9

In our intranet application(s) we use SSO (single sign on) login while the sessions both on client and auth origin applications are stored in memcached.

The sessions are set to live for 12h before the garbage collector may consider them as for removal. Both applications are written using ZF2.

Unfortunately, the problem is, that after certain period of time (I don't have the exact value) the browser loses the session which causes the redirection to auth origin, where the session is still alive thus user is redirected back to client and the browser session is refreshed. This is not a big deal if the user has no unsaved work as these two redirects happen within 1 second and user even may not notice them.

But it really is a big deal when user has unsaved work and even an attempt to save it leads to redirects and the work is gone.

Here is the configuration of session in Bootstrap.php:

class Module
{
    public function onBootstrap(MvcEvent $e)
    {
        // ...
        $serviceManager      = $e->getApplication()->getServiceManager();
        $sessionManager      = $serviceManager->get('session_manager_memcached');
        $sessionManager->start();
        Container::setDefaultManager($sessionManager);
        // ...
    }

    public function getServiceConfig()
    {
        return array(
            'factories' => array(
                // ...
                'session_manager_memcached' => function ($sm) {
                    $systemConfig = $sm->get('config');
                    $config = new SessionConfig;
                    $config->setOptions(array(
                        'phpSaveHandler' => 'memcache',
                        'savePath' => 'tcp://localhost:11211?timeout=1&retry_interval=15&persistent=1',
                        'cookie_httponly' => true,
                        'use_only_cookies' => true,
                        'cookie_lifetime' => 0,
                        'gc_maxlifetime' => 43200, // 12h
                        'remember_me_seconds' => 43200 // 12h
                    ));
                    return new SessionManager($config);
                },
                // ...
        );
    }
}

The authentication service is defined as

            'authService' => function ($sm) {
                $authService = new \Zend\Authentication\AuthenticationService;
                $authService->setStorage(new \Zend\Authentication\Storage\Session('user_login'));
                return $authService;
            },
  • the session storage uses the same memcached session manager.

Then anywhere within the application a session value needs to be retrieved or set I just use a \Zend\Session\Container like this:

$sessionContainer = new \Zend\Session\Container('ClientXYZ');
$sessionContainer['key1'] = $val1;
// or
$val2 = $sessionContainer['key2'];

The SSO is requested for the active session at any action using the token from session which contains PHPSESSID from the auth origin. It's quite complicated to describe here within this question.

Additionally an authentication service stores a user identity (with roles for ACL) also in memcached session - using the same settings. Obviously this is now the place which causes confusion. Apparently the session storage of authentication service times out prematurely causing the ACL to retrieve no user identity to check leading into SSO logout sequence (but because user didn't really log out, SSO redirects the user back as described above).

I'm not sure how much code should I (and can I) share here, maybe you'll lead me to the solution straight away or just by asking me some questions. I am quite helpless right now after many hours of debugging and trying to identify the problem.

Somewhere I have read that memcached wipes out the memory once the session cookie gets 1MB in size - may this be the case? For the user identity we save just general user information and array of roles, I'd guess this could be max. up to few kb in size...

EDIT 1: To dismiss all guesses and to save your time, here few facts (to keep an eye on):

  • only memcached is used
  • cookies serve only to transport the PHPSESSID between the browser and server and it's value is the key for memory chunk in memcached where the data is stored
  • client and SSO auth apps are running on one server (be it integration, staging or live environment, still just one server)
  • session on client app goes off randomly causing it to redirect to SSO auth app, but here the session is still alive thus user is redirected back to client app which gets new session and user stays logged in
  • this should dismiss discussion about memcached being wiped off or restarted
  • also observation on telneted memcached directly shows both data chunks (for client and auth apps) are established almost at the same time with the same ttl

I am going to implement some dies in PHP and returns in JS parts to catch the moment when the session is considered gone and further inspect the browser cookie, memcached data, etc. and will update you (unless somebody comes with explanation and solution).

11
  • By default, session lifetime is 24min, and the garbage collector comes every 30min, so a session may be killed after 24-54 minutes of inactivity. Is it the kind of delay you got ?
    – Random
    Commented Jun 11, 2015 at 12:51
  • @Random Yes, it is. But why is the session killed if the gc_maxlifetime and ZF2's remember_me_seconds are both set to 12 hours? How to keep the session alive for the whole 12 hours? And more over - how it is then possible that the session at SSO auth origin doesn't time out but the ZF2 auth service does? They both use the same memcached settings and daemon.
    – shadyyx
    Commented Jun 11, 2015 at 12:57
  • I read a lot about this yesterday and this morning, having a similar problem. I saw that php's gc was useless and could be disabled, since Ubuntu had a cron doing this, also using gc_maxlifetime to kill inactive sessions. But since it comes from ubuntu, I don't know which php.ini (or other file) it uses to define this gc_maxlifetime, I'll have a look
    – Random
    Commented Jun 11, 2015 at 13:01
  • On my machine, the cron is on /etc/cron.d/php5 (as said on serverfault), and it uses lifetime value in /usr/lib/php5/maxlifetime, there is a default value of 24minutes, and then finds every php.ini file : /etc/php5/*/php.ini to catch a session.gc_maxlifetime
    – Random
    Commented Jun 11, 2015 at 13:23
  • OK, this sounds logical and I have found out it is all very correct - but does this apply also for sessions stored in memcached?
    – shadyyx
    Commented Jun 11, 2015 at 14:08

3 Answers 3

1
public function initSession()
{
    $sessionConfig = new SessionConfig();
    $sessionConfig->setOptions([
        'cookie_lifetime'     => 7200, //2hrs
        'remember_me_seconds' => 7200, //2hrs This is also set in the login controller
        'use_cookies'         => true,
        'cache_expire'        => 180,  //3hrs
        'cookie_path'         => "/",
        'cookie_secure'       => Functions::isSSL(),
        'cookie_httponly'     => true,
        'name'                => 'cookie name',
    ]);
    $sessionManager = new SessionManager($sessionConfig);
    // $memCached = new StorageFactory::factory(array(
    //     'adapter' => array(
    //        'name'     =>'memcached',
    //         'lifetime' => 7200,
    //         'options'  => array(
    //             'servers'   => array(
    //                 array(
    //                     '127.0.0.1',11211
    //                 ),
    //             ),
    //             'namespace'  => 'MYMEMCACHEDNAMESPACE',
    //             'liboptions' => array(
    //                 'COMPRESSION' => true,
    //                 'binary_protocol' => true,
    //                 'no_block' => true,
    //                 'connect_timeout' => 100
    //             )
    //         ),
    //     ),
    // ));

    // $saveHandler = new Cache($memCached);
    // $sessionManager->setSaveHandler($saveHandler);
    $sessionManager->start();
    return Container::setDefaultManager($sessionManager);
}

This is the function I use in order to create a cookie for X user. The cookie lives for 3 hours, no matter if there are redirects or if the user has closed the browser. It's still there. Just call this function in your onBootstrap() method from Module.php.

While logging, I use The ZF2 AuthenticationService and the Container to store and retrieve the user data.

I suggest you to install these module for easier debugging. https://github.com/zendframework/ZendDeveloperTools https://github.com/samsonasik/SanSessionToolbar/

1
  • Your config is not that very different from mine - except I do not see any memcached stuff except the commented out one - which is probably not in use then. Nevertheless, the biggest difference is in setting the cookie_lifetime to some value. I am using 0 thus the cookie should live till the browser session end - which happens by closing the browser down. Nevertheless this may be the cause - maybe somehow the browser session is nowadays terminated sooner. I am setting to the same 12 hrs now and will observe. Thx!
    – shadyyx
    Commented Jun 29, 2015 at 12:58
1

Memcached & gc_maxlifetime

When using memcached as session.save_handler, garbage collection of session will not be done.

Because Memcached works with a TTL (time to live) value, garbage collection isn't needed. An entry that has not lived long enough to reach the TTL age will be considered "fresh" and will be used. After that it will be considered "stale" and will not be used any longer. Eventually Memcached will free the memory used by the entry, but this has nothing to do with session garbage collection of PHP.

In fact, the only session.gc_ setting that's actually used in this case is session.gc_maxlifetime, which will be passed as TTL to Memcached.

In short: garbage collection is not an issue in your case.

Memcached & Cronjobs

As you are using Memcached as storage for your sessions, any cronjobs provided by the OS that will manually clean session folders on disk (like Ubuntu does) will have no effect. Memcached is memory storage, not disk storage.

In short: cronjobs like this are not an issue in your case.

Issue of app, not SSO

You state that the SSO server/authority is on the same machine as the SSO client (the application itself), is using the same webserver / PHP configuration, and is using the same instance of Memcached.

This leads me to believe we have to search in how session management is done in the application, as that is the only difference between the SSO authority and client. In other words: we need to dive into Zend\Session.

Disclaimer: I've professionally worked on several Zend Framework 1 applications, but not on any Zend Framework 2 applications. So I'm flying blind here :)

Configuration

One thing I notice in your configuration is that you've set cookie_lifetime to 0. This actually means "until the browser closes". This doesn't really make sense together with remember_me_seconds set to 12 hours, because a lot of people will have closed their browser before that time.

I suggest you set cookie_lifetime to 12 hours as well.

Also note that remember_me_seconds is only used when the Remember Me functionality is actually used. In other words: if Zend\Session\SessionManager::rememberMe() is called.

Alternative implementation

Looking at the way you've implemented using Memcached as session storage, and what I can find on the subject, I'd say you've done something different than what seems to be "the preferred way".

Most resources on this subject advise to use Zend\Session\SaveHandler\Cache (doc, api) as save-handler, which gives you the ability to use Zend\Cache\Storage\Adapter\Memcached (doc, api). This gives you much more control over what's going on, because it doesn't rely on the limited memcached session-save-handler.

I suggest you try this implementation. If it won't immediately resolve your issue, there are at least a lot more resources to find on the subject. Your chances of finding a solution will be better IMHO.

2
  • Does gc_maxlifetime have a sense when used with memcached? If it does, then how would you explain that SSO authority runs on the same server as client application and client's session is gone while SSO authority's not? I think the whole problem lays far away from garbage collection and memcached running.
    – shadyyx
    Commented Jun 24, 2015 at 7:02
  • You're right, session garbage collection has a lot less influence then I initially thought when using the memcached handler. I'll revise my answer. Commented Jul 2, 2015 at 19:12
0

This answer might not immediately address the cause of your memcache issue, but because of the unreliable nature of memcache I would suggest to make a backup of your memcached data in some persistent storage. Memcaching your data will help you to improve performance of your application but it is not fail-safe.

Maybe you can make a fallback (persistent) storage in your AuthenticationService instance. Then first you try to get your authentication data from your memcache and if nothing is found you check if there is something available in your persistent storage.

This will at least solve all issues with unexpected memcache loss issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.