We Keep Coding

Separate Container and Shiro Sessions?

We use Apache Shiro to provide security for 4 applications running within one Tomcat instance. They are deployed as 4 WARs, with all the Shiro config and security in a 5th WAR.
In order to provide SSO across these applications, we've configured ehCache to share sessions between all 5 web apps (the original intention was to use multiple containers, but this never happened).
The problem we are facing is that in sharing the sessions across the apps, we are also sharing all object data placed into the session. This is a problem because the apps have different dependencies and hence different classpaths, leading to ClassNotFoundExceptions. I think I'm right in saying that by default in a Tomcat container each WAR would have a separate session and so this would not be problem, but then we would not be able to share the Shiro user data!
So my question is this: Is it possible to have separate Shiro and Container sessions? This would allow the desired outcome i.e. any login data that Shiro uses would be placed into the 'Shiro' session and shared across the multiple apps, while the Container sessions would be separate for each app and therefore no data would be shared between them.

Shiro needs to run in each container. Then those containers need to share the Shiro session. https://shiro.apache.org/session-management.html#session-storage
You could do this using the container's session sharing capabilities or with Shiro's.

What is the default Session Storage for Spring Boot?

I have read the Spring Boot documentation and I got knowledge about Spring Session from this document.
But I see that HttpSession class works without adding any dependencies in my code.
JDBC
Redis
Hazelcast
MongoDB
So...
I'm guessing that Spring Boot provides Session Storage by default. Does anyone know about this? I looked at spring docs but couldn't find it.

How to you run your app? Do you use Tomcat or Jetty embedded server or deploy it in those servers? They all have their own session storage implementation. Tomcat uses file-bases session storage by default.

The session storage that you mentioned by default is provided by the Servlet container.It is just an internal java.util.Map.
Spring Session is a Spring sub-project. It is optional and its purpose is to allow you swap the session stroage mechanism provided by the container with the one provided by Spring Session which can be RDBMS, Redis ,Hazelcast Cluster or MongoDB .HttpSession is then stored in the container agnostic way such that you can have session persistence /session clustering more easier. You no longer need to consult the Servlet container documentation for how to configure a cluster etc.
If you want to use Spring session, you still have to include the dependencies from the spring session project.

Redis on Bluemix

We have a Java Spring application running on dedicated bluemix with Tomcat and cloudfoundry. We want to increase the number of running instances, thus we need to replicate our session variables to each instance.
From our perspective the natural path would be using Redis and Spring Sessions.
However, there is big red tag telling us that bluemix Redis support is experimental and should not be used in production environments.
If we can't use Redis in production environments, what is the alternative to session cluster aware in dedicated bluemix?

The two services that are available in Public that you could use are "Session Cache" and "Compose for Redis".
Session Cache: Improve application resiliency by storing session state information across many HTTP requests. Enable persistent HTTP sessions for your application and seamless session recovery in event of an application failure.

You can use Compose Enterprise in Bluemix Dedicated which contains production ready Redis: https://enterprise.compose.com/

can JPA and memcached be used simultaneously in a web application? how?

i am developing a web application and for Object relation mapping i am using JPA.
My application frequently reads from DB.
to speed up the DB reads can i use memcached along with JPA? what's the machanism?
i am using JPA with eclipselink, eclipse and weblogic.

Only place JPA and memcached will relate through an API I can think, if you are using hibernate, is caching. If you are using Hibernate you may configure memcached as your 2nd level cache provider by using the hibernate-memcached project. Though I believe there are better alternative than memcached if you are just planing to use it as a hibernate 2nd level cache.
Memcached is an in memory caching system which you may use as a db it self.

EJB, spring & hibernate

I've been doing Java standard edition development for awhile, and the frameworks and solutions have been fairly obvious to me (Swing for GUI, etc). I've recently begun the task of building a server for my own needs and to host a web page (things the server will be doing in addition to hosting a web page would include personal SVN hosting and integrating more web functionality into existing and future applications). For coding for only a single computer (that is, distributed computing, etc. is not really a concern)- I'm not entirely certain between Spring, Hibernate and EJB and am not very knowledgeable as to the capabilities of each. Information would be appreciated. I know Spring is an alternative to EJB, and Hibernate is an object-relational mapping library, so does EJB combine the two?

EJB3 in summary consists of 3 bean types; Message Driven Beans, Stateless/Stateful Session Beans and Entity Beans or JPA (Java Persistance Architecture). Hibernate can be used as a JPA provider, but it doesn't have to be used that way.
Spring has functionality that is roughly similar to Message Driven Beans and Stateless/Stateful session beans but it does not have an equivalent to JPA. Instead it allows you to utilize JPA or hibernate directly but if you do combine Spring with JPA you'll need an EJB container.
Another difference is that EJB is provided by 'containers' whereas spring is a framework that can be deployed into a java se application or a java servlet container web application like jetty or tomcat. Its an important distinction to make. Tomcat is not an EJB container, only a servlet container, hence if you were to only use basic tomcat, you couldn't use EJBs but you could use spring by including the required spring jar files in your web application (WEB-INF/lib). In that case you wouldn't use JPA either but you could use hibernate.
Some java servers that ARE EJB containers include weblogic, websphere, jboss, geronimo, and glassfish. Tomcat can become an EJB container if you combine it with OpenEJB.
In an application i'm developing at the moment, I'm using tomcat + openejb so I have an EJB container so I can use JPA with OpenJPA as the persistance provider. I'm using Spring MVC to do the web application development and will most likely use spring security as well down the track. I probably will also use Stateless Session EJBs as well to encapsulate business functionality but i could just as easily use Spring service/dao beans instead of statless session ejbs as well.
Its pretty confusing sometimes to work out what parts of which framework or container you should use and really comes down to either preference or using functionality in one that doesn't exist in the other or ease of use. Another consideration is memory utilization. Some of the ejb containers consume large amounts of memory just starting up with no applications running. This is one reason I ended up using tomcat + openejb. Hope this helps.