Session persistence across web apps

Question

Hi,
I am working on a project where we have two web applications deployed in single enterprise application. I want the session object to be shared across the web applications.
Does weblogic had any mechanism to allow for the session object to be shared across the multiple Servlet contexts inside a single enterprise application?
I am using Weblogic 8.1
Thanks,
Anil

Answer 1

Session data is not shared between web applications. User data is definantly important to share between applications. The single-sign-on security option is an example of this. But that's kindof a black box. If you use single-sign-on, then simply getting the remote user from the request in your servlet can be used as a key to get user data from your persistance layer (ejb's or jdbc or even jms).
If you don't want to use single-sign-on, you can use a filter. There's some url prestidigitation, also, but otherwise this approach is pretty simple:
1. Protect access to all of your web-app's urls with some naming convention /webappname/secure*. However, don't use these urls in any web page. All servlets and jsps you use should map names beginning with "secure".
2. Filter all access to your webapp (this is a new feature in servlet spec 2.3). Within the filter, use the session id as a key to find out if the user is already login to any other web application. You will need a stateless session bean to do this. The doFilter would be something like this:
SecurityBean securitybean = Utilities.getSecurityBean();
HttpSession session = request.getSession(true);
if (session.getAttribute("myuserdata") == null){
UserData userdata = securitybean.getUserdata(sessionid);
if(userdata != null)
session.setAttribute("myuserdata",userdata);
... now forward the request to the "secure*" url in the filter. If the user was logged in with the slsb securitybean, then your web app will have all of your user data. If the user is not logged in by the securitybean, then the login prompt established in your web.xml will pop-up.
The only extra work is to have a slsb securitybean. This can use the RoleManager in oc4j or it can use the jaas implementation in oc4j to log the user in, using the sessionid to get the username.
The shared="true" attribute should be used for all application in the *-web-site.xml, so that the sessionid's are the same.
regards,
the elephantwalker
www.elephantwalker.com