API calls should be handled correctly in case of fail-over of JOC Cockpit Cluster

Current Situation

The API calls

• security/joc_cockpit_permissions
• security/command_permissions
• configurations

do end with an error in case of fail-over.

• user is null Authorization header with basic based64part expected
• JocAuthenticationException: token not valid

Desired Behavior

The API calls

• security/joc_cockpit_permissions
• security/command_permissions
• configurations

should not end with an error in case of fail-over.

How to reproduce

• Install two JOC Cockpit instances on two different servers.
• Add the JOC Cockpit cluster configuration
• with JOC Cockpit manage accounts
• or direct in the shiro.ini.active configuration file

securityManager.sessionManager.globalSessionTimeout = 9000000
sessionDAO = com.sos.auth.shiro.SOSDistributedSessionDAO
securityManager.sessionManager.sessionDAO = $sessionDAO
* 

• Login in instance A using the login API call (use a REST client plugin for your browser)
• Use one of the above API calls using the access-token returned by the login but now use the user instance.

Patch

A patch is available here