date:20090824

Running tomcat as limited user (MS Windows)

2009-08-24 Thread Gary

I must have had this problem before but can't remember how I solved it.

I normally run as a limited user. I installed tomcat okay (simply
switching to an administrator account to do so) but trying to start
the server results in

 java.util.logging.ErrorManager: 4
 java.io.FileNotFoundException:
C:\Programme\Develop\CC_EnterpriseClient\server\t
 omcat\logs\catalina.2009-08-23.log (Zugriff verweigert)
 at java.io.FileOutputStream.openAppend(Native Method)
 at java.io.FileOutputStream.init(Unknown Source)
 at java.io.FileOutputStream.init(Unknown Source)
 at java.io.FileWriter.init(Unknown Source)
 at org.apache.juli.FileHandler.open(FileHandler.java:259)
 at org.apache.juli.FileHandler.init(FileHandler.java:59)
 at org.apache.juli.FileHandler.init(FileHandler.java:50

Basically, the user I am logged in as does not have permission to
write to the logs directory, and I would assume the same problem will
occur with the webapps directory when I try to deploy what I am
developing.

Any ideas how to solve this?

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running tomcat as limited user (MS Windows)

2009-08-24 Thread Peter Crowther

2009/8/24 Gary workinginb...@gmail.com

 I normally run as a limited user.


i.e. non-Administrator?


   java.io.FileNotFoundException:
 C:\Programme\Develop\CC_EnterpriseClient\server\t
  omcat\logs\catalina.2009-08-23.log (Zugriff verweigert)
 at java.io.FileOutputStream.openAppend(Native Method)
 at java.io.FileOutputStream.init(Unknown Source)
 at java.io.FileOutputStream.init(Unknown Source)
 at java.io.FileWriter.init(Unknown Source)
 at org.apache.juli.FileHandler.open(FileHandler.java:259)
 at org.apache.juli.FileHandler.init(FileHandler.java:59)
 at org.apache.juli.FileHandler.init(FileHandler.java:50

 Basically, the user I am logged in as does not have permission to
 write to the logs directory, and I would assume the same problem will
 occur with the webapps directory when I try to deploy what I am
 developing.

 Any ideas how to solve this?


Add write permission on those directories for the account under which you're
running Tomcat?

- Peter

RE: Connector set up

2009-08-24 Thread Gerardo Corro


Hi,

I need the intercept the calls (/*) to all webapps since these are actually wap 
apps; many handsets cannot process properly the 302 redirect code, so I need to 
deliver the final result of forward redirects to clients.

I'm already able to process all follow redirects, I just need to put the proxy 
in front of the web-apps.

I cannot add Apache either, all I can do is to fix it from Tomcat

Thanks a lot.






 Date: Sun, 23 Aug 2009 23:45:58 +0200
 From: a...@ice-sa.com
 To: users@tomcat.apache.org
 Subject: Re: Connector set up
 
 Gerardo Corro wrote:
  Hi,
  
  The purpose is to set-up an independent web-app as a proxy for other 
  webapps. I cannot touch the 6 original webapps, but I can do whatever I 
  want with the proxy one.
  
  How can I get all requests to any of these webapps be intercepted by the 
  proxy one?
  
 There may be a way to do that, but it sounds quite complicated, and we 
 do not understand your purpose in wanting to do that.
 Maybe if you explained exactly /why/ (*) you want to intercept the calls 
 to those webapps, someone may be able to help.
 
 (*) meaning : to do what before you forward the call ?
 If it is just to change the URL, then again, look at the urlrewrite 
 filter.  Or use an Apache httpd in front of your Tomcat, with 
 mod_rewrite and (mod_proxy or mod_jk).
 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 

_
Share your memories online with anyone you want.
http://www.microsoft.com/middleeast/windows/windowslive/products/photos-share.aspx?tab=1

Re: Running tomcat as limited user (MS Windows)

2009-08-24 Thread Gary

On 24/08/2009, Peter Crowther peter.crowt...@melandra.com wrote:
 2009/8/24 Gary workinginb...@gmail.com

 I normally run as a limited user.


 i.e. non-Administrator?

Yes, exactly.

[...]
 Basically, the user I am logged in as does not have permission to
 write to the logs directory, and I would assume the same problem will
 occur with the webapps directory when I try to deploy what I am
 developing.

 Any ideas how to solve this?


 Add write permission on those directories for the account under which you're
 running Tomcat?

Is that even possible on Windows?

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running tomcat as limited user (MS Windows)

2009-08-24 Thread Gary

On 24/08/2009, Gary workinginb...@gmail.com wrote:
 On 24/08/2009, Peter Crowther peter.crowt...@melandra.com wrote:
 2009/8/24 Gary workinginb...@gmail.com

 I normally run as a limited user.


 i.e. non-Administrator?

 Yes, exactly.
[...]
 Add write permission on those directories for the account under which
 you're
 running Tomcat?

 Is that even possible on Windows?

Ah... Yes. After quite a bit of f..iddling about, I see it is. That
works fine. Thanks, Peter.

Clue for anyone else who comes across this: you have to switch off
file sharing to be able to even see the place you need to make the
changes - http://support.microsoft.com/kb/308419. FFS, MS...

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running tomcat as limited user (MS Windows)

2009-08-24 Thread Peter Crowther

2009/8/24 Gary workinginb...@gmail.com

 Clue for anyone else who comes across this: you have to switch off
 file sharing to be able to even see the place you need to make the
 changes - http://support.microsoft.com/kb/308419. FFS, MS...


Ah - you hadn't said Windows XP, so I'd assumed a server-class OS!  Yes, XP
comes with brain-damaged simple file sharing turned on by default, which
both hides and breaks the normal Windows file permissions model.

Glad you found it.

- Peter

Re: Updating Roles for a logged-in user while using SingleSignOn

2009-08-24 Thread Pid


On 23/08/2009 22:22, nkrasnov wrote:


Thank you very much for your response.

Yes, I did want to dynamically update the roles.  The reason I was hoping to
do it without making the user re-enter the credentials is because due to
some peculiarities of the application this may happen quite often (several
times within a user's session), and is likely to get annoying.


Really?!  Is a role really the appropriate thing for whatever your 
problem is then?



I hear you about tinkering with the insides of Tomcat, though...  I was
hoping that I was missing something and there was a way to do it without
overwriting SSO valve's behavior.  There is no way to force
re-authentication but make SSO use the cached credentials to re-authenticate
and create a new GenericPrincipal object, is there?


There isn't any way in the current Servlet Spec to do what you ask.
The next version includes programmatic authentication, I think, but 
there's no containers out there supporting it yet.


Investigate how the FormAuthenticator works in concert with the Realm 
and you may find a way to do what you need.


You might investigate whether the following can provide you with better 
functionality:


 http://securityfilter.sourceforge.net/


p



Pid-6 wrote:


On 21/08/2009 19:31, nkrasnov wrote:


Hi,

I have several Tomcat webapps which use SSO and the same Realm for
authentication. All is working as expected, except that I now need to
update
roles for the user that's already been authenticated in the past. I seem
to
be able to do it successfully for a given request (by calling
LoginContect.login and switching the principals in the subject), but for
all
subsequent requests isUserInRole returns false for new roles. The way I
understand it, this is happening because a GenericPrincipal object, which
JAASRealm created in the initial authenticate call, holds a copy of the
original role list, and so on all subsequent calls SSO valve puts that
GenericPrincipal into request and its getRoles, which is called by
isUserInRole, accordingly, always returns the original list of roles. Is
there any way for me to get around this? I don't seem to have any ability
to
update the roles in this GenericPrincipal object once it's put into SSO
cache... Or, if there is no way to update the roles, can I force
re-authentication without making the user re-enter userid/password (we do
have those stored in SSO cache, I believe)?


So you want to dynamically update the user roles?
Is there a reason why you can't get the user to log out and back in?

I'd guess that the effort of sending a message to the user suggesting
that they log out, will be less than tinkering with the insides of
Tomcat - things that could change with each release.

Or you could use a servlet Filter to monitor a flag set in the session,
which then forces the session to invalidate  log the user out.

p


Any help would be greatly appreciated.

Thank you very much for your time,
Natasha



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org








-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: wrong jspInit handling

2009-08-24 Thread Mark Thomas

Stefano Nichele wrote:
 Am I missing something ?

Yes (well your question is anyway). Most importantly: the Tomcat version you are
using. Less important but usually worth mentioning: the JDK and OS you are 
using.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Connector set up

2009-08-24 Thread Pid


On 24/08/2009 08:03, Gerardo Corro wrote:


Hi,

I need the intercept the calls (/*) to all webapps since these are actually wap 
apps; many handsets cannot process properly the 302 redirect code, so I need to 
deliver the final result of forward redirects to clients.

I'm already able to process all follow redirects, I just need to put the proxy 
in front of the web-apps.


If you can alter the webapps at a little, e.g. by adding a Servlet 
Filter, you could intercept and process the calls to each webapp.


Otherwise you'd need to run a separate Tomcat and place it in front of 
the other Tomcats so it can intercept the calls.


 http://tomcatproxy/   --   http://appserver1:8080/webapp1

p


I cannot add Apache either, all I can do is to fix it from Tomcat

Thanks a lot.







Date: Sun, 23 Aug 2009 23:45:58 +0200
From: a...@ice-sa.com
To: users@tomcat.apache.org
Subject: Re: Connector set up

Gerardo Corro wrote:

Hi,

The purpose is to set-up an independent web-app as a proxy for other webapps. I 
cannot touch the 6 original webapps, but I can do whatever I want with the 
proxy one.

How can I get all requests to any of these webapps be intercepted by the proxy 
one?


There may be a way to do that, but it sounds quite complicated, and we
do not understand your purpose in wanting to do that.
Maybe if you explained exactly /why/ (*) you want to intercept the calls
to those webapps, someone may be able to help.

(*) meaning : to do what before you forward the call ?
If it is just to change the URL, then again, look at the urlrewrite
filter.  Or use an Apache httpd in front of your Tomcat, with
mod_rewrite and (mod_proxy or mod_jk).


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



_
Share your memories online with anyone you want.
http://www.microsoft.com/middleeast/windows/windowslive/products/photos-share.aspx?tab=1



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: wrong jspInit handling

2009-08-24 Thread Stefano Nichele


You are right, sorry.
Apache Tomcat 6.0.13
jdk1.6.0_10
Windows XP SP3

but I was able to reproduce it with:
Apache Tomcat 6.0.13
jdk1.6.0_07
CentOS release 5.2

Cheers,
ste


Mark Thomas wrote:

Stefano Nichele wrote:
  

Am I missing something ?



Yes (well your question is anyway). Most importantly: the Tomcat version you are
using. Less important but usually worth mentioning: the JDK and OS you are 
using.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


  




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running tomcat as limited user (MS Windows)

2009-08-24 Thread Serge Fonville

 Clue for anyone else who comes across this: you have to switch off
 file sharing to be able to even see the place you need to make the
 changes - http://support.microsoft.com/kb/308419. FFS, MS...


 Ah - you hadn't said Windows XP, so I'd assumed a server-class OS!  Yes, XP
 comes with brain-damaged simple file sharing turned on by default, which
 both hides and breaks the normal Windows file permissions model.

If your not running professional but home edition.
You will probably need cacls and net to perform the required operations.
cacls to change permissions and net to alter groups and users.
To take ownership, this can only easily be done through the gui (the
security tab and click away...windows style ;-))

HTH

Regards,

Serge Fonville

On Mon, Aug 24, 2009 at 9:34 AM, Peter
Crowtherpeter.crowt...@melandra.com wrote:
 2009/8/24 Gary workinginb...@gmail.com

 Clue for anyone else who comes across this: you have to switch off
 file sharing to be able to even see the place you need to make the
 changes - http://support.microsoft.com/kb/308419. FFS, MS...


 Ah - you hadn't said Windows XP, so I'd assumed a server-class OS!  Yes, XP
 comes with brain-damaged simple file sharing turned on by default, which
 both hides and breaks the normal Windows file permissions model.

 Glad you found it.

 - Peter


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Connector set up

2009-08-24 Thread Martin Gainty


which method does the request use?

HTTP 302
method: GET
method: HEAD
The temporary URI SHOULD be given by the Location field in the
   response. Unless the request method was HEAD, the entity of the
   response SHOULD contain a short hypertext note with a hyperlink to
   the new URI(s).


method:PUT
method:POST
If the 302 status code is received in response to a request other
   than GET or HEAD, the user agent MUST NOT automatically redirect the
   request unless it can be confirmed by the user, since this might
   change the conditions under which the request was issued.


http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
Martin Gainty 
__ 
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité
 
Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger 
sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung 
oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem 
Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. 
Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung 
fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le 
destinataire prévu, nous te demandons avec bonté que pour satisfaire informez 
l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est 
interdite. Ce message sert à l'information seulement et n'aura pas n'importe 
quel effet légalement obligatoire. Étant donné que les email peuvent facilement 
être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité 
pour le contenu fourni.




 From: rob_gar_...@hotmail.com
 To: users@tomcat.apache.org
 Subject: RE: Connector set up
 Date: Mon, 24 Aug 2009 02:03:08 -0500
 
 
 Hi,
 
 I need the intercept the calls (/*) to all webapps since these are actually 
 wap apps; many handsets cannot process properly the 302 redirect code, so I 
 need to deliver the final result of forward redirects to clients.
 
 I'm already able to process all follow redirects, I just need to put the 
 proxy in front of the web-apps.
 
 I cannot add Apache either, all I can do is to fix it from Tomcat
 
 Thanks a lot.
 
 
 
 
 
 
  Date: Sun, 23 Aug 2009 23:45:58 +0200
  From: a...@ice-sa.com
  To: users@tomcat.apache.org
  Subject: Re: Connector set up
  
  Gerardo Corro wrote:
   Hi,
   
   The purpose is to set-up an independent web-app as a proxy for other 
   webapps. I cannot touch the 6 original webapps, but I can do whatever I 
   want with the proxy one.
   
   How can I get all requests to any of these webapps be intercepted by the 
   proxy one?
   
  There may be a way to do that, but it sounds quite complicated, and we 
  do not understand your purpose in wanting to do that.
  Maybe if you explained exactly /why/ (*) you want to intercept the calls 
  to those webapps, someone may be able to help.
  
  (*) meaning : to do what before you forward the call ?
  If it is just to change the URL, then again, look at the urlrewrite 
  filter.  Or use an Apache httpd in front of your Tomcat, with 
  mod_rewrite and (mod_proxy or mod_jk).
  
  
  -
  To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
  For additional commands, e-mail: users-h...@tomcat.apache.org
  
 
 _
 Share your memories online with anyone you want.
 http://www.microsoft.com/middleeast/windows/windowslive/products/photos-share.aspx?tab=1

_
With Windows Live, you can organize, edit, and share your photos.
http://www.windowslive.com/Desktop/PhotoGallery

Re: Updating Roles for a logged-in user while using SingleSignOn

2009-08-24 Thread nkrasnov

Pid-6 wrote:

Really?! Is a role really the appropriate thing for whatever your
problem is then?

This is what I am trying to decide. If it was possible to update roles,
then role would be the appropriate thing, as it would allow me not to have
to implement my own resource/servlet hiding. If what you are saying is
that role set is something that by definition shouldn't change within a
session and therefore this functionality should not be supported, then it
probably isn't.

There isn't any way in the current Servlet Spec to do what you ask.
The next version includes programmatic authentication, I think, but
there's no containers out there supporting it yet.

Investigate how the FormAuthenticator works in concert with the Realm
and you may find a way to do what you need.

You might investigate whether the following can provide you with better
functionality:

http://securityfilter.sourceforge.net/

Thanks a lot for the reference. I'll investigate using security filter.

Pid-6 wrote:

On 21/08/2009 19:31, nkrasnov wrote:

Hi,

I have several Tomcat webapps which use SSO and the same Realm for
authentication. All is working as expected, except that I now need to
update
roles for the user that's already been authenticated in the past. I
seem
to
be able to do it successfully for a given request (by calling
LoginContect.login and switching the principals in the subject), but
for
all
subsequent requests isUserInRole returns false for new roles. The way I
understand it, this is happening because a GenericPrincipal object,
which
JAASRealm created in the initial authenticate call, holds a copy of the
original role list, and so on all subsequent calls SSO valve puts that
GenericPrincipal into request and its getRoles, which is called by
isUserInRole, accordingly, always returns the original list of roles.
Is
there any way for me to get around this? I don't seem to have any
ability
to
update the roles in this GenericPrincipal object once it's put into SSO
cache... Or, if there is no way to update the roles, can I force
re-authentication without making the user re-enter userid/password (we
do
have those stored in SSO cache, I believe)?

So you want to dynamically update the user roles?
Is there a reason why you can't get the user to log out and back in?

I'd guess that the effort of sending a message to the user suggesting
that they log out, will be less than tinkering with the insides of
Tomcat - things that could change with each release.

Or you could use a servlet Filter to monitor a flag set in the session,
which then forces the session to invalidate log the user out.

Any help would be greatly appreciated.

Thank you very much for your time,
Natasha

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

--
View this message in context:
http://www.nabble.com/Updating-Roles-for-a-logged-in-user-while-using-SingleSignOn-tp25085139p25116530.html
Sent from the Tomcat - User mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

51 matches

Mail list logo