Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: local policy)
From: Bruce Weertman <bruce@iris.washington.edu>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Subject: Intermittent Digest Authentication User Lockout
Message-Id: <982CC876-973C-4364-8D7D-65549DC4EBC1@iris.washington.edu>
Date: Mon, 18 Nov 2013 10:29:24 -0800
To: users@tomcat.apache.org
Mime-Version: 1.0 (Mac OS X Mail 7.0 \(1822\))

I am running into an intermittent problem with Digest-Authentication. =
This is with tomcat 7.0.39

The issue appears to be that clients will occasionally get locked out =
for 5 minutes. The problem
appears to happen with there is a combination of good password and then =
bad password, or the
other way round. We have also seen the problem happen when our load =
balancer is not sticky.=20

My understanding is that digest-auth really should not work if the =
load-balancer is not sticky since there need to be information
sent from the server to the client in order to make the authentication. =
We have since made our load balancer sticky, hoping that=20
this would resolve the issue.=20

Actually, I should make a clarification here. It=92s not =93clients=94 =
that are getting locked out. It is =93users=94.=20

Once a user gets into a bad state the account gets locked out until a 5 =
minute period goes by.=20

Looking at the tomcat source code, I see DigestAuthenticator.java line =
147:=20
protected long nonceValidity =3D 5 * 60 * 1000;

Sorry if this sounds confused - I=92m confused. I can say this. We=92re =
seeing users get locked out for
5 minutes at a time. Having the load balancer not being sticky would =
definitely cause the problem,
but after making them sticky, we still see the problem with at least one =
client program. The client
programs are mostly non-webbrowser based.

Thanks=

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org