Re: How to have a custom classloader outside Tomcat's own lib-dir?

Guten Tag Thorsten Schöning, am Montag, 17. April 2023 um 13:16 schrieben Sie: >> common.loader=[...],"${catalina.base}/lib_custom/*.jar" >> common.loader=[...],"${catalina.home}/lib_custom/*.jar" >> common.loader=[...],"${catalina.ba

Re: How to have a custom classloader outside Tomcat's own lib-dir?

Axis2 as a webapp in Tomcat and that does support a custom classloader. But that is simply because it does so on its own, have nothign to do with Servlet standards? Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mitglied der Bitstore Gruppe - Ihr Full-Serv

How to have a custom classloader outside Tomcat's own lib-dir?

, but it doesn't seem to be standard and supported by Tomcat. Thanks for your input! Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK E-Mail: thorsten.schoen...@am-soft.de Web:htt

Re: Why does LockOutRealm not support CredentialHandler?

id during tests when the credential handler didn't work as expected for the user database. I simply moved it up for test purposes, got the warning and thought there was some fundamental underluying problem. Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mit

Re: Why does LockOutRealm not support CredentialHandler?

properly taken into account? So whatever the SO-guy sees, might have a different root cause, as it was the case for me. Thanks for triggering me to try again! Might have been to late already at Monday as well. :-) Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Ha

Re: How do auth-method BASIC and DIGEST play together with some credential helper?

the CIS spec to me and I just needed to collect input how to deal with that. OTOH, thinking about it again, the customer says to run automatic CIS checks using some app and that didn't complain about auth-method BASIC yet. So using that with PBKDF2WithHmacSHA512 seems to be fine even more. Mit f

Re: Why does LockOutRealm not support CredentialHandler?

ell, even without any warning this time. Which makes it additionally difficult to debug this whole setup. > In Tomcat 10 BTW, the "digest" attribute has been removed in favor > of a properly-configured . Note that you can't > use "digest" and also get acceptable security ou

Re: How do auth-method BASIC and DIGEST play together with some credential helper?

for input! Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK E-Mail: thorsten.schoen...@am-soft.de Web:http://www.AM-SoFT.de/ Tel: +49 5151- 9468- 0 Tel: +49 5151- 9468-55 M

Re: How do auth-method BASIC and DIGEST play together with some credential helper?

The cleartext password needs to be available in tomcat-users.xml, but isn't when using PBKDF2WithHmacSHA512. Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK E-Mail: thorsten.sc

Re: Why does LockOutRealm not support CredentialHandler?

pache.org/bugzilla/show_bug.cgi?id=66349 Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service - Bitstore Hameln GmbH Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK E-Mail: thorsten.schoen...@am-soft.de Web:http://www.AM-SoFT.de/ Tel: +49 5151- 9468- 0 T

Re: How do auth-method BASIC and DIGEST play together with some credential helper?

t asks me for plain-text passwords. There's no way I could provide a digest generated using PBKDF2WithHmacSHA512 with the settings mentioned in my former mail. And even if there was, that digest would be a plain-text password again. Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Service -

How do auth-method BASIC and DIGEST play together with some credential helper?

erver at all? Of course there's TLS in place, it's really about to follow the CIS benchmark as much as possible for some customer requirements. But some parts of that CIS benchmark don't make too much sense to me. Thanks for your help! Mit freundlichen Grüßen Thorsten Schöning -- AM-SoFT IT-Se

Why does LockOutRealm not support CredentialHandler?

al handler found with a depth-first search, that should work for the majority of use-cases. Other aspects of the config like default assumed nesting level of realms and stuff seem hard-coded as well. Would be glad to read some thoughts, as I need to decide how to deal with this limitation right n

Re: Experiences with Tomcat in some IoT-project?

like that. Some different discussed board/CPU with far less power consumption only provides 128 MiB of RAM, hence the tests. Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon...

Experiences with Tomcat in some IoT-project?

for everything you share! Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon...05151- 9468- 55 Fax...05151- 9468- 88 Mobil..0178-8 9468- 04 AM-SoFT

Re: Character encoding problems using jsp:include with jsp:param in Tomcat 8.5 only.

nt to make sure that I'm not spam filtered. Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon...05151- 9468- 55 Fax...05151- 9468- 88 Mobil..0178-8 9468- 0

Character encoding problems using jsp:include with jsp:param in Tomcat 8.5 only.

some regression? There is some conversion somewhere which was not present in the past. 3. What is the correct fix I need now? The character encoding filter, even though it only applies to bodies per documentation? Thanks! Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning

Re: What is the correct place to specifiy SPI service files for Java?

ues in very specific environments, but in my opinion shouldn't be the root cause, as that is provided with Ubuntu as well. Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon..

Re: What is the correct place to specifiy SPI service files for Java?

ted to read about, but if you want the credits, feel free to add it yourself and I will delete mine. Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon...05151- 9468- 55

Re: What is the correct place to specifiy SPI service files for Java?

be made > available by adding them to the application's class path or by some > other platform-specific means. https://docs.oracle.com/javase/7/docs/api/java/util/ServiceLoader.html So, Tomcat prefers Jars because only those are explicitly mentioned or what is the reason? Mit freundlichen Grüß

Re: What is the correct place to specifiy SPI service files for Java?

ng "META-INF/services" at the top level of the web project, but "WEB-INF/classes/META-INF/services" instead. That can be clearly seen e.g. using Process Monitor. So is this a bug or needs some configuration or has changed in newer versions of Tomcat or whatever? Mit freundlichen

What is the correct place to specifiy SPI service files for Java?

-inf-services-javax-servlet-servletcontainerinitializ Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am-soft.de AM-SoFT IT-Systeme http://www.AM-SoFT.de/ Telefon...05151- 9468- 55 Fax...05151- 9468- 88 Mobil

How to make Tomcat 7.0.52 and newer ones compatible regarding filter HttpHeaderSecurity?

apache.org/mod_mbox/tomcat-users/200808.mbox/<4893749f.3070...@ice-sa.com> Thanks for your input! [1]: https://stackoverflow.com/a/35795122/2055163 [2]: http://tuckey.org/urlrewrite/ Mit freundlichen Grüßen, Thorsten Schöning -- Thorsten Schöning E-Mail: thorsten.schoen...@am