Adding to my own previous post :

A posteriori, I saw a question here :
that may be related to your question on this list.
Examining the above, you problem may be in the httpd configuration :
As I interpret it, the <Directory> section that you mention, will not be taken into account for the URLs that you are proxying to tomcat. That is because <Directory> sections only apply if the URL ultimately maps to a local file for httpd. In this case, it does not, because you are proxying this request to tomcat. For such URLs, you should use a <Location> or <LocationMatch> in httpd, not a <Directory>.
For example, *add* this to your httpd configuration :
<LocationMatch /servlet.*>
    DirectoryIndex off
    RewriteEngine Off
    AuthType openid-connect
    AllowOverride None
    AuthzDBDQuery "a correct database query"
    Require dbd-group allrepo
    LogLevel debug

Note: the above is very rough, and you may need to tune the regex a bit better.

On 08.10.2019 00:11, André Warnier (tomcat) wrote:
On 07.10.2019 23:24, Magosányi Árpád wrote:
On 10/7/19 8:20 PM, André Warnier (tomcat) wrote:

Forgot the atribute 'tomcatAuthentication="false"' in the Connector ?

Yes, I did, however adding it back did not improve the situation.

Ok. I just mentioned that, because it is one piece of the puzzle, and you might 
forgotten it.
What this piece really does is :
- IF the front-end Apache httpd authenticates the HTTP request which it later 
passes on to
- IF the protocol used between Apache httpd and tomcat is AJP
- IF the AJP Connector in tomcat has the attribute set as above
- THEN tomcat will retrieve the user-id of the httpd-authenticated user, and 
save it
internally as the tomcat-authenticated user-id for this request

So now you have the two last IF's answered positively.
What about the first IF ?

Info : in the default format of the Apache httpd access log, it will show the
authenticated user (if any) for each request, for example like this : - THEUSER [07/Oct/2019:21:18:20 +0200] "GET 
(where "THEUSER" is the httpd-authenticated user)

while if the request is not authenticated by httpd, it will show a "-" instead 
of the
user-id, like this : - - [07/Oct/2019:21:18:20 +0200] "GET /starwebtt-internal/esearch...

(and, of course, if httpd has not authenticated the request which it later 
passes on to
tomcat via AJP, then it cannot pass a user-id to tomcat, and thus tomcat cannot 
this user-id, and thus the request, at the tomcat level, is not authenticated).

Next comes the question of how the tomcat application retrieves this user-id, 
from tomcat
itself. I suppose that this would be a question for the developers of the
"com.kodekonveyor.realm.KKAuthorizationFilter" filter mentioned in your 
configuration below.
(if the KKAuthorizationFilter does not use request.getRemoteuser(), but uses 
some other
method, then you are out of luck for this front-end/back-end combination)(or 
you may need
to do something additional at the front-end httpd level).

My server.xml now:

<?xml version="1.0" encoding="UTF-8"?>
<Server port="-1" shutdown="SHUTDOWN">
   <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
   <Listener className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

     <Resource name="UserDatabase" auth="Container"
               description="User database that can be updated and saved"
               pathname="conf/tomcat-users.xml" />

   <Service name="Catalina">

     <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"

     <Engine name="Catalina" defaultHost="localhost">

       <Realm className="org.apache.catalina.realm.LockOutRealm">
         <Realm className="org.apache.catalina.realm.UserDatabaseRealm"

       <Host name="localhost"  appBase="webapps"
             unpackWARs="true" autoDeploy="true">

         <Valve className="org.apache.catalina.valves.AccessLogValve"
                prefix="localhost_access_log" suffix=".txt"
                pattern="%h %l %u %t &quot;%r&quot; %s %b" />


and my web.xml until mime mappings:

<web-app xmlns="";










To unsubscribe, e-mail:
For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

Reply via email to