RE: Tomcat SSO valve implementation

2020-12-21 Thread George Stanchev
We use spring-security-saml for application-level SP implementation and it 
works pretty good too. The project is in the process of being rewritten from 
scratch though with 2.0 in milestone builds. No direct integration with Tomcat 
though but on application level.

George

-Original Message-
From: André Warnier (tomcat/perl)  
Sent: Thursday, December 17, 2020 8:42 AM
To: users@tomcat.apache.org
Subject: Re: Tomcat SSO valve implementation

On 16.12.2020 19:39, Kevin Oxley wrote:
> We are trying to support SSO SAML 2.0 for user authentication in Tomcat
> (9.0.22).   Can anybody provide a reference to a pre-integrated SAML SSO
> valve implementation that you've had a good experience with?
> 

searching Google for "SAML SP for servlet engine" gives a few links, among them 
this one :
https://dzone.com/articles/saml-single-sign-on-with-tomcat-and-picketlink

I haven't tried it myself. In my cases, I always use an Apache httpd front-end, 
which does the authentication prior to proxying to a back-end tomcat (with the 
Connector attribute ' 
tomcatAuthentication="false" '). In the front-end Apache2 httpd then, we use 
Shibboleth as the SAML SP side.
That works perfectly.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: The main resource set specified is not valid

2020-12-21 Thread Christopher Schultz

Mark,

On 12/21/20 06:51, Mark Thomas wrote:

On 21/12/2020 00:50, Marc Chamberlin wrote:

Hello - I am encountering a problem, on OpenSuSE15.0 and on
OpenSuSE15.2, which suddenly appeared, possibly via an update or
possibly from me working on Tomcat and doing something that I can't find
a way to resolve.


Did OpenSuSE update as well? I'm wondering if you are suddenly running 
under systemd and are being locked into a chroot (or similar) jail.


-chris

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: The main resource set specified is not valid

2020-12-21 Thread Mark Thomas
On 21/12/2020 00:50, Marc Chamberlin wrote:
> Hello - I am encountering a problem, on OpenSuSE15.0 and on
> OpenSuSE15.2, which suddenly appeared, possibly via an update or
> possibly from me working on Tomcat and doing something that I can't find
> a way to resolve. I am now getting a rather obtuse set of error messages
> for all my webapps, which is coming from a series of stack walk-back
> traces (shown without the actual program trace messages) from the
> Tomcat/Catalina logfile -
> 
> 9-Dec-2020 13:47:22.732 SEVERE [main]
> org.apache.catalina.startup.HostConfig.beforeStart Unable to create
> directory for deployment: [/usr/share/tomcat/webapps]

That indicates that that directory does not exist (or Tomcat can't see
it) and that Tomcat could not create it. Given that, the subsequent
errors are expected.

> 19-Dec-2020 13:47:22.734 SEVERE [main]
> org.apache.catalina.core.ContainerBase.startInternal A child container
> failed during start
>     java.util.concurrent.ExecutionException:
> org.apache.catalina.LifecycleException: Failed to start component
> [org.apache.catalina.webresources.StandardRoot@704921a5]
>     Caused by: org.apache.catalina.LifecycleException: Failed to
> start component [org.apache.catalina.webresources.StandardRoot@704921a5]
>    Caused by: java.lang.IllegalArgumentException: The main resource
> set specified [/usr/share/tomcat/webapps] is not valid
> 
> The last error message - java.lang.IllegalArgumentException seems to the
> the pertinent one telling me the path /usr/share/tomcat/webapps is not
> valid.

That looks like an appBase rather than a docBase.

Stack traces are often extremely helpful in tracking down the cause of
an error. If you do trim them then:
- the last one (the root cause) is likely to be the most important (as
  you have correctly identified)
- keep at least the class, method and line number where the exception
  was thrown to save time figuring out where the error occurred
- provide the full stack trace ideally at the end of the email but
  pastebin or similar is also an option
> Doesn't tell me why it is invalid, sigh, when will programmers
> write decent user friendly error messages which can actually help?

That tone is far more likely to antagonise the very people who can help
rather than encourage them to be helpful. Remember that the people here
are all volunteers providing their time to help you for free.

Since the source code is freely available, you have the ability to look
at the source code where the exception was thrown to see if that
provides any additional hints as to what might have gone wrong.

> Anywise, on my system I am guessing that the problem is that this app
> path is actually a double soft link i.e.

Symlinks can be problematic. Tomcat checks that the absolute and
canonical file names are the same and that the canonical file name is
below the canonical docBase. That check can fail when symlinks are used
within a web application. The checks have a security significance on
case sensitive file systems. Linux is nearly always case sensitive so
you can use allowLinking on the Context to permit the use of symlinks.

> quasar:/usr/share/tomcat # ll -d /usr/share/tomcat/webapps
> lrwxrwxrwx 1 root tomcat 19 Jul 12  2019 /usr/share/tomcat/webapps ->
> /srv/tomcat/webapps
> 
> quasar:/usr/share/tomcat # ll -d /srv/tomcat/webapps
> lrwxrwxrwx 1 root tomcat 38 Nov 23 14:58 /srv/tomcat/webapps ->
> /websites/home/marc/domain.com
> 
> quasar:/usr/share/tomcat # ll -d /websites/home/marc/domain.com/
> drwxrwxr-x 39 marc users 4096 Aug 13 23:52 /websites/home/marc/domain.com/
> 
> I did try shortening this to a single soft link but that didn't change
> anything.  The only other possibility I can think of is that Tomcat may
> have troubles reaching a file system on a different mount point??? 
> /webapps/... is on a different disk drive and is a mount point.

That shouldn't matter.

> These two environment variables are defined in tomcat.conf -
> 
> CATALINA_HOME="/usr/share/tomcat"
> CATALINA_BASE="/usr/share/tomcat"
> 
> The host declaration for this application, in server.xml, is -
> 
>       unpackWARs="true" autoDeploy="true">
>      directory="logs"
>    prefix="localhost_access_log." suffix=".txt"
>    pattern="%h %l %u %t %r %s %b" />
>       
>     
>        
>     
>   

You have allowLinking there so the symlinks shouldn't be an issue.

The docBase looks wrong. I'd expect that to be "ROOT", the name of a
directory or possibly a WAR file.

> The context.xml file is -
> 
> 
>     WEB-INF/web.xml
>     WEB-INF/tomcat-web.xml
>     ${catalina.base}/conf/web.xml
> 
>     
> 

That looks OK.

> Sure would appreciate any help offered and thanks in advance. I been
> spending lots of hours trying to noodle this problem out and just not
> getting anywhere! A puzzler is that I had Tomcat working on OpenSuSE
> 15.0 at one time and this error message surfaced when I was trying to