See apache issue reported as a bug.

http://issues.apache.org/bugzilla/show_bug.cgi?id=38242

and

http://issues.apache.org/bugzilla/show_bug.cgi?id=34107


Many classes implement HttpSessionBindingListener instead of HttpSessionListener. This causes a problem with Tomcat 5.5.12 when they try and unbind values from the session, but the call to getSessionId returns null, and throws an invalidStateException. The spec. states that the HttpSessionBindingListener "causes an object to be notified when it is bound to[,] or unbound from a session." The HttpSessionListener spec states, "implementations of this interface are notified of changes to the list of active sessions in a web application."

UPortal is wanting to unbind values when the session is destroyed, therefore it should implement the HttpSessionListener, not the HttpSessionBindingListener. There is no guarantee that all portal containers will implement this correctly and have a valid session once session.invalidate() has been called.

This worked fine in earlier Tomcat versions, however the current implementation is not correct. All classes that implement HttpSessionBindingListener need to be changed to implement HttpSessionListener, and all methods that receive a HttpSessionBindingEvent need to be changed to receive a HttpSessionEvent.

Classes effected:
org.jasig.portal.GuestUserInstance
org.jasig.portal.GuestUserPreferencesManager
org.jasig.portal.GuestUserPreferencesManagerWrapper
org.jasig.portal.IUserPreferencesManager
org.jasig.portal.UserInstance
org.jasig.portal.UserInstanceManager
org.jasig.portal.UserPreferencesManager
org.jasig.portal.jndi.JNDIManager

Example Fix:

Current Version:

public class UserInstance implements HttpSessionBindingListener
{
    public void valueUnbound(HttpSessionBindingEvent bindingEvent)
    {
    }

    public void valueBound (HttpSessionBindingEvent bindingEvent)
    {
    }
}

public class GuestUserPreferencesManager extends UserPreferencesManager
{
    public void finishedSession(HttpSessionBindingEvent bindingEvent, String sessionId)
    {
    }
}

Fix version:

public class UserInstance implements HttpSessionListener
{
    public void sessionDestroyed(HttpSessionEvent bindingEvent)
    {
    }

     public void sessionCreated (HttpSessionEvent bindingEvent)
    {
    }
}

public class GuestUserPreferencesManager extends UserPreferencesManager
{
    public void finishedSession(HttpSessionEvent bindingEvent, String sessionId)
    {
    }