At my work, we’re currently working on a new J2EE platform to host our webapp applications, based on Tomcat 6 (6.0.24 to be precise). After deployed few fully public webapps without any issue, we start to deploy some other webapps with an authenticated part. The authentication is based on OpenSSO, using REST APIs. The cookie is created to OpenSSO, then set (client side) by one of our own webapplication. This cookie is validate using isValidToken REST API on every application the user goes. However, we’re not able to get authentication working on the preproduction environment, while it working perfectly on the dev environment. After some investigations with the developpers, we notice the OpenSSO’s cookie value was truncated.
After reading this post on the tomcat’s user mailing list, we start to configure tomcat. Few hours after, I was thinking about change the tomcat configuration is only a workaround, without fixing the original problem. Thanks to the OpenSSO’s IRC channel, someone (Allan Foster) pointed me to com.iplanet.am.cookie.c66Encode configuration variable. You can enable it in the console, Configuration, servers and sites, click on default paramaters, and then advanced tab. Set the value to true, and voila! Everything is now working good!