Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of rwonly@gmail.com designates
 209.85.222.184 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=jOmQhA2KD4IQao0kNPPgd3XbuhVPclZi2orPz8z8cN6u2TdgaGOZKQvoIg5M/Bv4Se
         FHQh+OKjs+ANZV+eWqVr7M5NjSCHNKv3j9/Z67vx1ZZcPyjPb5/dmV5/UqAjcygPk5WA
         UpduETUiIV1CznwsazBJegivJvvH+hOWJxTaA=
MIME-Version: 1.0
In-Reply-To: <4AB35501.5030005@apache.org>
References: <fbab58220909162305k650ae432i30fa723c0046350a@mail.gmail.com>
	 <4AB1FA59.7080302@apache.org>
	 <fbab58220909171938p4bdd407ena1d7bb7d3041df6e@mail.gmail.com>
	 <4AB35501.5030005@apache.org>
Date: Mon, 21 Sep 2009 11:26:39 +0800
Message-ID: <fbab58220909202026p52e9def9w4a0ef1fc74c1cdd4@mail.gmail.com>
Subject: Re: what does j_security_check do in clustering?
From: Rex Wang <rwonly@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=00504502ce4fc55f2f04740e0cc3

--00504502ce4fc55f2f04740e0cc3
Content-Type: text/plain; charset=ISO-8859-1

2009/9/18 Mark Thomas <markt@apache.org>

> Rex Wang wrote:
> > 2009/9/17 Mark Thomas <markt@apache.org>
> >
> >> Rex Wang wrote:
> >>> Dear Tomcat,
> >>>
> >>> I meet a problem when config a web project which using the form based
> >>> security in clustering.
> >> Clustering or load-balancing? Whether or not session replication is
> >> configured between your Tomcat instance's is key.
> >>
> >
> > I guess the j_security_check is not implemented by session. so the
> session
> > replication does not work for security check, right?
>
> I thought it did - hence my question about whether you were using
> clustering or just load balancing.
>

I am using clustering, and the security checking process can not complete if
the session affinity = false.
Looks like the login name and password are posted to another node, and some
times I got a 400 error
"HTTP Status 400 - Invalid direct reference to form login page".

I just wanna know, how to do the form based security check if the session
affinity = false in clustering.

Many thanks

-Rex


>
> > So the sticky session is the precondition of tomcat clustering?
>
> No. It is strongly recommended, but it isn't required providing you set
> up your cluster appropriately.
>
> Mark
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

--00504502ce4fc55f2f04740e0cc3--