Re: Tomcat + APR: 'Invalid Server SSL Protocol' (was 'Tomcat + APR .. Socket bind failed')

2009-10-19 Thread Ken Johanson
Ken Johanson wrote: Ken Johanson wrote: snip After doing a kill, then startup I now get: java.lang.Exception: Invalid Server SSL Protocol at org.apache.tomcat.jni.SSLContext.make(Native Method) at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:693

Tomcat + APR non-root on linux: Socket bind failed: [98] Address already in use

2009-10-15 Thread Ken Johanson
Hi everyone, Trying to run Tomcat Tomcat/6.0.18 + apr-1.3.8.tar.gz, I get a: Oct 15, 2009 12:11:20 AM org.apache.coyote.http11.Http11AprProtocol start SEVERE: Error starting endpoint java.lang.Exception: Socket bind failed: [98] Address already in use at

Re: Tomcat + APR non-root on linux: Socket bind failed: [98] Address already in use

2009-10-15 Thread Ken Johanson
Jan Pernica wrote: You cannot use port 1024 as non-root. Use apache and AJP to connect tomcat running on eg. 8080. Regards Jan On 15.10.2009 8:18, Ken Johanson wrote: Hi everyone, Trying to run Tomcat Tomcat/6.0.18 + apr-1.3.8.tar.gz, I get a: Oct 15, 2009 12:11:20 AM

Re: Tomcat + APR non-root on linux: Socket bind failed: [98] Address already in use

2009-10-15 Thread Ken Johanson
Peter Crowther wrote: 2009/10/15 Ken Johanson tomcat-u...@kensystem.com SEVERE: Error starting endpoint java.lang.Exception: Socket bind failed: [98] Address already in use at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:612) .. (no listener is actually running on 98

Tomcat + APR: 'Invalid Server SSL Protocol' (was 'Tomcat + APR .. Socket bind failed')

2009-10-15 Thread Ken Johanson
Ken Johanson wrote: snip After doing a kill, then startup I now get: java.lang.Exception: Invalid Server SSL Protocol at org.apache.tomcat.jni.SSLContext.make(Native Method) at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:693

Bug?: tomcat does not log reqs without c-length or transfer-encoding

2009-02-12 Thread Ken Johanson
Hi, I noticed that requests (POST in the case) that are missing both the Content-Length and also Transfer-encoding, are not logged (as invalid) in Tomcat/6.0.18. Seems potential for stealth mis-use (DoS etc). I'm not sure of this is core or org.apache.catalina.valves.AccessLogValve (would

Re: Servlet 2.5 and RequestDispatcher.include + Response.setHeader, invalid?

2009-01-30 Thread Ken Johanson
Caldarale, Charles R wrote: It's my understanding that servlet 2.5 loosened the requirement that a included/callee Servlet (and JSP?) cannot set the resp headers/status, and should now be able to set them if not already committed. Here's the exact text from SRV.8.3 of the servlet spec version

Re: Servlet 2.5 and RequestDispatcher.include + Response.setHeader, invalid?

2009-01-30 Thread Ken Johanson
Caldarale, Charles R wrote: From: Ken Johanson [mailto:tomcat-u...@kensystem.com] Subject: Re: Servlet 2.5 and RequestDispatcher.include + Response.setHeader, invalid? Do you know if that rule applies only to the Request object passed by the RequestDispatcher, or should the container also

Virtual dirs without new context?

2009-01-27 Thread Ken Johanson
Hi all, I know from reading that if one wants to create a a virtual directory (one that does not physically exist in the host's appbase but is accessible via a configured mapping), that the traditional suggestion is to create a new context in the host. However, I'd like to create one or

Servlet 2.5 and RequestDispatcher.include + Response.setHeader, invalid?

2009-01-27 Thread Ken Johanson
First my apologies if this has been discussed; searching the list for subject keywords, I did not see this discussion... It's my understanding that servlet 2.5 loosened the requirement that a included/callee Servlet (and JSP?) cannot set the resp headers/status, and should now be able to set

Unbounded content-length (e.g no Content-Length) in POST?

2008-10-08 Thread Ken Johanson
Greetings, Does Tomcat have an option to allow POSTs that do not have a Content-Length header, but instead only provide a range: Range: bytes=0- This is common for streaming media delivery software which may POST live data, or with other system that cannot predetermine the stream length.

Re: sePrincipal

2006-02-17 Thread Ken Johanson
[EMAIL PROTECTED] wrote: Thanks for reply Bill. Is there anyway to setPrincipal on HttpServletRequest? can I cast to concreate class that implemented that HttpServletRequest? Which class is it? Anil, is this what you are looking for? http://issues.apache.org/bugzilla/show_bug.cgi?id=38658

public void AuthenticatorBase.doLogin(request, response, principal)

2006-02-13 Thread Ken Johanson
Dear tomcat internals experts; I'm taking a shot at prototyping a new method (yet untested) within org.apache.cataline.authenticator.AuthenticatorBase: public void doLogin(HttpServletRequest request, HttpServletResponse response, Principal principal) {

Re: Calling Realm.authenticate() doesn't register Principal in with the Session??

2006-02-09 Thread Ken Johanson
I'm trying to re-word these two concepts in a more elegant way: 1) I'm looking for a way to use form based authentication - but unlike with the current form login Realm, I need a way to intercept the persons email address(s) (typed into the username field), so that I can convert that into its

Re: Calling Realm.authenticate() doesn't register Principal in with the Session??

2006-02-07 Thread Ken Johanson
Mark Thomas wrote: Ken Johanson wrote: Mark, are you saying that you agree, or disagree, with the usefulness of the idea? I am -0 to the idea as a whole. I don't see the point but am happy to proivde pointers where I can. Mark Okay - do you have any pointers for this need?: (please

Re: Calling Realm.authenticate() doesn't register Principal in with the Session??

2006-02-06 Thread Ken Johanson
Mark Thomas wrote: Given users are going to have to modify their app to use this library, not modifying the associated context.xml looks to be a nice to have requirement that is making things more difficult. Removing this requirement opens up a number of alternative implementation options

Re: Calling Realm.authenticate() doesn't register Principal in with the Session??

2006-01-20 Thread Ken Johanson
... I'm trying to write a facade API that will call into whatever Realm/Authenticator that the user already has configured (though an abstract/overridden method)... the idea being that no changes to the user's existing auth config or modules are required, nor that the user should need to change

Re: Calling Realm.authenticate() doesn't register Principal in with the Session??

2006-01-19 Thread Ken Johanson
Mark Thomas wrote: Ken Johanson wrote: Hi all, I am able to access the current context's org.apache.catalina.Realm object using Yoav Shapira's Tomcat-Realm example; however, when I call Realm.authenticate(String user, String pass), the Principal object that it returns is not being registered

Classes in tomcat/common cannot load org.apache.catalina.*

2006-01-17 Thread Ken Johanson
Hello, I'm looking for a way to be able to load classes in org.apache.catalina, like in Yoav Shapira's Tomcat Realm example ( http://wiki.apache.org/tomcat/HowTo#head-42e95596753a1fa4a4aa396d53010680e3d509b5 ). The problem is, when my compiled classes (which wrap that entire operation) are

Re: Classloaders for 'shared' and 'common' cannot load class-data from server?

2006-01-16 Thread Ken Johanson
(StandardWrapper.java:978) . ken -Original Message- From: Ken Johanson [mailto:[EMAIL PROTECTED] Sent: 16 January 2006 22:59 To: Tomcat Users List Subject: Classloaders for 'shared' and 'common' cannot load class-data from server? Hello, I'm building some utility wrappers for Tomcat

Re: Alternative Realm impl. that supports: boolean authenticate(String user, String pass) or void doLogin(Prinicipal p)?

2006-01-15 Thread Ken Johanson
Nicholas Irving wrote: I have been looking for a authenticate(user) method, but cannot seem to find one, as I need to do something similar. Any ideas? Do you mean doLogin(Principal p)? - To unsubscribe, e-mail: [EMAIL

Re: Unable to override doPut(), etc, from Tomcat's JSPServlet (response 403)

2006-01-14 Thread Ken Johanson
Caldarale, Charles R wrote: From: Ken Johanson [mailto:[EMAIL PROTECTED] Subject: Re: Unable to override doPut(), etc, from Tomcat's JSPServlet (response 403) Perhaps tomcat 5 outright prohibits PUT and other methods from even getting to _jspService (or JspServlet in general)?? There's

Alternative Realm impl. that supports: boolean authenticate(String user, String pass) or void doLogin(Prinicipal p)?

2006-01-14 Thread Ken Johanson
Is there another commonly used (perhaps not distib'd with tomcat) implementation of Realm that allows a more programmatic type of authentication? I know that a couple other servers provide something like a boolean ServerName.authenticate(String user, String pass), which checks against the

Re: Alternative Realm impl. that supports: boolean authenticate(String user, String pass) or void doLogin(Prinicipal p)?

2006-01-14 Thread Ken Johanson
Hmm, I see from all the org.apache.catalina.Realm implementations that come with Tomcat, that authenticate(user,pass) is already there - but I currently don't know how to gain access to the Realm service from within a servlet/jsp (where my controller might be)... and it seems to me that it

Re: Recommended way to selectively RequestDispatch.include/forward to form based login?

2006-01-13 Thread Ken Johanson
Bill Barker wrote: . The above seems like it should work; however I happen to get a StringIndexOutOfBounds* (with tomcat 5.0.30), probably caused by RD not being able to resolve the path of a protected URI (a guess) - so I'm looking for another way.. No, it's actually because it's

Re: Unable to override doPut(), etc, from Tomcat's JSPServlet (response 403)

2006-01-13 Thread Ken Johanson
Servlet.service() as final. Then they call _jspService() (which is created during JSP compilation). So doYYY() is never called. -Tim Ken Johanson wrote: Serendipity! I guess the couple time I'd done this before made me overly confident that it should work the way I *remembered* doing it (which

Re: Unable to override doPut(), etc, from Tomcat's JSPServlet (response 403)

2006-01-13 Thread Ken Johanson
Tim Funk wrote: You cannot add a doPut() to your servlet and excpect it to work. But in your JSP, you can do this: // The following worked fine with tomcat 5.0.28 (plus unrelated patches) if(PUT.equals(request.getMethod()) { /*put code*/ } else { /*not put code*/ } JSP's declare

Re: Unable to override doPut(), etc, from Tomcat's JSPServlet (response 403)

2006-01-13 Thread Ken Johanson
There's a comment in the web.xml settings for the default servlet: !-- readonly Is this context read only, so HTTP -- !-- commands like PUT and DELETE are -- !-- rejected? [true]-- Is there any possibility that you're actually getting into the

Recommended way to selectively RequestDispatch.include/forward to form based login?

2006-01-11 Thread Ken Johanson
Hello, Does anyone have a suggested way to selectively, inside a simple JSP or Servlet, cause the built-in Tomcat form-login to be presented? Currently, I'm doing the following: -Have protected URI inside my webapp, e.g. /login/, configured with a security-constraint in web.xml. (this works

Re: problem with keytool for ssl

2006-01-11 Thread Ken Johanson
You appear to be attempting to import (last step) the certificate request you created. Instead, you should be waiting for / getting back your CA's signed version of your CSR, then import that.. Otherwise, create self signed cert to import, if you dont need users to trust your claimed identity.

Re: Application Not Available - Tomcat 5.5.12

2006-01-11 Thread Ken Johanson
Mike wrote: Hello all, I have scoured Google and the list archives, it seems like somebody must have had this issue before but I can't find any record of it. (all on a single host) Tomcat 5.5.12 Apache 1.3.28 mod_jk Mandrake Linux 9.1 Struts 1.2.4 My problem is that, while using my