MBean/Tomcat ClassNotFound

2006-08-09 Thread José Luis Martínez-Avial
Hi,

I’m trying to deploy a Mbean in a web app. When I create the MBean, the next
exception is throwed:

 

javax.management.ReflectionException: null nested exception is
java.lang.ClassNotFoundException:
es.tid.puzzle.framework.jmx.agente.ControladorServicios

java.lang.ClassNotFoundException:
es.tid.puzzle.framework.jmx.agente.ControladorServicios

  at
mx4j.server.DefaultClassLoaderRepository.loadClassFromRepository(DefaultClas
sLoaderRepository.java:99)

  at
mx4j.server.DefaultClassLoaderRepository.loadClassWithout(DefaultClassLoader
Repository.java:33)

  at
mx4j.server.DefaultClassLoaderRepository.loadClass(DefaultClassLoaderReposit
ory.java:28)

  at mx4j.server.MX4JMBeanServer.createMBean(MX4JMBeanServer.java:697)

  at mx4j.server.MX4JMBeanServer.createMBean(MX4JMBeanServer.java:689)

 

But the class is present. I tried to change the jar, putting it in
shared/lib or in common/lib, pero it’s the same. The only solution is to put
the jar into classpath definition in catalina.bat, but I prefer not to touch
the tomcat classpath. ¿how can I do it?

 

TIA

 

José Luis

 

 

 



Re: getRealPath and war file

2006-08-09 Thread Romain Quilici

Mikolaj Rydzewski wrote:

Romain Quilici wrote:
However, Tomcat creates automatically a directory under webapps to 
contain war file contents, so I am wondering if Tomcat is using the 
newly generated directory to load the application(1st case) or

the war file (2nd case).
In the first case context.getRealPath(/) should return the path to 
the newly generated directory.
In the second case, why does Tomcat generate the directory to contain 
war file contents?

I.e. for performance reasons.

One should use context.getResourceAsStream() to read files from both 
war or expanded directory.



Hi all,
thanks for the answer.
My pb is more to write in a given directory(must be accessible with a 
url), than to read.

And I would prefer this directory to be located in my webapp.
Regards
Romain


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: getRealPath and war file

2006-08-09 Thread Mikolaj Rydzewski

Romain Quilici wrote:
My pb is more to write in a given directory(must be accessible with a 
url), than to read.

And I would prefer this directory to be located in my webapp.
Use directory outside webapp and then map it with alias, or some kind of 
dispatcher servlet/filter.


It'll help you to redeploy webapp and not to loose uploaded/saved files.

--
Mikolaj Rydzewski [EMAIL PROTECTED]



smime.p7s
Description: S/MIME Cryptographic Signature


How to define a local TLD in web.xml (DRY principle!!!)

2006-08-09 Thread Ach

I entered below section in my web.xml because of not repeating 
%@ taglib=blaBla in each jsf page:
  
  jsp-config
taglib
taglib-urihttp://java.sun.com/jsf/core/taglib-uri
tablig-location/tld/myfaces_core.tld/taglib-location
/taglib
taglib
taglib-urihttp://java.sun.com/jsf/html/taglib-uri
tablig-location/tld/myfaces_html.tld/taglib-location
/taglib
taglib
taglib-urihttp://myfaces.apache.org/tomahawk/taglib-uri
tablig-location/tld/tomahawk.tld/taglib-location
/taglib
   /jsp-config

It seems that it does not work for me. Is there another way to achieve my
goal?

 PS: I am using eclipse wtp and my directory schema is such as:
MyApp/WebContent/WEB-INF/tld and all tld files are in this tld folder.

 -Thanks in advance
-- 
View this message in context: 
http://www.nabble.com/How-to-define-a-local-TLD-in-web.xml-%28DRY-principle%21%21%21%29-tf2077762.html#a5722904
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat JSP Servlet Apache JK2

2006-08-09 Thread jeusdi

Hello,
   mmm, I've compiled and linked and configured mod_jk with Apache 2.0
correctly, but I doesn't work correctly. Mmm, if I access to
http://192.168.1.2 explorer continues show me the code of my JSP, but if I
access to http://192.168.1.2/ecommerce/login.jsp it shows me correctly the
JSP formatted or interpreted as simpe HTML file.

I don't know What more Can I do. Can you say me what do I do wrong?

jk.conf -

JkWorkersFile /etc/apache2/properties/workers.properties
JkLogFile /var/log/apache2/jk.log
JkLogLevel debug


workers.properties -


#
# List workers
worker.list=treb
#
# Define work
worker.treb.tomcat_home=$TOMCAT_HOME
worker.treb.java_home=$JAVA_HOME
worker.treb.port=8009
worker.treb.host=localhost
worker.treb.type=ajp13
worker.treb.cachesize=10
worker.treb.cache_timeout=600
worker.treb.socket_timeout=300
worker.treb.lbfactor=1


And httpd.conf -

ServerName 192.168.1.2

NameVirtualHost 192.168.1.2

VirtualHost 192.168.1.2
ServerName 192.168.1.2
ServerAdmin [EMAIL PROTECTED]
DocumentRoot /usr/local/tomcat/webapps/ecommerce
ErrorLog /usr/local/tomcat/webapps/webshop/logs/error_log
CustomLog /usr/local/tomcat/webapps/webshop/logs/access_log common
LocationMatch .*WEB-INF.*
AllowOverride None
Deny from all
/LocationMatch
JkMount /*.jsp treb
/VirtualHost


-- 
View this message in context: 
http://www.nabble.com/tomcat-JSP-Servlet-Apache-JK2-tf2071029.html#a5724146
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: How to define a local TLD in web.xml (DRY principle!!!)

2006-08-09 Thread David Smith
The taglib-location element is relative to the context as in 
/WEB-INF/tld/myfaces_core.tld


--David

Ach wrote:

I entered below section in my web.xml because of not repeating 
%@ taglib=blaBla in each jsf page:
 
 jsp-config

   taglib
   taglib-urihttp://java.sun.com/jsf/core/taglib-uri
   tablig-location/tld/myfaces_core.tld/taglib-location
   /taglib
   taglib
   taglib-urihttp://java.sun.com/jsf/html/taglib-uri
   tablig-location/tld/myfaces_html.tld/taglib-location
   /taglib
   taglib
   taglib-urihttp://myfaces.apache.org/tomahawk/taglib-uri
   tablig-location/tld/tomahawk.tld/taglib-location
   /taglib
  /jsp-config

It seems that it does not work for me. Is there another way to achieve my
goal?

PS: I am using eclipse wtp and my directory schema is such as:
MyApp/WebContent/WEB-INF/tld and all tld files are in this tld folder.

-Thanks in advance
 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat JSP Servlet Apache JK2

2006-08-09 Thread David Smith
It's a difference of path.  To Apache, the ecommerce webapp is the root 
of your site, but Tomcat does not see it that way.  Tomcat only 
recognizes the ROOT webapp as the document root.  Rename the ecommerce 
webapp to ROOT (notice the all caps), deleting the original ROOT 
directory under webapps and reconfigure Apache to use that as the 
document root.


The point is that URL paths in Tomcat and HTTPd must sync.  Your 
login.jsp can't be /ecommerce/login.jsp in tomcat and /login.jsp in Apache.


--David

jeusdi wrote:


Hello,
  mmm, I've compiled and linked and configured mod_jk with Apache 2.0
correctly, but I doesn't work correctly. Mmm, if I access to
http://192.168.1.2 explorer continues show me the code of my JSP, but if I
access to http://192.168.1.2/ecommerce/login.jsp it shows me correctly the
JSP formatted or interpreted as simpe HTML file.

I don't know What more Can I do. Can you say me what do I do wrong?

jk.conf -

JkWorkersFile /etc/apache2/properties/workers.properties
JkLogFile /var/log/apache2/jk.log
JkLogLevel debug


workers.properties -


#
# List workers
worker.list=treb
#
# Define work
worker.treb.tomcat_home=$TOMCAT_HOME
worker.treb.java_home=$JAVA_HOME
worker.treb.port=8009
worker.treb.host=localhost
worker.treb.type=ajp13
worker.treb.cachesize=10
worker.treb.cache_timeout=600
worker.treb.socket_timeout=300
worker.treb.lbfactor=1


And httpd.conf -

ServerName 192.168.1.2

NameVirtualHost 192.168.1.2

VirtualHost 192.168.1.2
   ServerName 192.168.1.2
   ServerAdmin [EMAIL PROTECTED]
   DocumentRoot /usr/local/tomcat/webapps/ecommerce
   ErrorLog /usr/local/tomcat/webapps/webshop/logs/error_log
   CustomLog /usr/local/tomcat/webapps/webshop/logs/access_log common
   LocationMatch .*WEB-INF.*
   AllowOverride None
   Deny from all
   /LocationMatch
   JkMount /*.jsp treb
/VirtualHost


 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Initializing session in a Filter

2006-08-09 Thread Mohsen Saboorian

Hi,
I have a filter (for /*) in which I'm caching something in the
session. Here is a piece of code:

public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) {
HttpServletRequest req = (HttpServletRequest) request;
HttpSession session = req.getSession(false);
if (session == null) {
System.out.println(Create a new session:  + new 
java.util.Date());
session = req.getSession();
}
// cache something
}

The first time I make a request, since req.getSession(false) returns
null, a session is created by a call to req.getSession() manually.
The second time I make a request to the server, req.getSession(false)
returns null and so a session is created again.
In all other request (third, ...) the last created session (second) is returned!

My question is why session is created two times?

Thanks in advance.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Session sharing accros subdomains?

2006-08-09 Thread Madhur K Tanwani
I've a main website hosting domain domain.com. There are links on this 
page that point to response servers, which is a subdomain  rs.domain.com.
The problem is that when a user signs in on the domain.com and clicks 
on any link his session is not available on rs.domain.com.


I see that this question has been asked an ample number of times on this 
group.
I think I'm clear on the point that this is against the spec / not 
possible normally.


What I want to ask is that whether there is something that can be done 
either in Tomcat / Apache / my application that will help me in this 
sharing of sessions.


We will be using Tomcat along with  Apache (for load balancing) on Linux 
(FC4).


Awaiting responses,

--
__
Madhur Kumar Tanwani


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



workers.properties

2006-08-09 Thread D. Salemink Klikstudio

Does anybody have experience setting up the workers.properties file to
serve mmbase through apache?
--
D. Salemink
Zomerdijkstraat 1-11079WX Amsterdam
+31207726869 +31651611510

Nieuwe media cursussen http://www.klikstudio.net
Webdesign en hosting http://www.klikstudio.nl

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Session hijacking with Tomcat/Myfaces - unable to fix it

2006-08-09 Thread Tomas Hulek
The default Tomcat installation is prone to session hijacking. I would
appreciate help how to fix it.

The problem is that the session-id generated under HTTP (eg. for any JSF
page) is caried over to authenticated confidential pages under HTTPS.

Thus the session ID can be easily sniffed under HTTP, then misused after
user logs-in under HTTPS.

I believe it can be considered as a serious security bug.

Scenario:

1) Tomcat and JSF, using Apache MyFaces.

2) A single application (context), using JSF pages

3) Some pages are public, and Faces servlet requests session ID on the
first hit

4) Some pages are only accessible under HTTPS after authetication, as
defined in web.xml:

  security-constraint
web-resource-collection
  web-resource-nameSecret part/web-resource-name
  url-pattern/secret/*/url-pattern
/web-resource-collection
auth-constraint
  role-namesecret_role/role-name
/auth-constraint
user-data-constraint
  transport-guaranteeCONFIDENTIAL/transport-guarantee
/user-data-constraint
  /security-constraint

5) Form-based authentication is used for the login (again, defined in
web.xml).

6) The user goes to the public part of the aplication, gets a session ID
(under HTTP)

7) The user goes to a confidential URL, logging-in successfully. The same
session ID is retained!!!

8) Anyone who knows the session ID generated in step 6 can reach the
confidential URL.

We have not found any straightforward way of making Tomcat regenerate the
session ID once user swichtes to HTTPS. We tried many approaches, and all
of them break some part of the JSF application.


Thank you for your help,


Tomas Hulek


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



APR build under Win32 (Visual Studio) - undefined symbols

2006-08-09 Thread Christoph P. Kukulies
I'm trying to build the APR dll  under Windows XP.
I unpacked them in directories

apr
apr-iconv
apr-util

I started the aprutil.dsw file and was able to build
apr-1.lib without a hitch.

But building libapriconv.dll I'm getting undefined symbols:
Linking...
   Creating library Debug/libapriconv-1.lib and object Debug/libapriconv-1.exp
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol __imp__apr_snprintf
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
iconv_module.obj : error LNK2001: unresolved external symbol [EMAIL PROTECTED]
Debug/libapriconv-1.dll : fatal error LNK1120: 9 unresolved externals
Error executing link.exe.

libapriconv-1.dll - 10 error(s), 4 warning(s)


Building libapr-1.dll then worked fine again. Should I bother?

Where does one put now libapr-1.dll to become effective?
Is there anything required in httpd.conf (LoadModule)?

--
Chris Christoph P. U. Kukulies kuku_at_kukulies.org

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: How to define a local TLD in web.xml (DRY principle!!!)

2006-08-09 Thread Ach

Thanks It works now. I have a syntax error in tags too!
-- 
View this message in context: 
http://www.nabble.com/How-to-define-a-local-TLD-in-web.xml-%28DRY-principle%21%21%21%29-tf2077762.html#a5725676
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Hot code replace

2006-08-09 Thread Ulath

hi,

 i am trying to use eclipse with tomcat (myeclipse plugin) but when i change
one of my class (JSF backing beans) i get Hot code replace failed - Scheme
change not implemented error, so i need to restart tomcat each time

what could i do to enable hot code replacement?


regards...
-- 
View this message in context: 
http://www.nabble.com/Hot-code-replace-tf2078792.html#a5725809
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat JSP Servlet Apache JK2

2006-08-09 Thread jeusdi

So, What must I change in my configuration files. I want that I access to
192.168.1.2 appear my login.jsp. I'm very stressed. I have a feeling I do
all right. I understant it.

my login.jsp is located in /usr/local/tomcat/webapps/login.jsp


-- 
View this message in context: 
http://www.nabble.com/tomcat-JSP-Servlet-Apache-JK2-tf2071029.html#a5726353
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat JSP Servlet Apache JK2

2006-08-09 Thread David Smith
You can't place a jsp in /usr/local/tomcat/webapps.  Tomcat does not 
make that location available to the client.


You originally had a ecommerce webapp with a login.jsp file you wanted 
to access at the top level.  I recommended you rename the webapp 
'ecommerce' to 'ROOT' and reconfigure apache httpd to use that as the 
docroot instead of 'ecommerce'.


Please read the tomcat docs and re-read my previous responses.

--David

PS:  Please leave in the relevant parts of the message you are replying 
to.  It's easier to answer when we don't have to dig back through the 
entire thread just to find out what's been said before.


jeusdi wrote:


So, What must I change in my configuration files. I want that I access to
192.168.1.2 appear my login.jsp. I'm very stressed. I have a feeling I do
all right. I understant it.

my login.jsp is located in /usr/local/tomcat/webapps/login.jsp


 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



webapp under domein

2006-08-09 Thread D. Salemink Klikstudio

Hello,
I'm trying to install a web- app under domain name.
I've managed to the point where i get the url
www.mydomain.com/webapp out of the tomcat webapp directory.
My problem is that every other domain on the server now also points to
the webapp directory.
How can I solve this?
Ive put mount remarks in the httpd conf file for my specific domain
and added the domain to the host file and the workers.properties also
point to my domein.
regards,
--
D. Salemink
Zomerdijkstraat 1-11079WX Amsterdam
+31207726869 +31651611510

Nieuwe media cursussen http://www.klikstudio.net
Webdesign en hosting http://www.klikstudio.nl

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Session sharing accros subdomains?

2006-08-09 Thread Almir Kazazic

hy ,

I think that your problem is on the client side. session is maintained
through cookies (well you know what i mean server discriminates
session based on cookies and stores data somowhere on server) and your
client will never send cookie to different server (in some cases maybe
it will work but mostly not). So if you want to do this you first have
to deal with this problem than you could serialize whole session data
and store it somewhere in database and on new domain you can
deserialize it and use it as session

regards

On 8/9/06, Madhur K Tanwani [EMAIL PROTECTED] wrote:

I've a main website hosting domain domain.com. There are links on this
page that point to response servers, which is a subdomain  rs.domain.com.
The problem is that when a user signs in on the domain.com and clicks
on any link his session is not available on rs.domain.com.

I see that this question has been asked an ample number of times on this
group.
I think I'm clear on the point that this is against the spec / not
possible normally.

What I want to ask is that whether there is something that can be done
either in Tomcat / Apache / my application that will help me in this
sharing of sessions.

We will be using Tomcat along with  Apache (for load balancing) on Linux
(FC4).

Awaiting responses,

--
__
Madhur Kumar Tanwani


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat JSP Servlet Apache JK2

2006-08-09 Thread Mark Eggers
There are a lot of issues here, mostly having to do
with how you've structured your virtual hosts. 
However, I think the following should get you up and
running quickly.

In your VirtualHost directive, add the following line:

DirectoryIndex index.html index.html.var login.jsp

That should bring up the login.jsp as a default index
when someone just goes to the directory.

Note, I have not tried this, but I do use this to
serve up .pl and .php index files.

I normally don't have a login.jsp page as the entry
point into my web application.  I normally put an
index.html splash page with a note about the web
application, and then on that page provide a link to
the login page should the user want to log in.

As I said above, there are a lot of potential issues
with the way you've constructed virtual hosts, both
with Apache and Tomcat.  The Tomcat issues are
certainly on topic for this mailing list, but the
Apache issues are probably not.

Hope this helps.

/mde/
just my two cents . . . .

--- jeusdi [EMAIL PROTECTED] wrote:

 
 Hello,
mmm, I've compiled and linked and configured
 mod_jk with Apache 2.0
 correctly, but I doesn't work correctly. Mmm, if I
 access to
 http://192.168.1.2 explorer continues show me the
 code of my JSP, but if I
 access to http://192.168.1.2/ecommerce/login.jsp it
 shows me correctly the
 JSP formatted or interpreted as simpe HTML file.
 
 I don't know What more Can I do. Can you say me what
 do I do wrong?
 
 jk.conf -
 
 JkWorkersFile
 /etc/apache2/properties/workers.properties
 JkLogFile /var/log/apache2/jk.log
 JkLogLevel debug
 
 
 workers.properties -
 
 
 #
 # List workers
 worker.list=treb
 #
 # Define work
 worker.treb.tomcat_home=$TOMCAT_HOME
 worker.treb.java_home=$JAVA_HOME
 worker.treb.port=8009
 worker.treb.host=localhost
 worker.treb.type=ajp13
 worker.treb.cachesize=10
 worker.treb.cache_timeout=600
 worker.treb.socket_timeout=300
 worker.treb.lbfactor=1
 
 
 And httpd.conf -
 
 ServerName 192.168.1.2
 
 NameVirtualHost 192.168.1.2
 
 VirtualHost 192.168.1.2
 ServerName 192.168.1.2
 ServerAdmin [EMAIL PROTECTED]
 DocumentRoot
 /usr/local/tomcat/webapps/ecommerce
 ErrorLog
 /usr/local/tomcat/webapps/webshop/logs/error_log
 CustomLog
 /usr/local/tomcat/webapps/webshop/logs/access_log
 common
 LocationMatch .*WEB-INF.*
 AllowOverride None
 Deny from all
 /LocationMatch
 JkMount /*.jsp treb
 /VirtualHost
 
 
 -- 
 View this message in context:

http://www.nabble.com/tomcat-JSP-Servlet-Apache-JK2-tf2071029.html#a5724146
 Sent from the Tomcat - User forum at Nabble.com.
 
 

-
 To start a new topic, e-mail:
 users@tomcat.apache.org
 To unsubscribe, e-mail:
 [EMAIL PROTECTED]
 For additional commands, e-mail:
 [EMAIL PROTECTED]
 
 


__
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam
protection around 
http://mail.yahoo.com 

__
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: mod_jk log level and logging issues

2006-08-09 Thread Rainer Jung
Hi,

thanks for the feedback. Good info!

fredk2 schrieb:
 issue 1:
 
 
 With mod_jk 1.2.15 i set my jk log level:
 
 JkLogFile logs/mod_jk.log
 #JkLogLevel info
 JkRequestLogFormat %w %V %U %s %T %B %H %m
 
 While switching to 1.2.18 I read in the fine manual that the default log
 level is info so I removed the directive, and.oh my ! the default is now
 debug :-) 

Gr. You are right. A quick inspection of our code shows, that in
fact: if the JkLogLevel directive is being used and it can not map the
value to a log level, it will use info. If one does not use any
JkLogLevel, then the code really looks like we fall through to debug.
Bad. I'll double check and correct defaults to INFO.

 issue 2:
 
 
 When Tomcat is down I get the following mod_jk.log error mesg and
 JkRequestLog entry:
 . . .
 [Tue Aug 08 14:34:33 2006] [23653:] [error] ajp_service::jk_ajp_common.c
 (1794): Error connecting to tomcat. Tomcat is probably not started or is
 listening on the wrong port. worker=myWorker failed
 [Tue Aug 08 14:34:33 2006] myWorker myserver.mydom.com /myapp/jsp/hello 200
 0.000378 0 HTTP/1.1 GET
 . . .

Again you are right. We log the request before we change the status
code. Not good. I'll try to improve this.

 The JkRequestLog entry shows a http status 200 whereas the browser (apache
 httpd) reports properly 503.

 Also any url that would normally show a status of 404 show 200 when
 tomcat is down.

Why do you expect a 404 in case Tomcat is down? If the request matches
mod_jk JkMount config, it should try to send to tomcat and the result
would be some 50X?

 This is a bit unexpected but it appears that 1.2.15 is doing the same. 
 Hence a broken tomcat can actually make a log stat look very good :)

Regards,

Rainer

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Mod_jk balancing, session problem

2006-08-09 Thread Rainer Jung
Hi,

Artur schrieb:
 - does it happen in times, when you get errors in the mod_jk-log? Does 
 it happen at all times, or do you have peaks at special times?

 I can't figure it out, when this happens, but there isn't any special
 moment I can observe. 
 It happens randomly. There isn't any error in mod_jk.log

Choose the suggested access log methods to improve observability (URLs
and Cookie and Set-Cookie Headers.

 And here I need some help. In mod_jk.log I always see the same worker -
 balancer worker, so I don't know which worker has been choosen. How can I
 change it ? I assume by adding request log to mod_jk you mean something
 like this:

 # JkRequestLogFormat set the request format
   JkRequestLogFormat %w %V %T

OK, unfortunately mod_jk does not yet allow to log the sub worker of an
lb. I'll check for improvement in 1.2.19...

 IfModule mpm_worker_module
 StartServers 5
 MaxClients   448
 MinSpareThreads  5
 MaxSpareThreads  25 
 ThreadsPerChild  7
 MaxRequestsPerChild   0
 /IfModule
 Interesting, very few ThreadsPerChild. Not really a problem, but I 
 wonder if this is efficient.

 We have decresed this value because we thought that maybe Apache is
 opening too many threads to Tomcat. We had in Tomcat's log entries saying
 All threads (500) are curently busy, increase maxThreds. 

Threads in Tomcat = Sum of numbers of apache threads used during peak
times. So this relates more to MaxClients and not to ThreadsPerChild.
If you want to connect many Apaches with a lot of threads to tomcat you
need to use tricks like the APR connector on the tomcat side. A few
hundred threads should be no problem, on a good OS even 1.000-2.000
should work.


 Think about using connect_timeout and prepost_timeout. Maybe also set 
 recovery_options to 3.

 What values do you suggest for above parameters ?

connect_timeout=2

This is in Milliseconds. Anything between 2000 and 2 should be OK.
The right value depends on your trust in latency, reliability of your
network and the responsiveness of the target machine.

prepost_timeout=1

Values between 5000 and 3 are reasonable. Arguments the same as before.

recovery_options=3 or 7 (here you'll need to experimnt on your own. The
added 4 is very new, but maybe helpful).

Regards,

Rainer


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: mod_jk log level and logging issues

2006-08-09 Thread fredk2

Hi Rainer:

Many thanks for your answers (and fast!).

Why do you expect a 404 in case Tomcat is down? If the request matches 
mod_jk JkMount config, it should try to send to tomcat and the result 
would be some 50X? 

What I meant to say was that when previously you might have had a missing
jsp/html and thus a 404, when tomcat is down it says 200 which means,
according to the mod_jk.log, that it is working when in reality it is not
:-) .  Yes,  I would expect 50x.

thanks, Fred
-- 
View this message in context: 
http://www.nabble.com/mod_jk-log-level-and-logging-issues-tf2075041.html#a5730282
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Create an object that's shared with multiple applications?

2006-08-09 Thread 0 8

Hello,

I currently have a JSP application under Tomcat that uses an object
created when Tomcat starts up.  The object is created using a class
that implements ServletContextListener and I can call the object from
my JSPs.  All is well.

Originally, I thought I could have one of these objects per
application.  But it turns out I can have only one per server.

I've been doing some searching and looking through the documentation,
but I can't figure out how to do this.

How can I create a single object when Tomcat starts up and access that
object from multiple web apps?

Thanks,
Matt

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Create an object that's shared with multiple applications?

2006-08-09 Thread Pid
put it in a database?

0 8 wrote:
 Hello,
 
 I currently have a JSP application under Tomcat that uses an object
 created when Tomcat starts up.  The object is created using a class
 that implements ServletContextListener and I can call the object from
 my JSPs.  All is well.
 
 Originally, I thought I could have one of these objects per
 application.  But it turns out I can have only one per server.
 
 I've been doing some searching and looking through the documentation,
 but I can't figure out how to do this.
 
 How can I create a single object when Tomcat starts up and access that
 object from multiple web apps?
 
 Thanks,
 Matt
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Create an object that's shared with multiple applications?

2006-08-09 Thread Lung Chan

check jndi ressources

On 8/9/06, Pid [EMAIL PROTECTED] wrote:


put it in a database?

0 8 wrote:
 Hello,

 I currently have a JSP application under Tomcat that uses an object
 created when Tomcat starts up.  The object is created using a class
 that implements ServletContextListener and I can call the object from
 my JSPs.  All is well.

 Originally, I thought I could have one of these objects per
 application.  But it turns out I can have only one per server.

 I've been doing some searching and looking through the documentation,
 but I can't figure out how to do this.

 How can I create a single object when Tomcat starts up and access that
 object from multiple web apps?

 Thanks,
 Matt

 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Create an object that's shared with multiple applications?

2006-08-09 Thread Ryan O'Hara

How can I create a single object when Tomcat starts up and access that
object from multiple web apps?

Thanks,
Matt


Have you added listener and listener-class tags in each applications'  
web.xml?


Ryan

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Create an object that's shared with multiple applications?

2006-08-09 Thread 0 8

I did, but then I get more than I get one object created for each application.

I literally just stumbled a mention of a crossContext setting in
Tomcat, but I'm still trying to figure out if that will help here.

On 8/9/06, Ryan O'Hara [EMAIL PROTECTED] wrote:

 How can I create a single object when Tomcat starts up and access that
 object from multiple web apps?

 Thanks,
 Matt

Have you added listener and listener-class tags in each applications'
web.xml?

Ryan

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Re: How to call beforeSessionDestroyed of SessionListener

2006-08-09 Thread Umesh Kudtarkar
Anyone with other suggestions ?

-Original Message-
From: Umesh Kudtarkar [mailto:[EMAIL PROTECTED] 
Sent: Monday, August 07, 2006 2:23 PM
To: Tomcat Users List
Subject: RE: Re: How to call beforeSessionDestroyed of SessionListener

Hi Moises,
Actually I am not trying to call it. I am hoping as per servlet 2.4 spec
there is some mechanism of getting HttpSession before it is destroyed.
My sessionListener class checks for some session attribute and updates
some bits in database. In case of session timeout by the time
sessionDestroyed() method of SessionListener is called Session is
already destroyed. Is there any other way of getting session information
just
before it is destroyed ?

Thanks,
Umesh

-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of Moises Lejter
Sent: Monday, August 07, 2006 1:53 PM
To: users@tomcat.apache.org
Subject: Re: How to call beforeSessionDestroyed of SessionListener

I am not sure what you are trying to do ... but you should never be
calling 
this yourself - container callbacks are Tomcat's to call.
What you would do at app level is define an HttpSessionListener to be 
called...

Moises

Umesh Kudtarkar [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
Hi,
I am trying to find out how to call beforeSessionDestroyed. From Tomcat
5.5 code I see following
in org.apache.catalina.session.StandardSession

  fireContainerEvent(context,
 beforeSessionDestroyed,
   listener);

But not sure how it is called. Has anyone tried this? Any suggestions?

Thanks,
Umesh





-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Create an object that's shared with multiple applications?

2006-08-09 Thread 0 8

Pid,

I'm sure this is a stupid question but...what?  I don't follow.

I can store the object in a database?  I'm limited to SQL Server.
Does that matter?

On 8/9/06, Pid [EMAIL PROTECTED] wrote:

put it in a database?

0 8 wrote:
 Hello,

 I currently have a JSP application under Tomcat that uses an object
 created when Tomcat starts up.  The object is created using a class
 that implements ServletContextListener and I can call the object from
 my JSPs.  All is well.

 Originally, I thought I could have one of these objects per
 application.  But it turns out I can have only one per server.

 I've been doing some searching and looking through the documentation,
 but I can't figure out how to do this.

 How can I create a single object when Tomcat starts up and access that
 object from multiple web apps?

 Thanks,
 Matt

 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Modifying saved URL from j_security_check

2006-08-09 Thread Gregor Schneider

Hi Mark,

something really, really strange is happening here: As you suggested, I've
subclassed org.apache.catalina.authenticator.FormAuthenticator, patched the
Authenticators.properties in catalina.jar, however, my own Authenticator is
not being used.
Strange though, since if I delete my jar where my Authenticator resides from
server/lib, Tomcat won't start up grumping that my class is missing...

I've overwritten the methods invoke(), where I'm just throwing an Exception
(to make sure that my class is really triggered as a 1st try), also I've
overwritten the method restoreRequest() and authenticate() - none of the
methods gets hit.

Do you have any idea what I'm missing here?

Below is my code (short  simple):

[cut]===

package com.cr.manuals.catalina;

import java.io.IOException;
import java.util.Iterator;
import java.util.Locale;

import javax.servlet.ServletException;
import javax.servlet.http.Cookie;

import org.apache.catalina.HttpRequest;
import org.apache.catalina.HttpResponse;
import org.apache.catalina.Request;
import org.apache.catalina.Response;
import org.apache.catalina.Session;
import org.apache.catalina.ValveContext;
import org.apache.catalina.authenticator.Constants;
import org.apache.catalina.authenticator.SavedRequest;
import org.apache.catalina.deploy.LoginConfig;

public class FormAuthenticator extends
   org.apache.catalina.authenticator.FormAuthenticator {

   /**
* Enforce the security restrictions in the web application deployment
* descriptor of our associated Context.
*
* @param request Request to be processed
* @param response Response to be processed
* @param context The valve context used to invoke the next valve
*  in the current processing pipeline
*
* @exception IOException if an input/output error occurs
* @exception ServletException if thrown by a processing element
*/
   public void invoke(Request request, Response response,
  ValveContext context)
   throws IOException, ServletException {

   System.out.println( inside own invoke );
   throw new ServletException(Inside invoke);
   }


   /**
* Authenticate the user making this request, based on the specified
* login configuration.  Return codetrue/code if any specified
* constraint has been satisfied, or codefalse/code if we have
* created a response challenge already.
*
* @param request Request we are processing
* @param response Response we are creating
* @param configLogin configuration describing how authentication
*  should be performed
*
* @exception IOException if an input/output error occurs
*/
   public boolean authenticate(HttpRequest request,
   HttpResponse response,
   LoginConfig config)
   throws IOException {

   System.out.println (*** inside own authenticate );
   return super.authenticate(request, response, config);
   }

   /**
* Restore the original request from information stored in our session.
* If the original request is no longer present (because the session
* timed out), return codefalse/code; otherwise, return
* codetrue/code.
*
* @param request The request to be restored
* @param session The session containing the saved information
*/
   protected boolean restoreRequest(HttpRequest request, Session session) {

   System.out.println(* inside own restore *);
   return super.restoreRequest(request, session);
   }
}

[cut]===

This is the content of my Authenticators.properties:

[cut]===

BASIC=org.apache.catalina.authenticator.BasicAuthenticator
CLIENT-CERT=org.apache.catalina.authenticator.SSLAuthenticator
DIGEST=org.apache.catalina.authenticator.DigestAuthenticator
FORM=com.cr.manuals.catalina.FormAuthenticator
NONE=org.apache.catalina.authenticator.NonLoginAuthenticator

[cut]===

I thought that maybe the reason for this might be that we're running in
SSL-mode, however, same behaviour when using pure http

FYI: Tomcat 5.0.28, Suse Linux 9.1

Clueless...

Greg
--
what's puzzlin' you, is the nature of my game


RE: How to call beforeSessionDestroyed of SessionListener

2006-08-09 Thread Umesh Kudtarkar
Thanks David. I will give it a try.

-Original Message-
From: David Smith [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 09, 2006 11:24 AM
To: Tomcat Users List
Subject: Re: How to call beforeSessionDestroyed of SessionListener

There is also a lesser known interface 
javax.servlet.http.HttpSessionActivationListener which appears to handle

the condition you are after.

--David

Umesh Kudtarkar wrote:

Anyone with other suggestions ?

-Original Message-
From: Umesh Kudtarkar [mailto:[EMAIL PROTECTED] 
Sent: Monday, August 07, 2006 2:23 PM
To: Tomcat Users List
Subject: RE: Re: How to call beforeSessionDestroyed of SessionListener

Hi Moises,
Actually I am not trying to call it. I am hoping as per servlet 2.4
spec
there is some mechanism of getting HttpSession before it is destroyed.
My sessionListener class checks for some session attribute and updates
some bits in database. In case of session timeout by the time
sessionDestroyed() method of SessionListener is called Session is
already destroyed. Is there any other way of getting session
information
just
before it is destroyed ?

Thanks,
Umesh

-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of Moises Lejter
Sent: Monday, August 07, 2006 1:53 PM
To: users@tomcat.apache.org
Subject: Re: How to call beforeSessionDestroyed of SessionListener

I am not sure what you are trying to do ... but you should never be
calling 
this yourself - container callbacks are Tomcat's to call.
What you would do at app level is define an HttpSessionListener to be 
called...

Moises

Umesh Kudtarkar [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
Hi,
I am trying to find out how to call beforeSessionDestroyed. From Tomcat
5.5 code I see following
in org.apache.catalina.session.StandardSession

  fireContainerEvent(context,
 beforeSessionDestroyed,
   listener);

But not sure how it is called. Has anyone tried this? Any suggestions?

Thanks,
Umesh



  



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



mod_jk 1.2.15 connectivity failing errorcode =13

2006-08-09 Thread hari168

I am using Tomcat 5.5 , Apache 1.3.27 and Mod_JK 1.2.15..

Connectivity is failing with following error message in mod_jk.log file

[error] jk_init::mod_jk.c (2039): Initializing
shm:${APACHE_HOME}/logs/jk-runtime-status errno=13

Please any one suggest, how i can dig this issue..



-- 
View this message in context: 
http://www.nabble.com/mod_jk-1.2.15-connectivity-failing-errorcode-%3D13-tf2080577.html#a5731608
Sent from the Tomcat - User forum at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat Book Recommendation?

2006-08-09 Thread Filip Hanik - Dev Lists
I would say you don't need a book. The tomcat reference and usage docs 
are excellent, and then you have a gazillion tutorials online


Filip


M. Goodell wrote:

Hello,
   
  Are there any text books / reference information about Tomcat on the maket that are considered to be the must haves ??? Years ago, I owned James Goodwills book and that was great, however that is old information now days. 
   
  In particular, what I am looking for is a systematic approach to Apache / Tomcat development with the emphasis on Tomcat of course.
   
  Thanks,
   
  M Goodell
   



-
Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls.  Great rates 
starting at 1¢/min.
  



No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.10.7/411 - Release Date: 8/7/2006
  



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Dynamically Determining the Web App

2006-08-09 Thread Kohn, Robert M.
Dear Friends,

I have two web apps that are identical except for their root directory
(and context entry in server.xml).
Is there any way of determining from within a servlet which one is
actually running?
Or, alternatively, is there a way of retrieving values from the
context section of server.xml for the corresponding web app?

Thank you very much!

- Robert Kohn


Re: mod_jk 1.2.15 connectivity failing errorcode =13

2006-08-09 Thread Filip Hanik - Dev Lists

hari168 wrote:

I am using Tomcat 5.5 , Apache 1.3.27 and Mod_JK 1.2.15..

Connectivity is failing with following error message in mod_jk.log file

[error] jk_init::mod_jk.c (2039): Initializing
shm:${APACHE_HOME}/logs/jk-runtime-status errno=13

Please any one suggest, how i can dig this issue..



  

replace ${APACHE_HOME} with the actual path in your config file

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Dynamically Determining the Web App

2006-08-09 Thread Hassan Schroeder

On 8/9/06, Kohn, Robert M. [EMAIL PROTECTED] wrote:

I have two web apps that are identical except for their root directory
(and context entry in server.xml).
Is there any way of determining from within a servlet which one is
actually running?


ServletContext.getServletContextName() should do it, eh?

--
Hassan Schroeder  [EMAIL PROTECTED]

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Session hijacking with Tomcat/Myfaces - unable to fix it

2006-08-09 Thread Mark Thomas
Tomas Hulek wrote:
 The default Tomcat installation is prone to session hijacking. I would
 appreciate help how to fix it.

This is a more general http problem with a well known solution. Do
everything over https.

Mark

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Hot code replace

2006-08-09 Thread Darryl Miles

Ulath wrote:

 i am trying to use eclipse with tomcat (myeclipse plugin) but when i change
one of my class (JSF backing beans) i get Hot code replace failed - Scheme
change not implemented error, so i need to restart tomcat each time

what could i do to enable hot code replacement?


What IDE and JVM implementation are you using ?


Darryl

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Session hijacking with Tomcat/Myfaces - unable to fix it

2006-08-09 Thread Kim Albee

It's a fundamentally bad security scheme to use the session-ID as the
identifier for your users.  Might be straight forward, but architecturally a
bad choice if you *really* want a secure area.

Kim :-)

On 8/9/06, Tomas Hulek [EMAIL PROTECTED] wrote:


The default Tomcat installation is prone to session hijacking. I would
appreciate help how to fix it.

The problem is that the session-id generated under HTTP (eg. for any JSF
page) is caried over to authenticated confidential pages under HTTPS.

Thus the session ID can be easily sniffed under HTTP, then misused after
user logs-in under HTTPS.

I believe it can be considered as a serious security bug.

Scenario:

1) Tomcat and JSF, using Apache MyFaces.

2) A single application (context), using JSF pages

3) Some pages are public, and Faces servlet requests session ID on the
first hit

4) Some pages are only accessible under HTTPS after authetication, as
defined in web.xml:

  security-constraint
web-resource-collection
  web-resource-nameSecret part/web-resource-name
  url-pattern/secret/*/url-pattern
/web-resource-collection
auth-constraint
  role-namesecret_role/role-name
/auth-constraint
user-data-constraint
  transport-guaranteeCONFIDENTIAL/transport-guarantee
/user-data-constraint
  /security-constraint

5) Form-based authentication is used for the login (again, defined in
web.xml).

6) The user goes to the public part of the aplication, gets a session ID
(under HTTP)

7) The user goes to a confidential URL, logging-in successfully. The same
session ID is retained!!!

8) Anyone who knows the session ID generated in step 6 can reach the
confidential URL.

We have not found any straightforward way of making Tomcat regenerate the
session ID once user swichtes to HTTPS. We tried many approaches, and all
of them break some part of the JSF application.


Thank you for your help,


Tomas Hulek


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




Re: Modifying saved URL from j_security_check

2006-08-09 Thread Mark Thomas
Gregor Schneider wrote:
 Hi Mark,
 
 something really, really strange is happening here: As you suggested, I've
 subclassed org.apache.catalina.authenticator.FormAuthenticator, patched the
 Authenticators.properties in catalina.jar, however, my own Authenticator is
 not being used.

snip/

 I thought that maybe the reason for this might be that we're running in
 SSL-mode, however, same behaviour when using pure http

Hmm. Odd. Very odd. I am using 5.5.x and other weird things are
happening that I need to fix. In the mean-time, can you try plan B
below? Make sure that you use the jars in your Tomcat installation to
compile against.

My authenticator is being called but the process is failing due to a
struts error I don't yet understand. Anyway, can you try the following?

Copy org.apache.catalina.authenticator.FormAuthenticator, add a
System.out somewhere and place the compiled class in
server/classes/org/apache/catalina/authenticator/FormAuthenticator.class

Authenticators.properties should be as per a clean installation

This should over-ride the class in the jar and call your code.

Best of luck.

Mark




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



JDBCRealm with Simple Servlet Filter

2006-08-09 Thread Dhiraj Ramakrishnan

Hello,


I have configured a SimpleServletFilter to act as my authentication
filter, i want it to do certain things after the authentication has failed.

My application is being authenticated using a TOMCAT JDBC Realm. The
authentication scheme is BASIC.

I noticed that the filter is being called after the authentication is
done, that is only if it is a valid user the filter is being called.

The filter is not called at all in case the authentication has failed.




Any ideas on this problem will be much appreciated.

Thanks

Dhiraj Ramakrishnan


Re: getRealPath and war file

2006-08-09 Thread Romain Quilici

Mikolaj Rydzewski wrote:

Romain Quilici wrote:
My pb is more to write in a given directory(must be accessible with a 
url), than to read.

And I would prefer this directory to be located in my webapp.
Use directory outside webapp and then map it with alias, or some kind 
of dispatcher servlet/filter.


It'll help you to redeploy webapp and not to loose uploaded/saved files.


Actually,
in my application, files are temporary. So even if they are deleted in 
doesn't matter.
What I mean is images are pushed inside a client browser when they are 
generated, but then are no longer used.
I prefer to create the directory within my application, to avoid 
permissions issues
As I understood, context.getRealPath(/); will return the context of my 
application, even if my app is deployed within a war(as soon as 
UnpackWars is set to true in Tomcat).
So I can deal with this command. I will provide anyway a mechanism to 
check if context.getRealPath(/); is null, in such case the application 
should take the values from init parameters

Regards
Romain



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: getRealPath and war file

2006-08-09 Thread Dies Koper

Hello Romain,

Is there no way you can use the temporary working directory 
(javax.servlet.context.tempdir)?
I don't know what pushing inside a client browser means, but as you 
mentioned the files are temporary, this sounds like the place to put them..
Also, you won't need to worry about maintaining some extra directory 
after deployment, and this is a portable solution.


Regards,
Dies

Romain Quilici wrote:

Mikolaj Rydzewski wrote:

Romain Quilici wrote:
My pb is more to write in a given directory(must be accessible with a 
url), than to read.

And I would prefer this directory to be located in my webapp.
Use directory outside webapp and then map it with alias, or some kind 
of dispatcher servlet/filter.


It'll help you to redeploy webapp and not to loose uploaded/saved files.


Actually,
in my application, files are temporary. So even if they are deleted in 
doesn't matter.
What I mean is images are pushed inside a client browser when they are 
generated, but then are no longer used.
I prefer to create the directory within my application, to avoid 
permissions issues
As I understood, context.getRealPath(/); will return the context of my 
application, even if my app is deployed within a war(as soon as 
UnpackWars is set to true in Tomcat).
So I can deal with this command. I will provide anyway a mechanism to 
check if context.getRealPath(/); is null, in such case the application 
should take the values from init parameters

Regards
Romain




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]