I'm using Spring Security 3.0.5 on Tomcat 6 for our web application. Recently I've been implementing a failover system using this memcached-based session manager: http://code.google.com/p/memcached-session-manager/
This is how I have been testing the failover process w/ two Tomcats, A and B. A and B are running behind a load balancer.
* User logs into Tomcat A. SecurityContextImpl is visible in his session.
* User's session is automatically replicated to memcached. User's SecurityContextImpl also visible (serialized) in memcached.
* To simulate a failure, Tomcat A is shutdown.
* The load balancer redirects User to Tomcat B.
* At this point User should also be logged into Tomcat B, but this is not the case. He's redirected to the login page.
After digging around I determined that at some point during Tomcat A shutdown the user's SecurityContextImpl is removed from his session. Other session data remains unchanged. I can verify this by examining the session data in memcached. Since the SecurityContextImpl is gone, after failover Tomcat B sees the user as un-authenticated.
If I kill Tomcat A instead of cleanly shutting it down the SessionContextImpl remains in the session (and memcached) and the failover to Tomcat B succeeds.
Now I'm trying to determine what is removing the SeesionContextImpl. Is this a feature of Spring Security? A listener of some sort? I've had no luck figuring this out. Any help greatly appreciated.