Keeping multiple sessions in the same instance

Question

We are currently developing a large application in which the modules are deployed as separate .EAR files (each of which contains WAR and EJB.JAR).

In GlassFish 3.1, we configure applications on a single input using JAAS. Therefore, we need to support each web module session while the SSO session is alive.

An example could be: Modules A , B and C deployed with a 10-minute session. The user subscribes with A , then can go to B and C , and spend (say) 20 minutes on C

The idea is that although the user uses only C , we must save his session (including managed beans) to A and B

What can help us achieve this? the idea is to create a servlet on each module to touch the session (thus keep it alive), and send asynchronous (one-way perhaps?) requests to these servlets from the module the user uses, but it seems to overdo it a bit with open HTTP connections (via TCP) every time the user does something. Perhaps a survey can help here, but we would like to avoid this kind of message.

Another idea is to use a shared memory cache and cache listener to touch other sessions by searching with a session identifier; can this do the trick with better performance?

We are open to any ideas ... other than using other application servers (we must use OpenSource GlassFish - no Coherence * Web).

Thank you for your time.

Answer 1

Do you need JAAS? You can implement the solution using spring-security and a redis redundant cache for session identifiers. so, for example, when the user is logged in to system A , the session identifier is put into the redis cache, when the user goes to B via a link that passes the session identifier as a request parameter, the security level is spring (on B ), make sure that the session identifier is alive and valid in redis cache. Redis has built-in support for data expiration

This is a good article: http://www.infoq.com/minibooks/Identity-Management-Shoestring for creating central authentication services (CAS).

Hope this helps