Tomcat (+Cocoon) with SSL

[Robert Arthur]

Sorry for the re-post, but I urgently need this problem remedied!

I have installed Apache+mod_ssl on a Win32 system.  I then installed Tomcat
with mod_jk (recompiled for EAPI), and set it up to start a secure handler
on 8443, using JSSE.   Finally I installed Cocoon (from xml.apache.org), and
set up my page, which involves a simple user logon.

All was well, and I get a secure connection with HTTPS, but I cannot seem to
prevent access to the page under HTTP.   I have tried using SSLRequireSSL in
the  field for Cocoon, along with SSLOptions +StrictRequire.
This works fine with normal (non-tomcat) pages, but has no effect here.

Cocoon is set up to send all .xml files to my ajp13 worker.

Any help would be greatly appreciated.

Bob.

Setting a servlet to be SSL only

[Robert Arthur]

Hi - I am new to all forms of web server configuration, so please bear with
me!

I am using Apache+mod_ssl and tomcat (mod_jk), with Cocoon installed under
tomcat.   I wish to create a username and logon page index.xml with secure
transmission of data to connection.xml.

After much agony, I managed to get to the stage where
https:///Cocoon/Connection/index.xml would give me a secure
connection.   However, http:///Cocoon/Connection/index.xml would
still work to give a non-secure connection.

I added SSLRequireSSL to the  pointing to
$TOMCAT-HOME/webapps/Cocoon, and included SSLOptions +StrictRequire in the
SSL configuration, but to no avail.

Do I need to inform tomcat of the SSL requirement, and if so how?

Many thanks,

Bob.

mod_jk with EAPI problems

[Robert Arthur]

I am using Tomcat with mod_jk in Apache+mod_ssl in 
Win32.   Upon receiving the warning :
 
 Loaded DSO modules/mod_jk.dll uses plain 
Apache 1.3 API, this module might crash under EAPI! (please recompile it with 
-DEAPI)
 
I opened mod_jk.dsp into Visual C++, and added /D 
"EAPI".   Upon compiling, I got a "too many initializers" 
error.   Investigating the typedef for module, there was no 
preprocessor instruction to extend the def for module for EAPI.   
Grabbing the typedef from the Apache source, I added
 
#ifdef EAPI
#ifdef ULTRIX_BRAIN_DEATH    
void  (*add_module) ();    void  (*remove_module) 
();    char *(*rewrite_command) ();    
void  (*new_connection) ();    void  
(*close_connection) ();#else    void  (*add_module) 
(struct module_struct *);    void  (*remove_module) 
(struct module_struct *);    char *(*rewrite_command) 
(cmd_parms *, void *config, const char *);    void  
(*new_connection) (conn_rec *);    void  
(*close_connection) (conn_rec *);#endif
The module then compiled without 
problem.   However, when I attempted to use it, the warning 
persisted!
 
Any help would be appreciated.
 
Bob.