The keepState Property in Payara Micro Doesn't Work Fully

Technical Discussion
1

The keepState Property in Payara Micro Doesn’t Work Fully

From what I understand, when keepState is set to true, the persistent session state should be maintained during redeployments. This means that when running in dev mode using mvn package payara-micro:dev, the login session should be preserved, and the caller principal and caller group should also be maintained.

Here is the log of the issue:

Steps Taken:

  1. Create a Project:
  • Use Payara Starter to create a Payara Micro project.
  • Select Maven, Java 21, Jakarta EE 10, Web Profile, Payara Micro 6.2024.7, and Form Authentication - Database.
  1. Run Dev Mode:
  • Execute mvn clean package payara-micro:dev.
  1. Log In:
  • Open the “Secure Protected Page,” which shows the login screen.
  • Log in with the user myuser.
  1. Observe Behavior:
  • The following actions work as expected:
    • User can open “Secure Protected Page.”
    • User gets a 403 Forbidden error when opening “Admin Page.”
    • User can open “Secured Protected Resource.”
    • User gets a 403 Forbidden error when opening “Secured Admin Resource.”
  1. Modify Source Code:
  • Save changes to the source code.
  • The code is automatically recompiled and redeployed.
  1. Observe Behavior After Redeploy:
  • User gets a 403 Forbidden error when opening “Secure Protected Page.”
  • User gets a 403 Forbidden error when opening “Admin Page.”
  • User gets a 403 Forbidden error when opening “Secured Protected Resource.”
  • User gets a 403 Forbidden error when opening “Secured Admin Resource.”

Question:

Is losing the caller group or role after redeployment the intended behavior of the keepState?
All session information, including caller groups and roles, should be preserved across redeployments.

2

Hi @hidekaz, as per our policies, reports of incidents or defects in the Payara Platform should be reported in the corresponding GitHub repository issue tracker (Issues · payara/Payara · GitHub for Platform Issues or Issues · payara/ecosystem-support · GitHub for Ecosystem issues). Keep this in mind in the future when requesting assistance.

On the issue at hand, you are correct, the keepState property should instruct the server runtime to maintain state across re-deployments of the same application, and we’re aware of this issue affecting Payara Server in its current version. Internally this report is already tracked with the internal ID FISH-7741, so once it is fixed, the behaviour you described should work as intended.

1 Like