OpenAM : Failed to get the valid sessions from the specified server

Question

I have an issue to retrieve current sessions in Openam. When I connect with the amAdmin user on the first server and go to the session item on the administration page, I cannot see the session on the second server. I got the following error : Failed to get the valid sessions from the specified server. But sometimes I can see the sessions on the second server.

But when I connect with the amAdmin user on the second server and go to the session item, I can only see the open sessions on the second server (only the current sessions on the second server are displayed instead of the open sessions for the first server)

I have restarted web container after configuring both servers and also I have checked keystore.jk (it the same on both servers) The session failover is configured as recommended in openam documentation.

After checking /sso/debug -> Session I get the following message:

ERROR: Session:getValidSession :
com.iplanet.dpro.session.SessionException:     AQIC5wM2LY4Sfcx_fLoDaTo7RYYE1qLOq3Q4WtoQQ1k7_jk.*AAJTSQACMDIAAlMxAAIwMQ..* Invalid session     ID.AQIC5wM2LY4Sfcx_fLoDaTo7RYYE1qLOq3Q4WtoQQ1k7_jk.*AAJTSQACMDIAAlMxAAIwMQ..*
    at com.iplanet.dpro.session.Session.getSessionResponseWithoutRetry(Session.java:1583)
    at com.iplanet.dpro.session.Session.getValidSessions(Session.java:1340)
    at com.iplanet.dpro.session.Session.getValidSessions(Session.java:1201)
    at com.sun.identity.console.session.model.SMProfileModelImpl.initSessionsList(SMProfileModelImpl.java:111)
    at com.sun.identity.console.session.model.SMProfileModelImpl.getSessionCache(SMProfileModelImpl.java:307)
    at com.sun.identity.console.session.SMProfileViewBean.beginDisplay(SMProfileViewBean.java:190)
    at com.iplanet.jato.taglib.UseViewBeanTag.doStartTag(UseViewBeanTag.java:149)

Did you have any ideas to fix this issue? Best regards

Answer 1

The issue has been resolved after modifing settings in the openam config file 'bootstrap'. Some settings are not correctly saved in this file.

Answer 2

OpenAM uses an HTTP url connection to the other instance url (listed under 'Servers & Sites' to retrieve the session information.

if the OpenAM server instance urls have scheme 'https', make sure the deployment container trusts the issuer of the cert ... that's plain JSSE (http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html), not OpenAM related.

Session failover means 'failover', not session replication.