-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using Apache DBD sessions #171
Comments
Please produce mag_auth_gssapi debug logs |
Sorry for the delay but I was on a trip and had no access to server logs
|
There is something suspicious here:
If the user is set to null then the rest of the authz stack will not authorize the user and go through a new auth attempt, in fact the second time you get Can you provide your configuration ? |
Yes, of course:
|
Does it work if you turn off GssapiLocalName ? |
Actually GssapiLocalName=Off doesn't make any difference: [Thu Mar 08 07:29:08.146785 2018] [core:debug] [pid 10724] util_cookies.c(59): [client 192.168.2.33:49188] AH00007: ap_cookie: user '(null)' set cookie: 'gssapi_session=289f4baf-686a-4c36-9816-9298f3fab304;Max-Age=1800;path=/;httponly;secure;', referer: https://base |
I am not sure what's interfeering here. |
And there's no change with GssapiLocalName=Off in the logs? (Still null user?) |
Here is the complete log of single request:
|
@niki-eng sounds like we dropped this one, do you still experience this issue, did you find out anything new ? |
Hi,
I'm trying to make mod_auth_gssapi to work with Apache dbd sessions.
If apache is configured to keep sessions with a client-side cookie (no dbd) everything works fine - sessions are established and users are authenticated correct. But when apache uses dbd to store sessions this causes the session to be reestablished on every request making them useless. DBD sessions are configured to use cookie with the directive
SessionDBDCookieName
When the browser makes a request it uses the last session cookie but the server responses with a new session cookie i.e. new session making authentication invalid and forcing browser to reauthenticate. This happens with every single request.
According to mysql logs (I use mysql as DBD backend) initially the session is correctly recognized but thereafter a new session is established and apache responses with a new cookie. Here is a mysql log snippet for a single request:
As you can see the session is found in DB and expiry is updated but then a new cookie/session is generated
I'm digging with this issue for a long time - tried to disable mod_auth_gssapi and found that mod_rewrite also produces the same problem (my app uses rewrite rule for almost every URL). Modifying the rule to set the environment variable HTTP_SESSION seems to fix the issue in mod_rewrite:
RewriteRule ^(.*)$ index.php?/$1 [QSA,L,E=HTTP_SESSION:%{LA-F:HTTP_SESSION}]
With this rule mod_rewrite works corectly with DBD - sessions are not reestablished on every request but enabling mod_auth_gssapi again restores the problem.
Can you pls advise for a possible workaround or what is making the issue.
Best regards,
Nikolay
P.S. I use DBD for storing sessions because there are situations when I want to invalidate a valid apache session by hand, so deleting the cooike from mysql looks like an easy option
The text was updated successfully, but these errors were encountered: