SSO on websphere losing session - session

Question

I have the following setup a request comes in via a load balancer to a Websphere IHS server which forwards the request onto the application server also Websphere. The issue I am facing when SSO is enabled is that a new session is being created on every request.
I know this because I have written a snoop servlet and the session id is different on every request. The web server and the app server have been configured to work with cookies and the load balancer has sticky sessions enabled.
I am using spenego as it is websphere and kerberos config to validate user from Active Directory.
Does anyone have any idea/pointers as to why my session is created on every request only when SSO is enabled. Without SSO the session is the same for the different requests. I have tried a lot of different settings in websphere but none have worked. for example clustering at the server layer, enabling security checkbox in websphere session management etc..
I have also tried to create my own cookie and put this back into the response thinking it will come back in the request but as before no cookie is sent back. The JSessionID cookie is also not visible. Also when creating my own cookie as you can see in the logs it states that com.ibm.ws.webcontainer.srt.SRTServletResponse addCookie WARNING: Cannot set header. Response already committed.
If you need any more info please ask and I will be happy to provide
right the nitty gritty then:
I have the following code in my servlet to check the session info and creating my own cookie
//lets try setting a cookie into the response
System.out.println("Setting a new cookie into the session");
String user = "";
if(req.getAttribute("com.ibm.ws.security.spnego.UserPrincipal") != null) {
user = req.getAttribute("com.ibm.ws.security.spnego.UserPrincipal").toString();
Cookie userCookie = new Cookie("userId", user);
userCookie.setMaxAge(60*60*24*365); //Store cookie for 1 year
res.addCookie(userCookie);
}
HttpSession session = req.getSession(false);
if ( session != null )
{
out.println("<h2>Session information:</h2>");
out.println("<TABLE Border=\"2\" WIDTH=\"65%\" BGCOLOR=\"#DDDDFF\">");
print(out, "Session ID", session.getId());
print(out, "Last accessed time", new Date(session.getLastAccessedTime()).toString());
print(out, "Creation time", new Date(session.getCreationTime()).toString());
String mechanism = "unknown";
if ( req.isRequestedSessionIdFromCookie() )
{
mechanism = "cookie";
}
else if ( req.isRequestedSessionIdFromURL() )
{
mechanism = "url-encoding";
}
print(out, "Session-tracking mechanism", mechanism);
out.println("</table><BR><BR>");
Enumeration vals = session.getAttributeNames();
if (vals.hasMoreElements())
{
out.println("<h2>Session values</h2>");
out.println("<TABLE Border=\"2\" WIDTH=\"65%\" BGCOLOR=\"#DDDDFF\">");
while (vals.hasMoreElements())
{
String name = (String)vals.nextElement();
out.println("<tr><td>" + escapeChar(name) + "</td><td>" + escapeChar(session.getAttribute(name).toString()) + "</td></tr>");
}
out.println("</table><BR><BR>");
}
}
out.println("</body></html>");
}
And the following code to check the cookies in the request
Cookie[] cookies = req.getCookies();
if ( cookies != null && cookies.length > 0 )
{
out.println("<H2>Client cookies</H2>");
out.println("<TABLE Border=\"2\" WIDTH=\"65%\" BGCOLOR=\"#DDDDFF\">");
for ( int i=0; i<cookies.length; i++ )
{
out.println("<tr><td>" + escapeChar(cookies[i].getName()) + "</td><td>" + escapeChar(cookies[i].getValue()) + "</td></tr>");
}
out.println("</table><BR><BR>");
}
and the following checks the request attributes
e = req.getAttributeNames();
if ( e.hasMoreElements() )
{
out.println("<h2>Request attributes:</h2>");
out.println("<TABLE Border=\"2\" WIDTH=\"65%\" BGCOLOR=\"#DDDDFF\">");
while ( e.hasMoreElements() )
{
String name = (String)e.nextElement();
System.out.println("Reuqest Attribute Faisal**************" + name + "********" + req.getAttribute(name).toString());
if(req.getSession() != null) {
System.out.println("**************Session id = " + req.getSession().getId());
} else {
System.out.println("**************Session is null");
}
if(req.getAttribute("com.ibm.ws.security.spnego.UserPrincipal") != null) {
if(req.getSession(false) != null) {
System.out.println("****Got the old Session id Faisal = " + req.getSession().getId());
req.getSession().setAttribute("user.principal", req.getAttribute("com.ibm.ws.security.spnego.UserPrincipal"));
}
}
out.println("<tr><td>" + escapeChar(name) + "</td><td>" + escapeChar(req.getAttribute(name).toString()) + "</td></tr>");
}
out.println("</table><BR><BR>");
}
So the first time I send the request all of my session variables and request attributes are printed out the second time I send a request the user principal is not available and my logs are as follows
[6/18/14 9:33:17:445 BST] 0000002f SystemOut O Reuqest Attribute**************javax.servl
et.request.key_size********128
[6/18/14 9:33:17:445 BST] 0000002f WASSessionCor W SessionAffinityManager setCookie SESN0066E: The r
esponse is already committed to the client. The session cookie cannot be set.
[6/18/14 9:33:17:447 BST] 0000002f srt W com.ibm.ws.webcontainer.srt.SRTServletResponse ad
dSessionCookie WARNING: Cannot set session cookie. Response already committed.
[6/18/14 9:33:17:448 BST] 0000002f SystemOut O **************Session id = N0Lp9cftRNzWkjw
KUDheA1U
[6/18/14 9:33:17:448 BST] 0000002f SystemOut O ****Got the old Session id = N0Lp9cftRNzWk
jwKUDheA1U
[6/18/14 9:33:17:448 BST] 0000002f SystemOut O Reuqest Attribute**************javax.servl
et.request.cipher_suite********RC4-SHA
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O **************Session id = N0Lp9cftRNzWkjw
KUDheA1U
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O ****Got the old Session id= N0Lp9cftRNzWk
jwKUDheA1U
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O Reuqest Attribute**************com.ibm.ws.
security.spnego.UserPrincipal********user#domain.COM
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O **************Session id = N0Lp9cftRNzWkjw
KUDheA1U
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O ****Got the old Session id = N0Lp9cftRNzWk
jwKUDheA1U
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O Reuqest Attribute**************com.ibm.web
sphere.servlet.uri_non_decoded********/lbgssoclient/snoop/
[6/18/14 9:33:17:449 BST] 0000002f SystemOut O **************Session id = N0Lp9cftRNzWkjw
KUDheA1U
[6/18/14 9:33:17:450 BST] 0000002f SystemOut O ****Got the old Session id= N0Lp9cftRNzWk
jwKUDheA1U
[6/18/14 9:33:17:452 BST] 0000002f SystemOut O Setting a new cookie into the session
[6/18/14 9:33:17:452 BST] 0000002f srt W com.ibm.ws.webcontainer.srt.SRTServletResponse ad
dCookie WARNING: Cannot set header. Response already committed.
[6/18/14 9:35:01:745 BST] 0000002e SystemOut O Reuqest Attribute**************javax.servl
et.request.key_size********128
[6/18/14 9:35:01:746 BST] 0000002e WASSessionCor W SessionAffinityManager setCookie SESN0066E: The r
esponse is already committed to the client. The session cookie cannot be set.
[6/18/14 9:35:01:747 BST] 0000002e srt W com.ibm.ws.webcontainer.srt.SRTServletResponse ad
dSessionCookie WARNING: Cannot set session cookie. Response already committed.
[6/18/14 9:35:01:749 BST] 0000002e SystemOut O **************Session id = ChRGK9SP4lEnGc2
yy7WQdGb
[6/18/14 9:35:01:750 BST] 0000002e SystemOut O Reuqest Attribute**************javax.servl
et.request.cipher_suite********RC4-SHA
[6/18/14 9:35:01:750 BST] 0000002e SystemOut O **************Session id = ChRGK9SP4lEnGc2
yy7WQdGb
[6/18/14 9:35:01:750 BST] 0000002e SystemOut O Reuqest Attribute**************com.ibm.web
sphere.servlet.uri_non_decoded********/lbgssoclient/snoop/
[6/18/14 9:35:01:750 BST] 0000002e SystemOut O **************Session id Faisal = ChRGK9SP4lEnGc2
yy7WQdGb
[6/18/14 9:35:01:752 BST] 0000002e SystemOut O Setting a new cookie into the session
Any advice or pointers are appreciated. i know there is a lot of info here but am really struggling with this.
Thanks
UPDATE:
After adding a session listner to monitor the session I noticed the following in the logs
[6/18/14 12:45:40:880 BST] 00000025 ServerCache I DYNA1071I: The cache provider "default" is being used.
[6/18/14 12:45:40:937 BST] 00000025 SystemOut O getting session for attributes print out
[6/18/14 12:45:40:938 BST] 00000025 SystemOut O Reuqest Attribute **************javax.servlet.request.key_size********128
[6/18/14 12:45:40:941 BST] 00000025 SystemOut O sessioncreated
[6/18/14 12:45:40:941 BST] 00000025 SystemOut O 1403091940939
[6/18/14 12:45:40:942 BST] 00000025 SystemOut O oN74OFyuPHcnyoxO_YBLK7z
[6/18/14 12:45:40:942 BST] 00000025 SystemOut O 1403091940939
[6/18/14 12:45:40:943 BST] 00000025 SystemOut O 1800
[6/18/14 12:45:40:943 BST] 00000025 SystemOut O sessionCreated - add one session into counter
[6/18/14 12:45:40:944 BST] 00000025 WASSessionCor W SessionAffinityManager setCookie SESN0066E: The response is already committed to the client. The session cookie cannot be set.
[6/18/14 12:45:40:945 BST] 00000025 srt W com.ibm.ws.webcontainer.srt.SRTServletResponse addSessionCookie WARNING: Cannot set session cookie
. Response already committed.
the last few lines state cannot set the session cookie because the response is already committed. Anyone know how to resolve this ?