EAP 7 Digest Authentication fails in load balanced environment

Solution Unverified - Updated -

Issue

  • Our application is configured to use DIGEST authentication. This works fine if JBoss instance is running but we can see authentication failing at random with load balanced across multiple running instances. This is because requests to this application do not get a session cookie in return until there is an authenticated session. This becomes problematic if the load balancer depends on the JSESSIONID for stickiness as the 401 response for the DIGEST challenge risks being sent to another node than the one that sent the challenge, which leads to authentication failure.

Environment

  • JBoss Enterprise Application Platform (EAP) 7.x
  • JBoss Core Services Apache httpd
    • mod_jk
    • mod_proxy
    • mod_cluster

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content