Forum Discussion

fpaj_137139's avatar
fpaj_137139
Icon for Nimbostratus rankNimbostratus
Nov 12, 2013

Multisession among Tomcat servers and its synchornization

Hello everyone,

 

me and my coleague are new users of our first F5 LTM and we are also new to this forum. We have support for this device but so far we have no answer since last week and project should move forward...

 

Anyway, we've encountered simultaneous login issue.

 

Introduction:

 

We're using bigip to load balance java based web apps. It does load balancing based on jsessionid for java apps deployed on tomcat. We can say that we deployed standard environment with BIG-IP, Tomcat, Apache and persist sessions

 

  • We run one port on our tomcat instances (8080)
  • we allow only for https "secure" traffic. Bigip handles the https offload. Http "unsecure" requests are redirect to https
  • We use oneconnect
  • We parse certain POST request and insert user login and organization_unit into jsesssionID cookie

Issue description:

 

How it works without LB: User is logging into application. Tomcat instance "combine" new session with login. The general idea is to prevent simultaneous user login. In case when user is trying to log into from another "machine" and Tomcat detect that login is connected with another session user can decide what to do: log in and close old session or resign.

 

Issue with LB:

 

Tomcat instances haven't common sessions pool. Instances work independently. Clustering or session replication hasn't been configured.

 

I wonder whether it is possible to achieve such functionality using LB or how to send list of all persist sessions from LB to tomcat instances. We know that we are able to collect those information using "show ltm persistence persist-records virtual Virtual-Server-ID all-properties" but this approach require console access and it doesn't fulfill our expectations. Would you please suggest other solution?

 

Kind Regards, Filip

 

application delivery
availability
deployment
design
devops
iRules
tomcat
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Nov 12, 2013

    I thought about array but LTM initialize array on every new connection therefore we won't know its content across multiple connections.

     

    you can use table command. it is available across connection.

     

    v10.1 - The table Command - The Basics by Spark

     

    https://devcentral.f5.com/articles/v101-the-table-command-the-basics.UoIjfW2jYdU

     

    even if we get the list of active sessions and we know that we have to terminate one - how to do this? It is easy to terminate session that has just started and that triggered this event but how to terminate another based on data from new one?

     

    would it be possible if we send sideband connection to server to terminate another session (e.g. remove that session from server)?

     

    v11 iRules: Intro to Sideband Connections by Colin Walker

     

    https://devcentral.f5.com/articles/v11-irules-intro-to-sideband-connections.UoIksG2jYdU

     

  • fpaj_137139's avatar
    fpaj_137139
    Icon for Nimbostratus rankNimbostratus
    Nov 12, 2013

    And yet one more issue - even if we get the list of active sessions and we know that we have to terminate one - how to do this? It is easy to terminate session that has just started and that triggered this event but how to terminate another based on data from new one?

     

  • fpaj_137139's avatar
    fpaj_137139
    Icon for Nimbostratus rankNimbostratus
    Nov 12, 2013

    Hi Nitass,

     

    can we just persist based on user login? so, server will decide what to do when user logs in from multiple locations.

     

    I think that's the problem. We don't know login at the beginning at the moment when session is assigned to the specific node. We have to parse login from POST request based on certain URI. We have to create some kind of container for login and decide what to do if it occurs that login exist in our container. I thought about array but LTM initialize array on every new connection therefore we won't know its content across multiple connections.

     

    There is another issue. I thnik that we can not use CLIENT_ACCEPTED event because we don't know login at the beginning. The event fires when user establish TCP connection and we get persist session based on JSessionID. Any input will be appreciated

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Nov 12, 2013

    I wonder whether it is possible to achieve such functionality using LB or how to send list of all persist sessions from LB to tomcat instances. We know that we are able to collect those information using "show ltm persistence persist-records virtual Virtual-Server-ID all-properties" but this approach require console access and it doesn't fulfill our expectations. Would you please suggest other solution?

     

    can we just persist based on user login? so, server will decide what to do when user logs in from multiple locations.

     

    sol7392: Overview of universal persistence

     

    http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7392.html