Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-18 Thread Mark Thomas
On 18/03/2010 04:26, Goo Sam Kong wrote: Hi Mark, Will apache.org correct the Tomcat documentation or fix the code? The docs are correct. This is already fixed in Tomcat 7 and has been proposed for Tomcat 6. Mark - To un

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Mark, Will apache.org correct the Tomcat documentation or fix the code? Thank you. On 18 March 2010 11:16, Caldarale, Charles R wrote: >> From: Goo Sam Kong [mailto:skgo...@gmail.com] >> Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 >> >> OIC, so whe

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
> From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com] > Subject: RE: How to set SSL session timeout in Tomcat 5.5.16 > > No idea - I'm not a committer. It will get more attention if you file > a Bugzilla entry for it: > http://issues.apache.org/bugzilla/enter

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
> From: Goo Sam Kong [mailto:skgo...@gmail.com] > Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 > > OIC, so when the code will be fixed? No idea - I'm not a committer. It will get more attention if you file a Bugzilla entry for it: http://issues.apache.org/bugzi

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Chuck, OIC, so when the code will be fixed? On 18 March 2010 11:07, Caldarale, Charles R wrote: >> From: Goo Sam Kong [mailto:skgo...@gmail.com] >> Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 >> >> I noticed there is a error in Tomca

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
> From: Goo Sam Kong [mailto:skgo...@gmail.com] > Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 > > I noticed there is a error in Tomcat documentation > (http://tomcat.apache.org/tomcat-6.0-doc/config/http.html), the > correct attribute for session cache

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Mark, Thank you for the solution, it working for me now. I noticed there is a error in Tomcat documentation (http://tomcat.apache.org/tomcat-6.0-doc/config/http.html), the correct attribute for session cache timeout should be "sessionCacheTimeout" instead of "sessionTimeout" in HTTPS connector

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Thank you very much Mark, I will try it tomorrow. On 17 March 2010 16:40, Mark Thomas wrote: > On 17/03/2010 00:49, Goo Sam Kong wrote: >> May I know how to set the SSL session timeout in Tomcat 5.5.16. I am >> running JDK 1.5.0 update 7 on RedHat Enterprise. > > 1. Upgrade to the latest 6.0.x >

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Mark Thomas
On 17/03/2010 00:49, Goo Sam Kong wrote: > May I know how to set the SSL session timeout in Tomcat 5.5.16. I am > running JDK 1.5.0 update 7 on RedHat Enterprise. 1. Upgrade to the latest 6.0.x 2. Read the docs: http://tomcat.apache.org/tomcat-6.0-doc/config/http.html Mark

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Goo Sam Kong
e, Charles R wrote: >> From: Goo Sam Kong [mailto:skgo...@gmail.com] >> Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 >> >> I attempted that, that is HTTP Session not SSL session. > > Depending on how your webapp is configured, you may have two HttpSes

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
> From: Goo Sam Kong [mailto:skgo...@gmail.com] > Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 > > I attempted that, that is HTTP Session not SSL session. Depending on how your webapp is configured, you may have two HttpSession objects - one protected, and one not

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Goo Sam Kong
know how to do/configure to invalidate SSL session? Thank you. Regards, SamKong Goo On 17 March 2010 10:30, Caldarale, Charles R wrote: >> From: Goo Sam Kong [mailto:skgo...@gmail.com] >> Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 >> >> Can I invalidate t

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
> From: Goo Sam Kong [mailto:skgo...@gmail.com] > Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 > > Can I invalidate the SSL session on server side? Look at the servlet API doc: http://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpSession.htm

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Goo Sam Kong
Hi Chuck, I am referring to invalidate SSL session. My application is using client certificate authentication, the XML-RPC client is using USB token as a keystore during SSL session, we want to force client to re-authenticate with my application on every XML-RPC request to prevent user remove the

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
> From: Goo Sam Kong [mailto:skgo...@gmail.com] > Subject: How to set SSL session timeout in Tomcat 5.5.16 > > May I know how to set the SSL session timeout in Tomcat 5.5.16. The session timeout value is independent of the session security, and set by the value in the webapp's WEB-INF/web.xml f