Re: making security constraints configureable

2011-11-09 Thread Leon Rosenberg
Hello Terence, the System property would be indeed the easiest way, unfortunately I wouldn't know that the descriptive security in web.xml supports scripting with environment variables. If it does, it would solve all the problems ;-) regards Leon 2011/11/8 Terence M. Bandoian tere...@tmbsw.com:

Re: making security constraints configureable

2011-11-09 Thread Leon Rosenberg
Hello Andre, sorry for the late response. Putting a httpd or lightttpd or nginx in front of our staging tomcat came to our mind too. The problem with this approach is however, that it reduces the idea of having a staging environment to absurdity, at least in technical sense, because its not

Re: making security constraints configureable

2011-11-09 Thread André Warnier
Leon Rosenberg wrote: Hello Andre, sorry for the late response. Putting a httpd or lightttpd or nginx in front of our staging tomcat came to our mind too. The problem with this approach is however, that it reduces the idea of having a staging environment to absurdity, at least in technical

Re: making security constraints configureable

2011-11-09 Thread André Warnier
Leon Rosenberg wrote: Hello Andre, sorry for the late response. Putting a httpd or lightttpd or nginx in front of our staging tomcat came to our mind too. The problem with this approach is however, that it reduces the idea of having a staging environment to absurdity, at least in technical

Re: making security constraints configureable

2011-11-09 Thread chris derham
This thread is quite long, but to sum up what I have understood 1) you have an application running on staging and production 2) you want to enable access to staging for public demos from anywhere on the internet - for this you want to add access controls 3) everyone else will access the

Re: making security constraints configureable

2011-11-08 Thread Terence M. Bandoian
On 1:59 PM, André Warnier wrote: Terence M. Bandoian wrote: On 1:59 PM, Konstantin Kolinko wrote: 2011/11/3 Leon Rosenbergrosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in

Re: making security constraints configureable

2011-11-07 Thread Leon Rosenberg
Hello Konstantin, On Mon, Nov 7, 2011 at 4:30 AM, Konstantin Kolinko knst.koli...@gmail.com wrote: 2011/11/3 Leon Rosenberg rosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in

Re: making security constraints configureable

2011-11-07 Thread André Warnier
Leon Rosenberg wrote: Hello Konstantin, On Mon, Nov 7, 2011 at 4:30 AM, Konstantin Kolinko knst.koli...@gmail.com wrote: 2011/11/3 Leon Rosenberg rosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't

Re: making security constraints configureable

2011-11-07 Thread Daniel Mikusa
Leon, One possible way to work around this would be to use an SSH tunnel or a VPN (like OpenVPN) to access your network from the remote locations. Dan On Sat, 2011-11-05 at 08:53 -0700, Leon Rosenberg wrote: Hello Daniel, I can't use IP-Adresses, because it is possible that we show the

Re: making security constraints configureable

2011-11-07 Thread André Warnier
@Leon : I think I misunderstood your requirement, so disregard my previous response. @Dan : an SSH tunnel for HTTP is a (mild) pain, because of the hostname. To make it work, you need to add an entry to your local hosts file (I assume a laptop), so that it resolves myhost.mycompany.com as

Re: making security constraints configureable

2011-11-07 Thread Terence M. Bandoian
On 1:59 PM, Konstantin Kolinko wrote: 2011/11/3 Leon Rosenbergrosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in staging environment. Put it behind Apache HTTPD (or any other

Re: making security constraints configureable

2011-11-07 Thread André Warnier
Terence M. Bandoian wrote: On 1:59 PM, Konstantin Kolinko wrote: 2011/11/3 Leon Rosenbergrosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in staging environment. Put it behind

Re: making security constraints configureable

2011-11-06 Thread Konstantin Kolinko
2011/11/3 Leon Rosenberg rosenberg.l...@gmail.com: I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in staging environment. Put it behind Apache HTTPD (or any other proxy) and let HTTPD handle

Re: making security constraints configureable

2011-11-05 Thread Leon Rosenberg
Hello Daniel, I can't use IP-Adresses, because it is possible that we show the preproduction system in a starbucks to some customers for user testing purposes. I have no means to know which adresses are allowed and which not. regards Leon On Thu, Nov 3, 2011 at 7:09 PM, Daniel Mikusa

making security constraints configureable

2011-11-03 Thread Leon Rosenberg
Hello, I have a situation where an application is accessable from outside in staging and production environment, but shouldn't be open for public in staging environment. What we did so far was, that we excluded everyone via web.xml: !-- security configuration -- login-config

Re: making security constraints configureable

2011-11-03 Thread Daniel Mikusa
Leon, Is it a requirement for you to use BASIC auth? or could you use something like the Remote Address Filter to restrict by IP address? https://tomcat.apache.org/tomcat-6.0-doc/config/valve.html#Remote_Address_Filter If you configure this valve in the restricted environment you can then