PolicyEvaluationException

Question

Hi,
I'm currently working on a project which requires Custom Conditions, which you can plug in, in AM (version 7).
Recently we made a Custom Condition and noticed that it was only consulted one time, at login time. After that, the Policy Decisions were cached. Since the requirement states that the Condition needs to kick in as the user selected another working data set, I've set the 'Subjects Result Time to Live' to '0' (Service Config->Policy Configuration).
After this, everything seemed to works fine, that is, locally. On local pc I have installed an agent which is linked to the AMDomain, no problem.
Now, when I'm testing on a unix domain, with his own agent, connecting to the same AMDomain, same source, same everything, I receive following exception:
com.sun.identity.policy.remote.PolicyEvaluationException: Received expired policy decision from server for resourceName=...
        at com.sun.identity.policy.client.ResourceResultCache.getPolicyDecision(
ResourceResultCache.java:235)
        at com.sun.identity.policy.client.PolicyEvaluator.getPolicyDecision(Poli
cyEvaluator.java:371)
        at com.sun.identity.agents.policy.AmWebPolicy.checkPolicyForResource(AmW
ebPolicy.java:98)
        at com.sun.identity.agents.filter.URLPolicyTaskHandler.process(URLPolicy
TaskHandler.java:105)
        at com.sun.identity.agents.filter.AmFilter.processTaskHandlers(AmFilter.
java:185)
        at com.sun.identity.agents.filter.AmFilter.isAccessAllowed(AmFilter.java
:152)
        at com.sun.identity.agents.filter.AmAgentBaseFilter.doFilter(AmAgentBase
Filter.java:38)
.... Normally, if I would consult the PolicyEvaluator within my own code I would catch this exception and somehow try to deal with it. Now it seems that the agent filter itself is throwing this exception, which makes it more complex...
Does anyone have experience with this??? I would be very grateful.
Many thanks in advance.
Regards,
Philip

Answer 1

Hi,
the system dates on the various unix domains are in sync. Related to this topic, the AMAgentFilter now throws a "session already invalidated" exception:
ERROR: AmFilter: Error while delegating to inbound handler: J2EE Local Auth Task Handler, access will be denied
java.lang.IllegalStateException: invalidate: Session already invalidated
at org.apache.catalina.session.StandardSession.invalidate(StandardSession.java:1258)
at org.apache.catalina.session.StandardSessionFacade.invalidate(StandardSessionFacade.java:164)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.doLocalAuthWithSessionBinding(LocalAuthTaskHandler.java:289)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.authenticate(LocalAuthTaskHandler.java:159)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.process(LocalAuthTaskHandler.java:106)
at com.sun.identity.agents.filter.AmFilter.processTaskHandlers(AmFilter.java:185)
at com.sun.identity.agents.filter.AmFilter.isAccessAllowed
This does not happen in development. Would it be possible that this is related to using a cluster?
Thx for your advice,
Philip