mikakoivisto/liferay-portal — pull request #12 by KocsisDaniel (2012-05-04 09:04:04+00:00)
Title: [TECH SUPPORT] LPS-27064 OpenAM authentication lost

Hi Mika,

Juan asked me to send this PR to you because you are an expert in this area. Could you please check this one?

The PR is about to fix the problem when you use OpenSSO auth and the SSO provider kill/expire your session in the background and when you next time refresh your portal page it requires a new login, then after you logged back successfully and refresh your page or send a new request to the server you will lost your session again and you need to auth again. This happens because not the portal logs you out and your session is not invalidated on the Liferay site, so next time the request can get some object from this invalid session like userId and it cause an invalid state in the request as well.

To fix the problem we had to invalidate the user session on the first point where we can realize the SSO stopped the session on the background. This point is in the OpenSSO filter, and I suggested this solution to Tamas because I think it has the least effect on the portal as well. To prevent to expire the session always (every time when some use hit the page first time without any previous expired session) we put an extra check for the User object on the session.

To reproduce the problem please follow the steps described in: LPP-2929

Thanks,
Daniel