Re: Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-09-14 Thread Pratik Shrestha
Hi Guys, Just wanted to know if anyone found an idea on fixing it or a workaround. Thanks Pratik. On Fri, Aug 28, 2020 at 10:46 AM Pratik Shrestha wrote: > Hi Chris > > > > > *This wasn't the case for httpd for many years. I don't know what itdoes > these days, but it used to reply with a nic

Re: Unable to get http redirect to https on Apache Tomcat 8.5.57

2020-09-14 Thread Mark Thomas
On 14/09/2020 20:22, Lee Jarvis wrote: > Hi all, >   > I’m trying to implement SSL and have defined a connector on ports 8080 and > 8443. I can connect to either port, but I want any incoming HTTP on 8080 to > be redirected to the HTTPS port on 8443, but that’s not happening as I have > things c

Unable to get http redirect to https on Apache Tomcat 8.5.57

2020-09-14 Thread Lee Jarvis
Hi all,   I’m trying to implement SSL and have defined a connector on ports 8080 and 8443. I can connect to either port, but I want any incoming HTTP on 8080 to be redirected to the HTTPS port on 8443, but that’s not happening as I have things configured below. What am I missing?         Thank

Unable to get http redirect to https on Apache Tomcat 8.5.57

2020-09-14 Thread Lee Jarvis
Hi all,   I’m trying to implement SSL and have defined a connector on ports 8080 and 8443. I can connect to either port, but I want any incoming HTTP on 8080 to be redirected to the HTTPS port on 8443, but that’s not happening as I have things configured below. What am I missing?         Thank

[OT] RE: How to get the tag name from within a taglib class ?

2020-09-14 Thread Berneburg, Cris J. - US
Hey Chris CS> IMO, the JSP effort was a stepping-stone on a path to better CS> technologies like Velocity, FreeMarker, and others. If I were CS> king, JSP would just go away. Just my POV of course, you are CS> welcome to fall in love with JSP. :) Seeing as I am ever on the trailing edge of learni

RE: How to get the tag name from within a taglib class ?

2020-09-14 Thread Berneburg, Cris J. - US
Rony RF> If possible I would like to write a single tagclass, but use it RF> for two or more different tags, as the implementation would share RF> quite a lot of code. Besides, it might be helpful for debugging. CS> Feel free to build a base class with the shared code and then implement CS> the d

Re: Handling Upgrades

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Darryl, On 9/14/20 12:44, Darryl Philip Baker wrote: > Until recently most of our Tomcat installations were using the Red > Hat distributed version. A version of Tomcat7 with Red Hat > backporting security and important break fixes. Red Hat has move

Re: Any update on 9.0.38 release plan

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 9/14/20 12:21, Mark Thomas wrote: > On 14/09/2020 16:57, Christopher Schultz wrote: >> Arshiya, >> >> On 9/14/20 10:54, Arshiya Shariff wrote: >>> Can we please get a tentative release date for 9.0.38 . >> >> The vote was started on 2020-09

Re: Re: Replacing the standard JspWriter

2020-09-14 Thread Adam Rauch
On 9/12/2020 2:15 AM, Mark Thomas wrote: On 12/09/2020 00:30, Adam Rauch wrote: I have implemented a custom JspWriter and registered it for use by our JSPs using the approach described here: https://stackoverflow.com/questions/29508245/jsp-using-a-delegate-for-out-jspwriter-with-jsp-includes-to-

Re: Handling Upgrades

2020-09-14 Thread Mark Thomas
On 14/09/2020 17:44, Darryl Philip Baker wrote: > Until recently most of our Tomcat installations were using the Red Hat > distributed version. A version of Tomcat7 with Red Hat backporting security > and important break fixes. Red Hat has moved their redistribution of Tomcat > to another packag

Handling Upgrades

2020-09-14 Thread Darryl Philip Baker
Until recently most of our Tomcat installations were using the Red Hat distributed version. A version of Tomcat7 with Red Hat backporting security and important break fixes. Red Hat has moved their redistribution of Tomcat to another package other than the OS. A package that it has been decided

Re: [OT] Decent OAuth libraries?

2020-09-14 Thread Luis Rodríguez Fernández
Hello Chris, I can suggest you Keycloak [1]. It supports OIDC (extension of OAUTH2) [2], it has adapters for apache tomcat [3] and it is quite easy to start with. I made a little proof of concept protecting the good and old /manager tomcat application using the "Client Credentials Flow". My setup

Re: Any update on 9.0.38 release plan

2020-09-14 Thread Mark Thomas
On 14/09/2020 16:57, Christopher Schultz wrote: > Arshiya, > > On 9/14/20 10:54, Arshiya Shariff wrote: >> Can we please get a tentative release date for 9.0.38 . > > The vote was started on 2020-09-11 and usually stays open for at least > 3 days. There are enough votes for the release-vote to pa

Re: Any update on 9.0.38 release plan

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arshiya, On 9/14/20 10:54, Arshiya Shariff wrote: > Can we please get a tentative release date for 9.0.38 . The vote was started on 2020-09-11 and usually stays open for at least 3 days. There are enough votes for the release-vote to pass and there

RE: Any update on 9.0.38 release plan

2020-09-14 Thread jonmcalexander
Sounds like it could be any day now. Dream * Excel * Explore * Inspire Jon McAlexander Infrastructure Engineer Asst Vice President Middleware Product Engineering Enterprise CIO | Platform Services | Middleware | Infrastructure Solutions 8080 Cobblestone Rd | Urbandale, IA 50322 MAC: F4469-010 T

Any update on 9.0.38 release plan

2020-09-14 Thread Arshiya Shariff
Hi All, Can we please get a tentative release date for 9.0.38 . Thanks and Regards Arshiya Shariff

Re: HTTP2 : PING and GOAWAY sent in the same millisecond

2020-09-14 Thread Mark Thomas
On 13/09/2020 06:19, Arshiya Shariff wrote: > Hi All, > > The KeepAliveTimeout value is configured to the default value of 20 seconds. > So when the connection is idle for 20 seconds, tomcat server(Port:1090) is > sending PING followed by GOAWAY within the same millisecond. The client also > re

Re: AW: Track native memory of a Tomcat application

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Andreas, On 9/14/20 05:03, Döscher, Andreas (ESI) wrote: > Moin, ah! The no-xmx-mistake! If you ommit the memory limitation, > java uses (on server-class machines) as default 1/4 of the > physical memory. (I found this blog entry > https://blog.open

[OT] Decent OAuth libraries?

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, I'm looking at implementing OAuth/OAuth2 on the server for both incoming and outgoing SSO with other systems. It doesn't look like rocket surgery, but I figure: why reinvent the wheel? Has anyone had any experiences in particular they'd like t

Re: Changing the keystore alias of the _default_ SSLHostConfig while running.

2020-09-14 Thread Daniel Skiles
> Did you try it? I've been unable to try it through JConsole or Visual VM. JConsole throws an error indicating that it can't load the remote class, and Visual VM disables the method. It looks like it takes a complex object, and I do not have enough experience with Tomcat, or MBeans in general,

Re: [OT] Replacing the standard JspWriter

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Adam, On 9/11/20 19:30, Adam Rauch wrote: > I have implemented a custom JspWriter and registered it for use by > our JSPs using the approach described here: > https://stackoverflow.com/questions/29508245/jsp-using-a-delegate-for- out-jspwriter-with-

Re: Microsoft Edge (Chromium based) not prompting for logons

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Dave, On 9/11/20 16:29, Dave Ford wrote: > We've set up out Tomcat Manager to use LDAP for authentication - > (note, this is not MS AD, but linux-based LDAP server). The OS our > tomcat servers are running on is Linux and they're not intergrated > w

Re: Changing the keystore alias of the _default_ SSLHostConfig while running.

2020-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Daniel, On 9/11/20 17:06, Daniel Skiles wrote: > I've gotten my _default_ SNI SSLHostConfig working. Thank you for > the help. Excellent. >> Perhaps that method could have a better name, like >> reinitializeSSLHostConfigs. "reload" implies that i

AW: Track native memory of a Tomcat application

2020-09-14 Thread ESI
Moin, ah! The no-xmx-mistake! If you ommit the memory limitation, java uses (on server-class machines) as default 1/4 of the physical memory. (I found this blog entry https://blog.openj9.org/2020/04/30/default-java-maximum-heap-size-is-changed-for-java-8/) Ciao, Andreas -Ursprüngliche Na

RE: Track native memory of a Tomcat application

2020-09-14 Thread Arshiya Shariff
Hi All, Thank you for the response Christopher . * A single request, or a single *type* of request? A single request (http/https) that is hit once per day * Does it increase as the request is processed, or does the JVM take that 4GiB immediately upon startup? The tomcat process