Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-16 Thread ohaya
Hi Andre (and Christopher and Olaf), I think that that is a good summary of where this is at this point. Thanks! Jim On Saturday, May 16, 2020, 08:23:54 AM EDT, André Warnier (tomcat/perl) wrote: In summary, yes, I think you're right in your final conclusion below. If the tomcat a

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-16 Thread tomcat/perl
In summary, yes, I think you're right in your final conclusion below. If the tomcat access log shows the authenticated user, it means that tomcat got it, and I see no other way than from Apache and through that "tomcatAuthentication=false" option of the tomcat AJP connector. And that in turn

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi, When I configure the OAM protection, they have the ability to configure values that go into HTTP headers (among other things) upon successful authentication (to OAM). I usually test this by protecting /cgi-bin/printenv on the Apache. printenv has this : ## ## printenv -- demo CGI progra

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread tomcat/perl
On 15.05.2020 14:42, ohaya wrote: Hi, Yes, I am using Oracle Access Manager (OAM) so we have what they call an "OAM webgate" that is integrated with the Apache. That webgate automatically populates an HTTP header named "remote_user" with the user that OAM authenticated. So the problem I hav

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jim, On 5/15/20 08:42, ohaya wrote: > Yes, I am using Oracle Access Manager (OAM) so we have what they > call an "OAM webgate" that is integrated with the Apache. That > webgate automatically populates an HTTP header named "remote_user" > with the u

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi, Yes, I am using Oracle Access Manager (OAM) so we have what they call an "OAM webgate" that is integrated with the Apache. That webgate automatically populates an HTTP header named "remote_user" with the user that OAM authenticated. So the problem I having is trying to figure out how to "

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread tomcat/perl
Let me give my 5 cent. In the tomcat AJP Connector Tomcat, you use the tomcatAuthentication attribute : This setting has the effect that tomcat will "believe" the authenticated user-id that Apache is passing to it in the AJP protocol messages that Apache sends to tomcat, and not try to re-au

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi Olaf, Thanks. I do appreciate that! I will do more digging. Jim On Friday, May 15, 2020, 07:41:50 AM EDT, Olaf Kock wrote: On 15.05.20 13:23, ohaya wrote: >  Hi, > > I just tried adding the secret to the Apache side: > > ProxyPass ajp://192.168.218.XXX:8009 secret="123" > Proxy

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread Olaf Kock
On 15.05.20 13:23, ohaya wrote: > Hi, > > I just tried adding the secret to the Apache side: > > ProxyPass ajp://192.168.218.XXX:8009 secret="123" > ProxyPassReverse ajp://192.168.218.XXX:8009 secret="123" > > and I get an error when I try to start Apache: > > AH00526: Syntax error on line 554 o

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi, I just tried adding the secret to the Apache side: ProxyPass ajp://192.168.218.XXX:8009 secret="123" ProxyPassReverse ajp://192.168.218.XXX:8009 secret="123" and I get an error when I try to start Apache: AH00526: Syntax error on line 554 of /apps/oracle/apache/conf/httpd.conf: ProxyPass u

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi, The Tomcat version I am using is 9.0.20. I will take a look at the changelog. This is the first time I have tried this, and I couldn't find much info, so I appreciate the feedback. I will look for info about "secret". I wasn't sure about the format on the Apache side for the ProxyPass/P

Re: Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread Olaf Kock
On 15.05.20 09:06, oh...@yahoo.com.INVALID wrote: > Hi, > > I am using an Apache proxy in front of Tomcat 9, and I am using AJP > connection to connect from the Apache to Tomcat, and I have the Apache > sending a username to the Tomcat in a REMOTE_USER header. > > In the Tomcat server.xml I hav

Does Tomcat 9 still support AJP connections, REMOTE_USER, and tomcatAuthentication="false"?

2020-05-15 Thread ohaya
Hi, I am using an Apache proxy in front of Tomcat 9, and I am using AJP connection to connect from the Apache to Tomcat, and I have the Apache sending a username to the Tomcat in a REMOTE_USER header. In the Tomcat server.xml I have: In the Apache httpd.conf, to test, this I have: ProxyPa