Enabling ssl in tomcat JSSE / APR
Hi all I was trying to enable ssl in my tomcat server. I dont know whether my tomcat is using JSSE or APR. but as I created a keystore and imported a cert into it , can I use JSSE type irrespective of the connector? My server.xml block Thanks - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Authentication without Authorization ( JNDI Realm )
Hi The following is the Realm configuration being used: ldap://ldapprime.pesgrid.wipro.com:389"; userBase="dc=wipro,dc=com" userSubtree="true" userSearch="(mail={0})" roleBase="dc=wipro,dc=com" roleSubtree="true" roleName="objectClass" roleSearch="(mail={0})"/> The following is the security constraint specified in web.xml /* * BASIC inetOrgPerson The following is an entry added to LDAP for testing: dn: uid=ccpadmin, dc=wipro,dc=com mail: ccpad...@wipro.com uid: ccpadmin userPassword:: YWRtaW4xMjM= objectClass: inetOrgPerson givenName: Cloud sn: Administrator cid: cloud cn: Cloud Administrator I am able to authenticate but authorization seems to fail ( error 403 forbidden ) Regards Shashank On Wed, 2009-12-02 at 19:16 -0800, Robert Koberg wrote: > On Dec 2, 2009, at 6:01 PM, Christopher Schultz wrote: > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA1 > > > > Chuck, > > > > On 12/2/2009 5:15 PM, Caldarale, Charles R wrote: > >>> From: Christopher Schultz [mailto:ch...@christopherschultz.net] > >>> Subject: Re: Authentication without Authorization ( JNDI Realm ) > >>> > >>> Technically speaking, this will require authentication but then let > >>> anyone holding any role defined in web.xml to access any page on your > >>> site. > >> > >> But the valid roles still have to be listed in web.xml to be compliant > >> with the spec. > > > > Yes. That's why I said "technically" and "practically". > > > >>> Practically speaking, you don't even need to define the roles in > >>> web.xml because (last time I checked), Tomcat treats '*' as > >>> "authenticated, regardless of roles". > >> > >> That was a bug, now fixed: > >> http://marc.info/?l=tomcat-user&m=123568422715010&w=2 > > > > I'll have to look elsewhere in the code, then. What I saw in > > GenericPrincipal clearly takes, ahem, liberties with the spec. > > (don't know if this has been mentioned) > > There is the @PermitAll (and @DenyAll, @RolesAllowed) annotations. It > requires a servlet 3.0 container or some framework that allows it (I like > Jersey). > > best, > -Rob > > > - > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > For additional commands, e-mail: users-h...@tomcat.apache.org > Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Authentication without Authorization ( JNDI Realm ) - Resolved
Hi had to use roleSearch="(mail={1})" instead of roleSearch="(mail={0})" {0} takes the user dn where as {1} takes the username. Regards Shashank. On Fri, 2009-12-04 at 16:04 +0530, Shashank Rachamalla wrote: > Hi > > The following is the Realm configuration being used: > > connectionName="cn=Manager,dc=wipro,dc=com" > connectionPassword="secret" > connectionURL="ldap://ldapprime.pesgrid.wipro.com:389"; > userBase="dc=wipro,dc=com" > userSubtree="true" > userSearch="(mail={0})" > roleBase="dc=wipro,dc=com" > roleSubtree="true" > roleName="objectClass" > roleSearch="(mail={0})"/> > > The following is the security constraint specified in web.xml > > > > /* > > > * > > > > > BASIC > > > > inetOrgPerson > > > > The following is an entry added to LDAP for testing: > > dn: uid=ccpadmin, dc=wipro,dc=com > mail: ccpad...@wipro.com > uid: ccpadmin > userPassword:: YWRtaW4xMjM= > objectClass: inetOrgPerson > givenName: Cloud > sn: Administrator > cid: cloud > cn: Cloud Administrator > > > I am able to authenticate but authorization seems to fail ( error 403 > forbidden ) > > Regards > Shashank > > > On Wed, 2009-12-02 at 19:16 -0800, Robert Koberg wrote: > > On Dec 2, 2009, at 6:01 PM, Christopher Schultz wrote: > > > > > -BEGIN PGP SIGNED MESSAGE- > > > Hash: SHA1 > > > > > > Chuck, > > > > > > On 12/2/2009 5:15 PM, Caldarale, Charles R wrote: > > >>> From: Christopher Schultz [mailto:ch...@christopherschultz.net] > > >>> Subject: Re: Authentication without Authorization ( JNDI Realm ) > > >>> > > >>> Technically speaking, this will require authentication but then let > > >>> anyone holding any role defined in web.xml to access any page on your > > >>> site. > > >> > > >> But the valid roles still have to be listed in web.xml to be compliant > > >> with the spec. > > > > > > Yes. That's why I said "technically" and "practically". > > > > > >>> Practically speaking, you don't even need to define the roles in > > >>> web.xml because (last time I checked), Tomcat treats '*' as > > >>> "authenticated, regardless of roles". > > >> > > >> That was a bug, now fixed: > > >> http://marc.info/?l=tomcat-user&m=123568422715010&w=2 > > > > > > I'll have to look elsewhere in the code, then. What I saw in > > > GenericPrincipal clearly takes, ahem, liberties with the spec. > > > > (don't know if this has been mentioned) > > > > There is the @PermitAll (and @DenyAll, @RolesAllowed) annotations. It > > requires a servlet 3.0 container or some framework that allows it (I like > > Jersey). > > > > best, > > -Rob > > > > > > - > > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > > For additional commands, e-mail: users-h...@tomcat.apache.org > > Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Automatic scaling decisions based on performance metrics
Hi I am currently involved in developing a module which performs automatic scaling of application server instances based on their performance. I am using JMX to pull data pertaining to server and underlying jvm on which the applications are deployed. I can also collect performance data for guest operating system. We are using mod_jk as load balancer. The challenging task here is to decide when to scale out and when to scale in. Please suggest some strategies used to determine the load at a cluster level based on which scaling decisions can be taken. Also can any scaling decisions be taken by considering performance statistics of a single instance in a cluster. The following are parameters currently monitored for each server instance. Guest OS 1) CPU Usage 2) Swap Usage JVM 1) JVM Free Memory App Server ( context is / ) 1) Maximum Request Processing Time. 2) Number of errors processing requests. 3) Number of errors encountered while processing requests. Regards, Shashank Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Automatic scaling decisions based on performance metrics
I have to implement this feature in the organization's private cloud.. will check out Amazon's scale feature before i proceed. Regards, Shashank On Mon, 2010-02-08 at 09:38 -0800, anthonyvie...@gmail.com wrote: > Amazon EC2 has a scale feature that allows scaling based on > configuration of settings such as memory, processor, etc. Is this the > service your configuring? > > On 2/8/10, Pid wrote: > > On 08/02/2010 13:05, Shashank Rachamalla wrote: > >> Hi > >> > >> I am currently involved in developing a module which performs automatic > >> scaling of application server instances based on their performance. I am > >> using JMX to pull data pertaining to server and underlying jvm on which > >> the applications are deployed. I can also collect performance data for > >> guest operating system. We are using mod_jk as load balancer. The > >> challenging task here is to decide when to scale out and when to scale > >> in. Please suggest some strategies used to determine the load at a > >> cluster level based on which scaling decisions can be taken. Also can > >> any scaling decisions be taken by considering performance statistics of > >> a single instance in a cluster. > > > > Excellent! This sounds like a great idea for an open source project. > > Where is it hosted? I might be interested in contributing... > > > > > > p > > > >> The following are parameters currently monitored for each server > >> instance. > >> > >> Guest OS > >> > >> 1) CPU Usage > >> 2) Swap Usage > >> > >> JVM > >> > >> 1) JVM Free Memory > >> > >> App Server ( context is / ) > >> > >> 1) Maximum Request Processing Time. > >> 2) Number of errors processing requests. > >> 3) Number of errors encountered while processing requests. > >> > >> Regards, > >> Shashank > >> > >> > >> Please do not print this email unless it is absolutely necessary. > >> > >> The information contained in this electronic message and any attachments > >> to this message are intended for the exclusive use of the addressee(s) and > >> may contain proprietary, confidential or privileged information. If you > >> are not the intended recipient, you should not disseminate, distribute or > >> copy this e-mail. Please notify the sender immediately and destroy all > >> copies of this message and any attachments. > >> > >> WARNING: Computer viruses can be transmitted via email. The recipient > >> should check this email and any attachments for the presence of viruses. > >> The company accepts no liability for any damage caused by any virus > >> transmitted by this email. > >> > >> www.wipro.com > >> > >> - > >> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > >> For additional commands, e-mail: users-h...@tomcat.apache.org > >> > > > > > > - > > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > > For additional commands, e-mail: users-h...@tomcat.apache.org > > > > > Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Using IP and Auth Constraints together
Hi! Is there any way to configure for a webapp to disable authentication and authorization for a particular IP address and enable it for all other IP addresses. Thanks in advance. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Using IP and Auth Constraints together
I am using JNDI Realm to authenticate with LDAP and after a little bit of exploration i found that a filter is always executed after a realm executes and hence filters will not solve my problem. Will check out Valves now. On Fri, 2009-05-15 at 13:36 +0200, André Warnier wrote: > Shashank Rachamalla wrote: > > Hi! > > Is there any way to configure for a webapp to > > disable authentication and authorization for a particular IP address and > > enable it for all other IP addresses. > > > Probably not, since I doubt that this is foreseen by the Servlet > Specification. > But I can think of a way, subject to confirmation by an expert on this > list : > > You could write a simple servlet filter, which checks the caller's IP > address, and if it matches, sets the user-id in the session to some > pre-determined value. > It is possible that when the authentication code finds out that there is > already a user set, it would just return OK and let the call through. > And for your application code, it would be easier to deal with a case > where there is always a user-id (even if one is a dummy), than have to > deal with some cases where it is not set, no ? > > What I am not quite sure of, is whether a filter runs early enough to > precede the authentication part, or not. > I guess if not, then you would have to implement this as a Valve. > > > > - > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > For additional commands, e-mail: users-h...@tomcat.apache.org > Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Not able to get threadcount and thread busy metrices in Tocat 7.0
Hi , I am facing a problem. We used to monitor tomcat JVM and used to monitor " current ThreadCount " and "current Threadbusy" Recently we upgraded from tomcat 6.0 to tomcat 7.0.16 and we are not able to get these metrices . On digging in we found that in tomcat6.0 the thread pool metrices were retrieved by class "org.apache.tomcat.util.threads.ThreadPool " But in tomcat 7.0 there is no such class instead it is replace by org.apache.tomcat.util.threads.ThreadPoolExecutor which does not give the above parameters. So my question is tomcat 7.0 how can we get the above metrices P.S- > Am new to tomcat so please bear if it is a silly question Regards Shashank
Not able to get threadcount and thread busy metrices in Tomcat 7.0
Hi , I am facing a problem. We used to monitor tomcat JVM and used to monitor " current ThreadCount " and "current Threadbusy" Recently we upgraded from tomcat 6.0 to tomcat 7.0.16 and we are not able to get these metrices . On digging in we found that in tomcat6.0 the thread pool metrices were retrieved by class "org.apache.tomcat.util.threads.ThreadPool " But in tomcat 7.0 there is no such class instead it is replace by org.apache.tomcat.util.threads.ThreadPoolExecutor which does not give the above parameters. So my question is tomcat 7.0 how can we get the above metrices P.S- > Am new to tomcat so please bear if it is a silly question Regards Shashank
RE: Problem
I have run the TC in standlone mode...and it is running .. but when running thru eclipse juno ...it is showing the message - Server Tomcat v7.0 Server at localhost was unable to start within 45 seconds. If the server requires more time, try increasing the timeout in the server editor. i have reinstalled the plugin and increase the start timeout...its makes no change. thanks > From: mgai...@hotmail.com > To: users@tomcat.apache.org > Subject: RE: Problem > Date: Sat, 19 Jan 2013 08:40:09 -0500 > > > what does the TC log say.. > > have you run TC standalone $CATALINA_HOME\bin\catalina start > > if TC runs standalone but not thru eclipse then you have 2 possible problems: > > 1)possible Mis-configured TC eclipse plugin > 2)There is a problem with TC eclipse plugin itself..probably > 2a)possible version mismatch between TC plugin and child dependencies > > 2b)possible resource allocation issue..socket bound..not enough PermGen > space etc pingback with your findings > > Martin__ > Verzicht und Vertraulichkeitanmerkung Diese Nachricht ist vertraulich. > Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir hoeflich um > eine Mitteilung. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist > unzulaessig. Diese Nachricht dient lediglich dem Austausch von Informationen > und entfaltet keine rechtliche Bindungswirkung. Aufgrund der leichten > Manipulierbarkeit von E-Mails koennen wir keine Haftung fuer den Inhalt > uebernehmen. > > From: vinit1...@live.in > > To: users@tomcat.apache.org > > Subject: Problem > > Date: Sat, 19 Jan 2013 13:22:17 +0530 > > > > Hi all,I am having a problem in starting the apache tomcat server version > > 7.0.31 through eclipse.It is showing the message that server taking time to > > start the server,so increase the start time limit,after configuring this i > > am not able to rectify this problem. > > thanks >
How ot monitor hung tomcat/apache processes?
Hi , I am working on a monitoring system to find out hung tomcat/apache processes . By this I mean if the PID exists and still the apache / tomcat is not responding that die to memory leak or variety of other reasons . Is their a tool to find this . Regards Shashank
RE: How ot monitor hung tomcat/apache processes?
Hi Darryl, Yes This is the same problem I am facing. Sorry I am kind of new to it but can you tell me what kind of end to end monitoring should I do ? Regards Shashank -Original Message- From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 5:38 PM To: Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? In my experience, the PID can still exist of tomcat but a Java heap crash has stopped it responding. Checking a PID will not check if the application is responding. You're better to do some sort of end to end monitoring On 22/09/10 10:03 PM, "Mendiratta, Shashank" wrote: Hi , I am working on a monitoring system to find out hung tomcat/apache processes . By this I mean if the PID exists and still the apache / tomcat is not responding that due to memory leak or variety of other reasons . Is their a tool to find this . Regards Shashank - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
RE: How ot monitor hung tomcat/apache processes?
HI Darryl , Thanx , about that here the outbound port 80 is blocked so we cannot wget , moreover this wont solve the problem as to why the the services are getting hung. Well I had an idea, please critic it. Why not monitor the server.log file if we get some kind of error. We send an alert and then restart the service . Befire that we have to make a repository of types of error that can occur Please do comment Regards Shashank From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 5:54 PM To: Mendiratta, Shashank; Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? It depends on the application you are running, but a simple test would be to access the webpage (ensuring part of it is served from Tomcat, not apache) and check for an expected response. For example, a simple jsp page that prints out "ok" You can then do a wget, and check for that string. Cheers. On 22/09/10 10:13 PM, "Mendiratta, Shashank" wrote: Hi Darryl, Yes This is the same problem I am facing. Sorry I am kind of new to it but can you tell me what kind of end to end monitoring should I do ? Regards Shashank -Original Message- From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 5:38 PM To: Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? In my experience, the PID can still exist of tomcat but a Java heap crash has stopped it responding. Checking a PID will not check if the application is responding. You're better to do some sort of end to end monitoring On 22/09/10 10:03 PM, "Mendiratta, Shashank" wrote: Hi , I am working on a monitoring system to find out hung tomcat/apache processes . By this I mean if the PID exists and still the apache / tomcat is not responding that due to memory leak or variety of other reasons . Is their a tool to find this . Regards Shashank
RE: How ot monitor hung tomcat/apache processes?
I get you point . well we are using dynatrace to keep a track on how slow the server is serving pages and for the entire system metrics monitoring we are using monit and both are done externally . The firewall has closed all the outbound ports so wget is not possible. Its just that we have to monitor the JVM so that it does not hang but yes you are right with dynatrace just has a monitoring window and it does not restart the service. So I have to come up with a cript also which how the system is serving pages if its to slow . then to restart the JVM . From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 6:12 PM To: Mendiratta, Shashank; Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? Are you trying to monitor from the same computer that tomcat is running on? That's not a good idea. What happens if the entire system crashes...you won't get any data/alerts. End to end uses another machine to monitor the first. You could monitor catalina.out for errors, but I don't think you'll capture every possibility. What would happen if the system stops serving pages (or serves them slow)? That won't show in the logs. What port is your application running on? You can use (from another machine) wget {servername}:8080. On 22/09/10 10:30 PM, "Mendiratta, Shashank" wrote: HI Darryl , Thanx , about that here the outbound port 80 is blocked so we cannot wget , moreover this wont solve the problem as to why the the services are getting hung. Well I had an idea, please critic it. Why not monitor the server.log file if we get some kind of error. We send an alert and then restart the service . Befire that we have to make a repository of types of error that can occur Please do comment Regards Shashank From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 5:54 PM To: Mendiratta, Shashank; Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? It depends on the application you are running, but a simple test would be to access the webpage (ensuring part of it is served from Tomcat, not apache) and check for an expected response. For example, a simple jsp page that prints out "ok" You can then do a wget, and check for that string. Cheers. On 22/09/10 10:13 PM, "Mendiratta, Shashank" wrote: Hi Darryl, Yes This is the same problem I am facing. Sorry I am kind of new to it but can you tell me what kind of end to end monitoring should I do ? Regards Shashank -Original Message- From: Darryl Lewis [mailto:darryl.le...@unsw.edu.au] Sent: Wednesday, September 22, 2010 5:38 PM To: Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? In my experience, the PID can still exist of tomcat but a Java heap crash has stopped it responding. Checking a PID will not check if the application is responding. You're better to do some sort of end to end monitoring On 22/09/10 10:03 PM, "Mendiratta, Shashank" wrote: Hi , I am working on a monitoring system to find out hung tomcat/apache processes . By this I mean if the PID exists and still the apache / tomcat is not responding that due to memory leak or variety of other reasons . Is their a tool to find this . Regards Shashank
RE: How ot monitor hung tomcat/apache processes?
Hi .. can you share the script ?? -Original Message- From: Pid [mailto:p...@pidster.com] Sent: Wednesday, September 22, 2010 9:52 PM To: Tomcat Users List Subject: Re: How ot monitor hung tomcat/apache processes? On 22/09/2010 13:54, Mendiratta, Shashank wrote: > So I have to come up with a cript also which how the system is serving > pages if its to slow . then to restart the JVM . Really? That sounds, well, a little drastic... p - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Regd: Logging issue in apache tomcat 7.0.42
Hi, I wanted to have logging in tomcat, but currently using juli/java.util.logging i am having a file with date in it (for example catalina.11.12.2013.log) , i am unable to remove date as my additional requirement is that i have to include daily rollover of the file. Alternatively i have tried this using log4j by following the documentation. I was able to get the log working properly if i start my tomcat using startup,sh. But i am starting tomcat from an ant script in the following way which is not at all forming the log. Can i be helped on this. Any help is appreciated. Thanks & Regards, Shashank