Re: Windows Service Security

2012-10-31 Thread Cédric Couralet
Bill, - create a local user, e.g. tomcat - stop Tomcat - use whatever path the Microsoft geniuses have invented this week to reach the Services applet - search for the Apache Tomcat Service - right click on it and select Settings or Properties (ditto) - in the tab Login as (or ditto),

Re: Windows Service Security

2012-10-31 Thread Cédric Couralet
the installer was made so i do not know if it is possible. -- Cédric Couralet

JMX with Listener

2012-12-11 Thread Cédric Couralet
to connect through jmx with the url service:jmx:rmi://localhost:10002/jndi/rmi://localhost:10001/jmxrmi without entering the credentials (nagios:nagios). I thought that by entering com.sun.management.jmxremote.authenticate=true, even read access would be restricted. Thank you for any answers. Cédric

Re: JMX with Listener

2012-12-11 Thread Cédric Couralet
Okay. Now for my problems or questions: - Apparently, the Jmx listener listens on 0.0.0.0 (confirmed by a netstat) on the two ports configured for the listener, is it normal ? I thought that useLocalPorts would restrain the listening only to 127.0.0.1. useLocalePorts /should/ force

Re: JMX with Listener

2012-12-11 Thread Cédric Couralet
Okay. Now for my problems or questions: - Apparently, the Jmx listener listens on 0.0.0.0 (confirmed by a netstat) on the two ports configured for the listener, is it normal ? I thought that useLocalPorts would restrain the listening only to 127.0.0.1. useLocalePorts /should/ force

Re: JMX with Listener

2012-12-17 Thread Cédric Couralet
2012/12/11 André Warnier a...@ice-sa.com: Cédric Couralet wrote: ... One question, though, in the tomcat doc (for 6.0.x) for the JMXRemoteListener, the configuration is : -Dcom.sun.management.jmxremote.password.file=$CATALINA_BASE/conf/jmxremote.password

Re: JMX with Listener

2012-12-17 Thread Cédric Couralet
Where do you /set/ CATALINA_BASE? Hum nowhere. Ok my mistake but i set catalina.base as a jvm options and I would like to reference it in another. As I say it, I don't think java can do it so i may be out of luck.

Re: JMX with Listener

2012-12-17 Thread Cédric Couralet
2012/12/17 André Warnier a...@ice-sa.com: Cédric Couralet wrote: Where do you /set/ CATALINA_BASE? Hum nowhere. Ok my mistake but i set catalina.base as a jvm options and I would like to reference it in another. As I say it, I don't think java can do it so i may be out of luck. [snip

Re: Tomcat 7.0.33 just stops without any errors...

2012-12-20 Thread Cédric Couralet
2012/12/20 Tony Anecito adanec...@yahoo.com: Hi All, I have noticed since switching to Tomcat 7.0.33 64-bit that sometimes it just stops functioning with no errors and no events in windows to give me a reason why. It seems to do it once every couple of weeks. Has anyone experienced that? I

Re: Reporting a revoked certificate

2012-12-21 Thread Cédric Couralet
Thanks Dan - which access log should I look at? all of the tomcat logs don't show anything. I've got it configured with APR TCNATIVE Hello, I'm not sure you could get an error page. The ssl dialog takes place before any http communication. So I don't think tomcat can send an http response

Re: Reporting a revoked certificate

2012-12-21 Thread Cédric Couralet
Hello, I'm not sure you could get an error page. The ssl dialog takes place before any http communication. So I don't think tomcat can send an http response if the certificate is revoked. You could use openssl s_client to try and connect to your server to see what is returned from Tomcat

Re: Question regarding JNDIRealm - tomcat 6.0.35

2013-02-20 Thread Cédric Couralet
2013/2/19 Tanmoy Chatterjee tanmoy.chatter...@nxp.com: Hello, Technical Stack: Apache Tomcat v 6.0.35 OS : RHEL 5.3 64 bits java version 1.6.0_18 32 bits I am using Realm className=org.apache.catalina.realm.JNDIRealm for connecting to LDAP. Is there any configuration to prevent the

Re: Question regarding JNDIRealm - tomcat 6.0.35

2013-02-20 Thread Cédric Couralet
2013/2/20 Tanmoy Chatterjee tanmoy.chatter...@nxp.com: Hello Cédric, The reason I want to do is as follows: I am facing the problem already expressed in https://issues.apache.org/bugzilla/show_bug.cgi?id=33774 I see that the bug status shows as Fixed, however I still get the same Issue on

Re: Tomcat Client Authentication

2013-02-20 Thread Cédric Couralet
2013/2/20 maximilian-schm...@telekom.de: Hello Mark, thank you for the quick answer! Could you explain, how I can change how to derive the user name from the cert? I don't have a DN in my certificate (Only E, CN, OU, O, L, S, C). This would be very great. Hello, The different E, CN,...

Re: Tomcat Client Authentication

2013-02-20 Thread Cédric Couralet
2013/2/20 maximilian-schm...@telekom.de: Hello Cedric, And look at the first line which could be Owner or Subject (I only have a french version at the moment which says Propriétaire:) (I created another Client-Cert) I did it and it shows me: CN=User03, OU=Any, O=Company, L=City,

Re: Question regarding JNDIRealm - tomcat 6.0.35

2013-02-20 Thread Cédric Couralet
2013/2/20 Tanmoy Chatterjee tanmoy.chatter...@nxp.com: Thanks Cédric, I will try this and let you know. Once Ldap closes the connection from it's end, tomcat indeed keeps on trying and finally establishes a new connectionbut the time spent in retrying is too high (more than 4-5 minutes)

Re: Tomcat 6.0.20/Windows 2008 R2/SSL Configuration

2013-03-20 Thread Cédric Couralet
2013/3/20 Harris, Jeffrey E. jeffrey.har...@mantech.com: -Original Message- From: my business mail [mailto:mv.ma...@gmail.com] Sent: Wednesday, March 20, 2013 2:39 PM To: Tomcat Users List Subject: Re: Tomcat 6.0.20/Windows 2008 R2/SSL Configuration I only added the keystore

Re: IWA username using JSP for Already authenticated Window system

2013-03-25 Thread Cédric Couralet
2013/3/25 N.s.Karthik nskarthi...@gmail.com: Hi Hello https://tomcat.apache.org/tomcat-7.0-doc/windows-auth-howto.html I have already tried this and found the same to Work only on Windows Environment but my Tomcat servers are on Oracle Linux Systems... Will this configurations work with

Re: IWA username using JSP for Already authenticated Window system

2013-03-25 Thread Cédric Couralet
One thing to watch for is that the client must use Kerberos and not NTLM (it's a guess but it seems logical) . Sorry to burst in, but can you elaborate on that ? Why does it seem logical ? To my own (admittedly limited) knowledge, Kerberos is not the most widely implemented solution in

Re: Form Authentication

2013-04-18 Thread Cédric Couralet
Hello, Without knowing how are your security-constraint, and where are the css file, I don't think anyone could help you. Did you try as a last measure to force css file to pass through the authentification, something as : security-constraint

Re: SSLAuthenticator question

2013-04-26 Thread Cédric Couralet
Hi, 2013/4/26 Jeffrey Janner jeffrey.jan...@polydyne.com: Ok, I know I've been doing this for awhile and should probably know better, but Since long ago (4.x?), at the guidance of some long-gone developers, I've been adding the following to our app_context.xml file for instances where

Dynamic auth-constraint in web.xml ?

2013-05-03 Thread Cédric Couralet
Hello, More of a servlet spec question than a tomcat one, and, from what I read, a rather long shot, but is there a way to define auth-constraint dynamically in web.xml? For instance I'd like to have the following security-constraint display-name/display-name

Re: Dynamic auth-constraint in web.xml ?

2013-05-03 Thread Cédric Couralet
2013/5/3 Christopher Schultz ch...@christopherschultz.net: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cédric, On 5/3/13 3:09 AM, Cédric Couralet wrote: More of a servlet spec question than a tomcat one, and, from what I read, a rather long shot, but is there a way to define auth

Re: Different behaviour when start inside Eclipse

2013-06-19 Thread Cédric Couralet
2013/6/20 Demetrio Carvalho demetri...@hotmail.com: When I start the Tomcat 7 by invoking startup.sh via gnome-terminal I can reach the administration console while browsing localhost:8080. But when I start the same Tomcat inside the Eclipse although my web application is working properly

Re: JMX monitoring of tomcat service

2013-07-23 Thread Cédric Couralet
2013/7/23 honyk j.tosov...@email.cz: Dear All, I run tomcat as service on Windows Server 2008 R2. I am not able to monitor it locally yet (discussed in another thread) so in the meantime I am trying to establish JMX connection to it acc. to this guide:

Re: tomcat 7 ldap error

2013-08-07 Thread Cédric Couralet
2013/8/7 Christopher Schultz ch...@christopherschultz.net: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Vicky, On 8/6/13 10:46 PM, vicky007aggar...@yahoo.co.in wrote: Hi All, Can somebody pls share the steps requires to setup active directory with tomcat . Is it valid to simply

Re: Deploying war from dependency with tomcat7-maven-plugin

2013-09-09 Thread Cédric Couralet
2013/9/9 Greg Amerson gregory.amer...@liferay.com: Hello all, I'm trying to use the tomcat7-maven-plugin, specifically running the *mvn tomcat7:run* command. However, in my case I have two requirements that are different than the documentation provides for and I'm wondering if it is

Re: Filtering HTTP OPTIONS request method from logs?

2013-09-16 Thread Cédric Couralet
Hi, I'm also interested in a method to filter those OPTIONS. With the same setup, I basically created my own AccessLogValve wich does the filtering, something like : /** * Don't log request when HTTP Method is one of the exclude List */ @Override public void log(Request

Re: Filtering HTTP OPTIONS request method from logs?

2013-09-16 Thread Cédric Couralet
2013/9/16 André Warnier a...@ice-sa.com: Apologies for top posting, just following the trend. OPTIONS are used quite a bit by e.g. DAV clients. Won't you want also to add an IP filter then, to be able to block selectively only the requests from the proxies themselves ? Sorry for the

Re: Apache HTTP + Tomcat + SSL

2013-09-30 Thread Cédric Couralet
Hi, 2013/9/30 André Warnier a...@ice-sa.com: Hi. [...] The question is now : why does that application require HTTPS ? An application usually doesn't care how it is accessed, except if some configuration of the application requires it to get some information from the SSL protocol (like a

Re: Apache HTTP + Tomcat + SSL

2013-09-30 Thread Cédric Couralet
2013/9/30 Christopher Schultz ch...@christopherschultz.net: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cédric, On 9/30/13 10:06 AM, Cédric Couralet wrote: Hi, 2013/9/30 André Warnier a...@ice-sa.com: Hi. [...] The question is now : why does that application require HTTPS

Re: Apache HTTP + Tomcat + SSL

2013-09-30 Thread Cédric Couralet
I said An application *usually* doesn't care how it is accessed. Most applications do not. Some do. But I would argue that this would not be such a good design, because it removes flexibility in the application. It would mean that the application then cannot work in a context where there is

Re: Override logging

2013-10-08 Thread Cédric Couralet
2013/10/8 André Warnier a...@ice-sa.com: Geoff Meakin wrote: I've been asked to host a couple of tomcat thirdparty webapps which all have either logging.properties or log4j configurations (internally). My question is, as a sysadmin who only gets to run the tomcat container, can I override

Re: Help needed with SpnegoAuthenticator authentication

2013-11-16 Thread Cédric Couralet
2013/11/15 chris ch...@ottmountainbike.co.uk: Any help with this would be very much appreciated. We are trying to proof of concept this to return the remote user's domain login name to use it in a Web application. Attempting to use a keytab method to hopefully negate any requirement for

Re: LDPA Authentication Failure

2013-12-13 Thread Cédric Couralet
2013/12/13 Phill Perryman ph...@alstonelane.com: I have set up the following authentication to the ldap server. I can log into this server using the LdapAdmin browser ok. Running 7.0.34 (I think its 34 but I can't bring the server up at the moment) I am getting a stack trace Dec 13, 2013

Re: Tomcat as Windows service under technical user

2014-01-27 Thread Cédric Couralet
2014/1/27 Strobel, Stefan (TS IC) stefan.stro...@hp.com: Hi everybody, I would like to run a Tomcat 7.0.47 as Windows service. But that service shall not be executed as Administrator but as a local technical user. That user is existent, let's call it A. The account is secured with password

Re: SEVERE: Servlet.service() for servlet [action] in context with path [/portal] threw exception

2014-01-29 Thread Cédric Couralet
Hi, 2014/1/30 Randeep randeep...@gmail.com: Hi, I'm getting the following exception. I'm running it in Netbeans IDE. With tomcat 7.50.0 Am I missing some libraries here? Jar files? Developers says its not their code problem its server problem. But i'm not able to get it. Struts core jar

Re: unable to start Tomcat through the Windows Services panel

2014-02-04 Thread Cédric Couralet
2014-02-04 javier_esp...@hna.honda.com: Thank you Mark, but it did not make a difference. Any other idea? Do you have anything in the log directory of your tomcat installation? There should be log for commons-daemon (used to launch the service) and maybe for tomcat.

Re: AJP and attributes versus headers

2014-02-10 Thread Cédric Couralet
2014-02-11 1:20 GMT+01:00 Elliot Kendall elliot.kend...@ucsf.edu: We have a Java application running on Tomcat with an Apache HTTP proxy in front. Our SSO system (Shibboleth) runs as an Apache module and sets an HTTP header with the logged-in username, which gets passed through to Tomcat and

Re: What is the best connector configuration for thousands of mostly idle users?

2014-02-10 Thread Cédric Couralet
2014-02-10 22:34 GMT+01:00 André Warnier a...@ice-sa.com: Jesse Barnum wrote: On Feb 10, 2014, at 11:14 AM, Filip Hanik fi...@hanik.com wrote: Jesse, mostly idle users and you wish to conserve resources. Use the JkOptions +DisableReuse on the mod_jk module. This will close connections

Re: AJP and attributes versus headers

2014-02-11 Thread Cédric Couralet
2014-02-11 10:41 GMT+01:00 André Warnier a...@ice-sa.com: Cédric Couralet wrote: 2014-02-11 1:20 GMT+01:00 Elliot Kendall elliot.kend...@ucsf.edu: We have a Java application running on Tomcat with an Apache HTTP proxy in front. Our SSO system (Shibboleth) runs as an Apache module and sets

Re: Regarding i think an intrusion

2014-05-01 Thread Cédric Couralet
2014-04-30 19:07 GMT+02:00 Christopher Schultz ch...@christopherschultz.net : -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Leonardo, On 4/30/14, 12:48 PM, Leonardo Santagostini wrote: Im uploading mi logfiles so it will be available when finished uploading. Remember to get a thread

Re: ISAPI Redicect - Request Entitiy too large

2014-07-21 Thread Cédric Couralet
2014-07-21 6:42 GMT+02:00 Mikey mikey7...@gmail.com: Alexander Diedler adiedler at tecracer.de writes: Hello at ll, I have installed a new Windows 2008 R2 x64 Server with IIS7 and Tomcat 6.0.32 x64 Edition. We use SSO Authentication from IIS to the Tomcat. Suddenly, we got on some

Re: SAML 2.0 with container managed authentication in Tomcat

2014-09-11 Thread Cédric Couralet
Hello, 2014-09-11 14:26 GMT+02:00 Maarten van Hulsentop maar...@vanhulsentop.nl: Dear Tomcat-users, We are investigating the best way to support SAML 2.0 (SP) authentication with our application. Our application is using container managed authentication provided by Tomcat, and works very

Re: Client authentication for specific path

2014-10-01 Thread Cédric Couralet
2014-10-01 18:16 GMT+02:00 Nathan Quirynen nat...@pensionarchitects.be: On 01/10/14 18:08, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Nathan, On 10/1/14 10:02 AM, Nathan Quirynen wrote: Hi Tomcat users, A current application has client authentication

Re: Client authentication for specific path

2014-10-03 Thread Cédric Couralet
2014-10-03 17:42 GMT+02:00 Nathan Quirynen nat...@pensionarchitects.be: On 02/10/14 19:00, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Nathan, On 10/1/14 12:16 PM, Nathan Quirynen wrote: On 01/10/14 18:08, Christopher Schultz wrote: Nathan, On 10/1/14