Environment: WebSphere AS 9.0.0.10.
I am trying to log in in my app(http://myhost:9080/myapp/login.xhtml), that deployed at WAS and next log in WAS administrative console(https://myhost:9043/ibm/console).
After a successful log in my app in the next browser tab, I try to log in to the administrative console by another user. It returns me 500 HTTP code and in logs:
SESN0008E: A user authenticated as anonymous has attempted to access a session owned by user:defaultWIMFileBasedRealm/CN=dv,OU=Users,OU=S,DC=c,DC=s,DC=u.
SESN0008E: A user authenticated as user:defaultWIMFileBasedRealm/uid=uadm,o=defaultWIMFileBasedRealm has attempted to access a session owned by user:defaultWIMFileBasedRealm/CCN=dv,OU=Users,OU=S,DC=c,DC=s,DC=u.
I guess that is somehow connected with LTPA tokens. As my application and administrative console are in one host, they have a single "LtpaToken2" cookie. When I log in my app I get LTPA for user "dv" and when I log in in ibm/console I get LTPA for user "uadm", that LTPA replaces "LtpaToken2" cookie. If I return the previous "LtpaToken2" cookie by manual, I can open the administrative console again, but in an attempt to log in I get a new LTPA and 500 HTTP code. I tried to disable "Security integration" on the server, but it didn't give anything.
AuthFilter
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpSession session = req.getSession(true);
WebUser user = (WebUser) session.getAttribute(Constants.webuser);
Principal principal = req.getUserPrincipal();
String jUserLogin = req.getParameter(Constants.jUserLogin);
String jUserPassword = req.getParameter(Constants.jUserPassword);
if (StringUtils.isNotEmpty(jUserLogin)) {
loginBean.setjUserLogin(jUserLogin);
byte[] loginBytes = (jUserLogin + ":" + jUserPassword).getBytes();
String encoded = DatatypeConverter.printBase64Binary(loginBytes);
session.setAttribute(Constants.userLogin, encoded);
}
if (user == null && principal != null) {
user = new WebUser();
loginUser(req, session, user, principal);
}
chain.doFilter(request, response);
}
private void loginUser(HttpServletRequest req, HttpSession session, WebUser user, Principal principal) {
WebUser oldUser = (WebUser) session.getAttribute(Constants.webuser);
user.clean();
user.setLogin(principal.getName());
user.setPass(session.getAttribute(Constants.userLogin));
session.setAttribute(Constants.webuser, user);
}
login.xhtml
<form action="j_security_check" method="POST">
<p:panel styleClass="login-panel block_center" header="LoGIn" style="width:400px;">
<p:panelGrid columns="1" styleClass="no_border_panel_grid" columnClasses="panel_grid_column_250px" style="width: 100%; text-align: center">
<p:inputText id="j_username" placeholder="Login"/>
<p:password id="j_password" placeholder="Pass"/>
<input id="my_button_5" type="submit"
style="width: 77%; margin: 0; padding: 9px; margin-top: 10px" value="Log in"/>
</p:panelGrid>
</p:panel>
</form>
What wrong with it? I have no idea(