title: Session invalidation in weblogic with Jaspic/JSR196 module
body: <p>We developed a jsf web application with a Jaspic/JSR196 module registered programmatically by the webapp.</p>
  
  <p>We followed the instructions in the following blog to achieve this : <a href="http://arjan-tijms.blogspot.pt/" rel="nofollow">http://arjan-tijms.blogspot.pt/</a></p>
  
  <p>The solution works ok for authenticating the user: we have a bean that receives an username and password and invokes the request.authenticate method. The request is validated in the Server Authentication Module (SAM) and the user becames authenticated.</p>
  
  <p>The problem is that while navigating in the webapp the session seems to be often invalidated, which makes the user to be redirected to the login page. The SAM module implementation redirects the user to the login page when request.getUserPrincipal returns null while accessing a protected resource. We didn´t found a pattern for this behaviour.</p>
  
  <p>While analyzing the logs we found some exceptions that are thrown:
  (Sometimes these exceptions are displayed in the webpage.)</p>
  
  <p><strong>HttpSession is invalid</strong></p>
  
  <pre><code>&lt;Feb 26, 2013 5:13:30 PM GMT&gt; &lt;Error&gt; &lt;HTTP&gt; &lt;BEA-101020&gt; &lt;[ServletContext@1361767580[app:web-richfaces module:web-richfaces path:null spec-version:3.0]] Servlet failed with an Exception
  java.lang.IllegalStateException: HttpSession is invalid
  at weblogic.servlet.internal.session.SessionData.isNew(SessionData.java:891)
  at weblogic.servlet.security.internal.SecurityModule.login(SecurityModule.java:252)
  at weblogic.security.jaspic.servlet.JaspicSecurityModule.checkUserPerm(JaspicSecurityModule.java:85)
  at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:95)
  at weblogic.servlet.security.internal.SecurityModule.isAuthorized(SecurityModule.java:543)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:499)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:463)
  at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2119)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2089)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2074)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1513)
  at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:254)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)    
  </code></pre>
  
  <p><strong>Session invalidation is in progress with different thread</strong></p>
  
  <pre><code>&lt;Feb 26, 2013 5:16:12 PM GMT&gt; &lt;Error&gt; &lt;HTTP&gt; &lt;BEA-101020&gt; &lt;[ServletContext@1361767580[app:web-richfaces module:web-richfaces path:null spec-version:3.0]] Servlet failed with an Exception
      java.lang.IllegalStateException: Session invalidation is in progress with different thread
      at weblogic.servlet.internal.session.SessionData.invalidate(SessionData.java:880)
      at weblogic.servlet.internal.ServletRequestImpl$SessionHelper.updateSessionId(ServletRequestImpl.java:3215)
      at weblogic.servlet.internal.ServletObjectsFacadeImpl.updateSessionId(ServletObjectsFacadeImpl.java:54)
      at weblogic.servlet.security.internal.SecurityModule.generateNewSession(SecurityModule.java:265)
      at weblogic.servlet.security.internal.SecurityModule.login(SecurityModule.java:253)
      at weblogic.security.jaspic.servlet.JaspicSecurityModule.checkUserPerm(JaspicSecurityModule.java:85)
      at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:95)
      at weblogic.servlet.security.internal.SecurityModule.isAuthorized(SecurityModule.java:543)
      at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:499)
      at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:463)
      at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2119)
      at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2089)
      at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2074)
      at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1513)
      at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:254)
      at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
      at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
  </code></pre>
  
  <p><strong>Response already committed</strong></p>
  
  <pre><code>&lt;Feb 26, 2013 5:06:16 PM GMT&gt; &lt;Error&gt; &lt;HTTP&gt; &lt;BEA-101020&gt; &lt;[ServletContext@1361767580[app:web-richfaces module:web-richfaces path:null spec-version:3.0]] Servlet failed with an Exception
  java.lang.IllegalStateException: Response already committed
  at weblogic.servlet.internal.ServletResponseImpl.objectIfCommitted(ServletResponseImpl.java:1651)
  at weblogic.servlet.internal.ServletResponseImpl.sendError(ServletResponseImpl.java:658)
  at weblogic.security.jaspic.servlet.JaspicSecurityModule.checkUserPerm(JaspicSecurityModule.java:87)
  at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:95)
  at weblogic.servlet.security.internal.SecurityModule.isAuthorized(SecurityModule.java:543)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:499)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:463)
  at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2119)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2089)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2074)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1513)
  at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:254)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
  </code></pre>
  
  <p>The following log entries shows that a valid session is not found so the user is redirected to the login page:</p>
  
  <pre><code>&lt;HttpRequest@207744527 - /prototype-web-richfaces/pages/customer/customer.jsf: SessionID: MmGLRsrCKrVs2ms2ZYcJbxB1LLngk7pZcjPP4Fd071b1JJLPyLTg!1600091307 found in cookie header&gt;
  &lt;HttpRequest@207744527 - /prototype-web-richfaces/pages/customer/customer.jsf: SessionID= MmGLRsrCKrVs2ms2ZYcJbxB1LLngk7pZcjPP4Fd071b1JJLPyLTg found for WASC=ServletContext@1361767580[app:web-richfaces module:web-richfaces path:/prototype-web-richfaces spec-version:3.0]&gt;
  &lt;HttpRequest@207744527 - /prototype-web-richfaces/pages/customer/customer.jsf: Trying to find session: MmGLRsrCKrVs2ms2ZYcJbxB1LLngk7pZcjPP4Fd071b1JJLPyLTg!1600091307&gt;
  &lt;HttpRequest@207744527 - /prototype-web-richfaces/pages/customer/customer.jsf: Trying other contexts to find valid session for id: MmGLRsrCKrVs2ms2ZYcJbxB1LLngk7pZcjPP4Fd071b1JJLPyLTg!1600091307&gt;
  &lt;HttpRequest@207744527 - /prototype-web-richfaces/pages/customer/customer.jsf: Couldn't find valid session for id: MmGLRsrCKrVs2ms2ZYcJbxB1LLngk7pZcjPP4Fd071b1JJLPyLTg!1600091307&gt;
  [[ACTIVE] ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] INFO authentication.jaspic.TestServerAuthModule - Request URI: /prototype-web-richfaces/pages/customer/customer.jsf
  [[ACTIVE] ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG authentication.jaspic.TestServerAuthModule - Principal is null. Redirecting to login page.
  </code></pre>
  
  <p>It seems that the container is invalidating the Http Sessions. But we can't understand why.
  Any help?</p>