acegi 1.0.7 weblogic cluster

[ferdio]

Hello Anyone

We're using Acegi 1.0.7 for concurrent login handling in our application, i.e. to prevent a user from logging to the application with the same username twice (at the same time).

Our application is deployed in 2 weblogic servers, clustered.

The application successfully blocks the 2nd user (with the same user name) when they login to the same server (as the first user). But when the 2nd user (with the same username) specifically attempts to login to the application launched from the 2nd server in the cluster, they are not blocked.

Our WebLogic admin guy has verified that the sessions is being replicated between the two WebLogic servers, i.e. when a user logs onto one WebLogic server, he sees a 'primary session' created on that server, and see's a 'secondary' session (with same id) created on the second server.

The following lines are what we are using in the application code to prevent more than one user logging in with the same username:

<listener>
<listener-class>org.acegisecurity.ui.session.HttpSessionEventPubli sher</listener-class>
</listener>

<bean id="concurrentSessionFilter" class="org.acegisecurity.concurrent.ConcurrentSessionFilt er">
<property name="sessionRegistry"> <ref bean="sessionRegistry"/> </property>
<property name="expiredUrl" value="/"/>
</bean>

<bean id="singleSession" class="org.acegisecurity.concurrent.ConcurrentSessionCont rollerImpl">
<property name="maximumSessions" value="1"/>
<property name="exceptionIfMaximumExceeded" value="true"/>
<property name="sessionRegistry" ref="sessionRegistry"/>
</bean>
Has anybody successfully implemented this security across a cluster?

Can anybody offer any good advice.

Thanks kindly in advance.
FerdieO

[Rob Winch]

What implementation of the SessionRegistry are you using? SessionRegistryImpl, the implementation provided with Acegi Security, uses an in memory map. The map is probably not replicated across your cluster. Additionally the SessionRegistryImpl only removes sessions based upon the HttpSessionEventPublisher (it does not add them using Spring events). Therefore, you will likely need to write a new implementation that uses centralized storage (i.e. distributed cache, database, etc) in order to support a clustered environment.

HTH,
Rob

[ferdio]

Thanks kindly for the response Rob, have been away since you answered, but back again.

We have re-implemented SessionRegistryImpl via JGroup following this blog http://www.altuure.com/2007/12/23/clustering-acegi-via-jgroups-distributedhashtable/

Could you point to any sample? Or something on which we can base a new implementation?

Kind Regards,
Ferdie.

[Rob Winch]

I think in principal the implementation sounds like it would work, but to be honest I am not all that familiar with JGroups. Have you tried adding/enabling logging to see if the user is found in the second cluster?