[#JRA-14630] Fix the seraph.os.cookie from failing on Tomcat by upgrading atlassian-seraph

JIRA

Fix the seraph.os.cookie from failing on Tomcat by upgrading atlassian-seraph

Created: 12/Mar/08 07:20 PM Updated: 14/Jan/09 09:12 PM

Component/s:

Security

Affects Version/s:

3.12.2, 3.12.3

Fix Version/s:

3.13

Time Tracking:

Original Estimate:

Remaining Estimate:

Time Spent:

1.5h

Issue Links:

Cloners

This issue was cloned as:

~~CONF-11410~~ Some users' logins are not remembered using Tomcat

Duplicate

This issue is duplicated by:

~~JRA-14856~~ Remember my password with LDAP

~~JRA-16244~~ Remember-me functionality should work from multiple machines

Participants:	Anton Mazkovoi [Atlassian], Christopher Owen [Atlassian], Ian Daniel [Atlassian], Kirk Wylie, Michael Tokar [Atlassian], Sheri Widler and Wolfram Richter
Since last comment:	41 weeks, 3 days ago
Resolution Date:	06/May/08 08:13 PM
Labels:	remember_me

Description

« Hide

Once SER-117 has been fixed, incorporate the changes into JIRA (see the linked issue for a full description of the problem).

Note that this only affects Tomcat users; Resin and Orion do not appear to be affected.

User Symptoms: Users have checked the "Remember my login on this computer" checkbox (also known as the "Remember Me" checkbox), but are still getting prompted for login credentials after a period of inactivity.

All

Comments

Work Log

Change History

Sort Order:

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 11/Apr/08 01:56 AM

The user symptom of possibly being affected by this bug is users reporting that they have checked the "Remember my login on this computer" checkbox, but are still getting prompted for login credentials after a period of inactivity.

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 17/Apr/08 05:13 PM - edited

This bug is present in Tomcat 5.5.26 and Tomcat 6. It is not present in Tomcat 5.5.20. Hence, one workaround for this bug is to use Tomcat 5.5.20.

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 18/Apr/08 05:02 AM

Another support customer affected by this: JSP-21303.

[ Permalink | « Hide ]

Anton Mazkovoi [Atlassian] added a comment - 28/Apr/08 02:59 AM

Need to fix this for JIRA 3.12.4

[ Permalink | « Hide ]

Anton Mazkovoi [Atlassian] added a comment - 28/Apr/08 03:02 AM

Please note that the upgrade of seraph will break the existing "remember me" cookies. So we need to mention this very clearly in the Upgrade Guide for JIRA 3.12.4 and let the support team know.

[ Permalink | « Hide ]

Kirk Wylie added a comment - 28/Apr/08 10:17 AM

Something particular problematic on this bug is that it's not documented anywhere that you can't run 3.12.2 (even on the 3.12.2 documentation) on Tomcat 6. I discovered this only after spending quite a bit of time migrating our JIRA infrastructure to Tomcat6.

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 30/Apr/08 10:33 PM - edited

Workarounds

The underlying bug for this issue, SER-117, was fixed in Seraph version 0.38. Seraph 0.38 shipped with JIRA 3.13. Therefore, the easiest fix is to upgrade to JIRA 3.13 (or newer versions, once we release them).

If upgrading to 3.13 is not an option, you can update JIRA to Seraph 0.38 (instructions follow), but you must be running JIRA 3.12.3. This is because Seraph 0.38 is not binary-compatible with any version of JIRA prior to JIRA 3.12.3. It is binary-compatible with JIRA 3.12.3. Do not make the following modifications to any JIRA version earlier than 3.12.3.

The workaround instructions are:

1. Upgrade to JIRA 3.12.3.

2. Shutdown JIRA 3.12.3.

3. In your JIRA 3.12.3 directory, run "build clean" (Windows) or "./build.sh clean" (Unix).

4. Replace webapp/WEB-INF/lib/atlassian-seraph-0.37.2.jar with atlassian-seraph-0.38.jar.

5. In your JIRA 3.12.3 directory, run "build" (Windows) or "./build.sh" (Unix) to produce a new web application.

6. Restart JIRA.

7. Please revert to atlassian-seraph-0.37.2.jar if you have any issues authenticating to your JIRA instance.

Important Note

The cookie encoding mechanism in Seraph 0.38 is not backward compatible with the previous mechanism. This means that all users, including those who have set the "Remember my login on this computer" checkbox, will be prompted to log in the first time that they access the modified JIRA instance. "Remember my login on this computer" should work fine after this initial login.

Another workaround is to instead use Tomcat 5.5.20, as it is not affected by the problem.

[ Permalink | « Hide ]

Wolfram Richter added a comment - 08/May/08 04:17 AM

Mhm. This workaround didn't work for us.
We're testing Jira 3.12.3 / Confluence 2.8.0 on Tomcat 6.0.16.

On Jira login we're getting now: User: tried to login but they do not have USE permission or weren't found. Deleting cookie.
in catalina.out.

In confluence the new seraph.jar breaks the application (Doesn' t start due to ClassNotFoundException).

In both applications users are not remembered which is quite annoying.

[ Permalink | « Hide ]

Christopher Owen [Atlassian] added a comment - 08/May/08 07:55 PM - edited

Yes. Seraph 0.38 will not work with Confluence 2.8.0, so please don't try to use this version with it.

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 09/May/08 02:08 AM

Hi Wolfram,

I have just re-tried the workaround (JIRA 3.12.3 with Seraph 0.38). I am not getting the problem you describe. Users are able to log in and Remember Me is working, including for usernames that had the problem without the patch in place.

I said above that this is an unsupported patch. Having said that, we would like to see if there is a problem that we need to be aware of. As such, I have created a support case for you, https://support.atlassian.com/browse/JSP-23056, and I will ask you some questions there. Can you please respond to that support case.

Kind regards,
Ian

—
Ian Daniel
JIRA Support Lead
ATLASSIAN - http://www.atlassian.com
Tried our new products yet? http://www.atlassian.com/software

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 09/May/08 02:27 AM

Wolfram reports via his support case that the patch is working now. It was a Tomcat configuration problem that he has fixed. The patch is working.

[ Permalink | « Hide ]

Sheri Widler added a comment - 16/Sep/08 04:07 PM - edited

Can I get information about the patch?
We are using Jira, Version: 3.12.3 and Confluence 2.8.2 and are having the same issue.
Would we have to upgrade to 3.13?

[ Permalink | « Hide ]

Anton Mazkovoi [Atlassian] added a comment - 16/Sep/08 11:21 PM

Hi Sheri,

The patch is needed for JIRA 3.12.3. It is not needed for JIRA 3.13 as JIRA 3.13 ships with the fix.

Cheers,
Anton

[ Permalink | « Hide ]

Ian Daniel [Atlassian] added a comment - 16/Sep/08 11:27 PM

Hi Sheri,

The patch is described here in an earlier comment in this issue. That comment describes how to deploy the patch to a JIRA 3.12.3 instance.

You would not have to upgrade to 3.13 to use the patch. However if you do upgrade to 3.13, you will not require that patch, as it ships as part of JIRA 3.13.

According to the Confluence issue for this problem, the problem has been fixed in Confluence 2.8.2. That is, you do not need the patch. So if you are having a problem related to "Remember my login" in Confluence 2.8.2, then please raise an issue in our support system, https://support.atlassian.com, and we will investigate the problem, as it probably has a different root cause to the problem fixed in the patch.

Kind regards,
Ian