Are you running on Linux with some web server that doesn't handle the ;jsessionid bit when parsing for what to pass to Tomcat?

Different session handling of weblogic on SP2 and SP3

          I have set up 2 weblogic servers which are using the same cookie name, and having
          the same webapp name, on the same physical machine thus
          http://127.0.0.1:7220/test (Server A).
          http://127.0.0.1:9999/test (Server B).
          Using Weblogic 6.1 Service Pack 2
          1. Access Server A
          - Server A generate a new Session ID "123456...."
          2. Redirect Link from Server A to Server B
          3. Access Server B
          - Server B generate a new Session ID "987654..."
          4. Redirect Link from Server B to Server A
          5. Access Server A
          - Reused the same session ID "123456...."
          Using Weblogic 6.1 Service Pack 3
          1. Access Server A
          - Server A generate a new Session ID "123456...."
          2. Redirect Link from Server A to Server B
          3. Access Server B
          - Server B generate a new Session ID "987654..."
          4. Redirect Link from Server B to Server A
          5. Access Server A
          - Regenerate a new session ID "ABCDEFGHI...."
          Why weblogic server handle session differently in SP2 and SP3??


I think this was a bug in SP3. You could raise a support ([email protected]) call to
          confirm.
          Rick Bongpipat wrote:
          > "Rick Bongpipat" <[email protected]> wrote:
          > >
          > >I have set up 2 weblogic servers which are using the same cookie name,
          > >and having
          > >the same webapp name, on the same physical machine thus
          > >
          > >http://127.0.0.1:7220/test (Server A).
          > >http://127.0.0.1:9999/test (Server B).
          > >
          > >Using Weblogic 6.1 Service Pack 2
          > >
          > >1. Access Server A
          > >- Server A generate a new Session ID "123456...."
          > >2. Redirect Link from Server A to Server B
          > >3. Access Server B
          > >- Server B generate a new Session ID "987654..."
          > >4. Redirect Link from Server B to Server A
          > >5. Access Server A
          > >- Reused the same session ID "123456...."
          > >
          > >Using Weblogic 6.1 Service Pack 3
          > >
          > >1. Access Server A
          > >- Server A generate a new Session ID "123456...."
          > >2. Redirect Link from Server A to Server B
          > >3. Access Server B
          > >- Server B generate a new Session ID "987654..."
          > >4. Redirect Link from Server B to Server A
          > >5. Access Server A
          > >- Regenerate a new session ID "ABCDEFGHI...."
          > >
          > >Why weblogic server handle session differently in SP2 and SP3??
          >
          > In relation to previous question.
          >
          > I have 3 qns about session creation behaviour:
          >
          > 1. When a web container receives a session cookie (eg. JSESSIONID) whose session
          > id does not exists in this
          > server, should the server create a new session ?
          >
          > 2. If a session is to be created because there is a session cookie, then should
          > the new session id
          > be the one sent or should it be a newly generated session id ?
          >
          > 3. If a new session id is to be generated, then should the new session id be used
          > to overwrite that in the cookie
          > and send it back to the client ?
          Rajesh Mirchandani
          Developer Relations Engineer
          BEA Support

Session handling

Hi,
I have some doubt about session handling in servlet
1. Who creates session ?
When first request come to the servlet , is it a browser which sends session id (jsesessionid) to the servlet or
WebContainer/Server creates it ? If it is created by browser , plz provide me code for that.
2. If i open up two firefox instance , I am getting same jsessionid at server side ? how it is possible ?
Thanks

1. Who creates session ?The container.
When first request come to the servlet , is it a browser which sends session id (jsesessionid) to the servletNo
or WebContainer/Server creates it?Yes.
If it is created by browser, plz provide me code for that.That request doesn't make any sense. The code concerned would have been in the browser if it worked that way. But it doesn't.
2. If i open up two firefox instance , I am getting same jsessionid at server side ? how it is possible ?Because the server is associating your IP address with a single session.

JAAS LoginModule - how do I get the "JSessionId"

Hi,
is there any possibility to get the JSessionId from a custom JAAS LoginModule for the WebAS 6.40 Server.
My first attempt was to read the JSESSIONID-Cookie from the Http-Request via the HttpGetterCallback-Class.
((HttpGetterCallback) callbacks[1]).setType(HttpCallback.COOKIE);
((HttpGetterCallback) callbacks[1]).setName("JSESSIONID");
It worked well, till I noticed that sometimes the JSessionId-Cookie doesn't exist.
The reason is, that the JSession-Cookie was set after the http-request has passed my login-modul.
So, if I got a cookie-value, it sometimes was the JSessionID from an earlier session.
So, my question:
Is there any other posibility to get the JSessionId?
If there is a way to get the ServletRequest-instance, I could reach the SessionId via "HttpServletRequest.getSession()".
Any idea? Any hints?
Regards
Steffen Spahr

This is only available for NetWeaver Portal, not NetWeaver Application Server(WebAS). host and port can be obtained using the following code:
               Callback[] callbacks = new Callback[3];
               callbacks[0] = new NameCallback("UserId: ");
               callbacks[1] = new PasswordCallback("Password: ", false);
               // get host name and port
               HttpGetterCallback getterCallback = new HttpGetterCallback();
               getterCallback.setType(HttpCallback.HEADER);
               getterCallback.setName("Host");
               callbacks[2] = getterCallback;
               try {
                    callbackHandler.handle(callbacks);
               } catch (Exception ex) {
                    throw new LoginException(ex + "");
               Object retValue = ((HttpGetterCallback)callbacks[2]).getValue(); //get host
host and port will be returned in the following format SERVER.COMPANY.COM:50000
Currently WebAS is not able to return the resource as per SAP development.

Sticky connectios based on the JSessionID

We are using a CSS11501.
We want to implement sticky connections based on the JSessionID from the ORACLE application servers?
How could this be done?
Thank you in advance.

Gilles,
thank you very much for your prompt reply.
It is very helpful and gives the right answer to my question.
Just a clarification through my scenario; the CSS load balances across 3-servers at 3 different ports. Each server may handle a request to any of these different ports.
On top of each server sits an APACHE that also publishes three uri that the client hits. These uri are common for all servers.
Thus, in order to make sticky connections to my understanding, we should not check the cookie from the session that the client initiates (I mean any jessionid originated by hitting e.g. www.company1.com) but the server IP and port. There are also www.company2.com and www.company3.com.
Each of them resides on www.server1.com, www.server2.com and www.server3.com
That means a mixed configuration, if the jsessionid cannot contain a constant. As far I have seen this is dynamic and quite difficult to make it constant. Have you ever come across with this ? Is this possible (I mean a constant in the jsessionid)? It is sufficient to me, if this can be implemented. I will ask the developer to do so, but we donnot know whether this is achievable.
Any suggestions that you may have are more than welcome.
It is quite complex and confusing ... :(

Handling of free goods in PO

Dear ALL,
Our vendor has agreed that he will give us one drum of oil free if we buy 100 drums from him.
how can we bifurcate this in the system that 100 drums we have purchased and one is as a free good.
1) what we have to do when raising a PO ?
shall we make PO with 101 drums and select <i><b>FREE indicator</b></i> in PO.In this case all 101 drums will become as free goods.
2) or if we raise a PO for 100 drums without selecting free goods indicator how shall we handle at the time of GR of 101 drums. in this case GR of 101 drums will be treated by system as overdelivery.
3)how can we maintain free goods information in PIR( Purchase info records)
Request to suggest steps in dealing with this scenario.
regards
ajay

Hi Ajay,
One way is create 2 line items in PO, one line item with 100 no's and 2nd line item with 1 number which should be checked with free goods.
At the time of GR do the GR for both the line items.
Hope this helps.
Thanks,
Viswanath

Get Attribute values from a page and procedure exception handling?

Hi All,
I have created new page with two input attributes not based on any VO. This page is created to capture two values and pass these to an AM method upon pressing OK button. The method in AM will call a procedure with two in parameter expecting the two values captured from the above said page.
I have two questions, first one how to capture the values entered by the page in the controller class and advises me how to handle exceptions when my procedure fails.
I can not use something like this since this page is not based on a VO
String fromName = (String)vo.getCurrentRow().getAttribute("FromName");
Do I have to create a dummy VO like select '' name1, '' name2 from dual?
Thanks for the help.

Hi,
Actually you can capture the parameters on the page like this way
String test = (String)pageContext.getParameter("id of the text input bean");
Now in procedure you can take an out parameter which stores the error messages on exception
and return that out parameter in java.
and then you can throw exception on page using OAException class.
Thanks
Gaurav Sharma

Report handling names with a single quote

Report 10gR2
I have created a report and most of the functionality that i want is working as expected.
I have a report where i am letting user enter their first name on one field and last name on another field in the parameter screen ( thats how it's stored in the database)
If they enter any name with an aphostrophe , say D'Costa ( either first name or last name)
then i get the below error
REP-50003: Bad parameter: pfaction=http://.........
I am using like keyword as seen below in the afterparam trigger and passing the parameter :p_where_last_name to the main sql query
:p_where_last_name := ' AND UPPER( :last_name) LIKE (' ||''''||'%'||UPPER(:last_name)||'%'||''''||')' ;
Whats the best approach to handle this issue
Also is there a way to capture this error
' REP-50003: Bad parameter: pfaction=http://.........
' and display a message, if so where and how, please advise.
thanks.
Edited by: Forms_Reports_Beginner on Aug 13, 2009 1:52 PM

I am not using form , it's just done in report, that is i am not calling the report from a form , just from a menu.
:last_name is a report_paramter that i created on the report.
you're right the first assignmnt is
AND UPPER( db column) LIKE
I have a paramter form on the report with a field last name and I am letting the user enter last name there which gets stored in the :last_name
Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:29 AM
Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:32 AM
Rodolfo,
your solution works,
:p_where_clause := ' AND UPPER( db_column ) LIKE (' ||''''||'%'||UPPER(Replace(:p_2,chr(39), chr(39)||chr(39)))||'%'||''''||')' ;
but i dont quite understand how this is working
Replace(:p_2,chr(39), chr(39)||chr(39))
i have never used chr
Edited by: Forms_Reports_Beginner on Aug 14, 2009 7:35 AM

JSESSIONID handling

Similar Messages

Maybe you are looking for