Re: Cannot Validate Signature for apache-tomcat-7.0.23-windows-i64.zip

2012-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Bill,

On 1/20/12 3:39 PM, Bill Rutledge wrote:
> For apache-tomcat-7.0.23-windows-i64.zip, I used Kleopatra to
> import the KEYS

Do you mean this file?

http://www.apache.org/dist/tomcat/tomcat-7/KEYS

> and check the validity of the signatures in 
> apache-tomcat-7.0.23-windows-i64.zip.asc and got the following.
> Does this look like I’ve made some mistake in this process?

WFM:

$ gpg --verify apache-tomcat-7.0.23-windows-i64.zip.asc
apache-tomcat-7.0.23-windows-i64.zip
gpg: Signature made Sun Nov 20 15:36:27 2011 EST using RSA key ID 2F6059E7
gpg: Good signature from "Mark E D Thomas "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:  There is no indication that the signature belongs to the
owner.
Primary key fingerprint: A9C5 DF4D 22E9 9998 D987  5A51 10C0 1C5A 2F60
59E7

So, if you trust the key with the above fingerprint, you should be fine.

Don't forget that you'll need to sign Mark's key if you want to
actually trust it. Then the warning you see above will go away.

(I don't trust Mark's key, yet, because he hasn't actually
participated in a key signing event that I've attended. No offense, Mark.)

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Z17oACgkQ9CaO5/Lv0PAo9wCfcn/ToHHqZS5ecn/zKeFF6MRj
Mz0AnRfah7kilUPvTXLOJR3wWA4eMuv9
=Hcsn
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Cannot Validate Signature for apache-tomcat-7.0.23-windows-i64.zip

2012-01-20 Thread Pid
On 20/01/2012 20:39, Bill Rutledge wrote:
>  
> 
> For apache-tomcat-7.0.23-windows-i64.zip, I used Kleopatra to import the
> KEYS and check the validity of the signatures in
> apache-tomcat-7.0.23-windows-i64.zip.asc and got the following. Does 
> this look like I’ve made some mistake in this process?
> 
>  
> 
>  
> 
> cid:image001.png@01CCD788.1E255930
> 

The list strips attachments and embedded images.

You'll need to post it online somewhere.


p


-- 

[key:62590808]



signature.asc
Description: OpenPGP digital signature


Cannot Validate Signature for apache-tomcat-7.0.23-windows-i64.zip

2012-01-20 Thread Bill Rutledge

For apache-tomcat-7.0.23-windows-i64.zip, I used Kleopatra to import the KEYS 
and check the validity of the signatures in 
apache-tomcat-7.0.23-windows-i64.zip.asc and got the following. Does  this look 
like I've made some mistake in this process?


[cid:image001.png@01CCD788.1E255930]


Re: Single virtual tomcat application which serves multiple contexts

2012-01-20 Thread André Warnier

Egor Samarkhanov wrote:

André,

Thanks for your notes! Please see my comments inline.

AW> Personal opinion:

AW> By putting some considerable effort into it, it is certainly possible to do something like 
AW> that, by rewriting URLs and/or proxying and/or making all your pages refer to the context 
AW> etc..


AW> But the question is : why ?
AW> If
AW> - you have many, many "clients"
Yes, I do have really many clients, and hope to get even more.
And in future I'd like to implement a failover solution with Tomcat
cluster. If i have these many applications deployed, then they will
be deployed on all nodes. I guess it would be much better if one
node contains a single application which can serve any client
(plus session replication). This way the cluster would be more
effective.

AW> - or you application is so big that having multiple copies of it totally 
fills your disk
It's pretty big, but the disk space is not the real concern, but
the memory. Many deployments of the same application consume lots of
PermGen.

AW> - or your application for "client1" needs to share data with the application for 
"client2"
No, it doesn't.

AW> then it may be worth thinking about this.

AW> But otherwise, you probably would immensely simplify your life by using a separate virtual 
AW> host for each client, and have for each virtual host a separate appBase, in which you just 
AW> deploy a copy of your application.


By the way, I was thinking about virtual hosts, but I didn't find any
solution yet to add new virtual hosts at runtime (to tomcat, or to apache
httpd).

AW> Think of the security issues otherwise, to avoid one client being ever able to access the 
AW> data of another;


Good point.

AW> or think of what happens when one of these clients in the future asks you
AW> for that little change just for him.. etc..

Yes, thinking about it all the time. But we didn't have such cases for
2 years, and if it happens - we would deploy the customized version to
some other, separate environment.


So, where do I start if I decide to go with the single virtual
application? Did someone try doing such things?

In that case, I would start with an Apache httpd front-end, connected to Tomcat via 
mod_proxy and mod_proxy_ajp, or via mod_jk.  You could then easily proxy any request to 
your single webapp running under Tomcat.

E.g.
http://front-end.company.com/client1/webapp -> tomcat:/single_webapp
http://front-end.company.com/client2/webapp -> tomcat:/single_webapp
...
http://front-end.company.com/clientn/webapp -> tomcat:/single_webapp
and use combinations of Proxy rules, Rewrite rules, SetHeaders rules etc.. to make sure 
that when your webapp returns pages, they correctly continue to refer to "client1", 
"client2" etc..
You just have to make sure then that your webapp always has enough information available, 
to know for which client it is being called.


You can also do this with virtual hosts at the Apache level, all proxying to the same 
back-end tomcat.  And there are tricks at the Apache level to handle "dynamic virtual hosts".



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Per-user management rights

2012-01-20 Thread Tim De Pauw

Then my conclusion was premature. I stand corrected!

Tim

On 1/20/2012 5:50 PM, Christopher Schultz wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Tim,

On 1/20/12 11:30 AM, Tim De Pauw wrote:

Not sure; a quick test seemed to suggest this, but I may have been
doing something wrong. If I have two hosts X and Y that resolve to
the same IP, can I still use AJP to forward requests to the
respective Tomcat host?


Absolutely. AJP forwards everything from the web server to Tomcat.
Tomcat can determine which virtual host should service the request
just like the web server can.


Regardless, I came across an old discussion [1], which suggests
implementing a servlet filter to check the authenticated user
against an ACL, and throwing a 403 if necessary. I hacked a filter
together, placed the class file under
/webapps/manager/WEB-INF/classes, mapped it to /text/* in
/webapps/manager/WEB-INF/web.xml, and I was good to go!


That will definitely work.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Zm3AACgkQ9CaO5/Lv0PDwsACfaY5OJYMt5jPms9Y3vxB3YcYe
sNsAni3yxlXvaSwkZYBJ0THRN0DubbKU
=E9d/
-END PGP SIGNATURE-


--
Tim De Pauw 
Vakgroep Informatica
Geassocieerde faculteit Toegepaste Ingenieurswetenschappen
Hogeschool Gent
http://tiwi.be/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Apache mod_jk proxy for Tomcat v6.0.29

2012-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ruiyuan,

On 1/20/12 1:25 PM, Ruiyuan Jiang wrote:
> We have an Apache (v2.0.59) mod_jk on HPUX 11.23 and Tomcat
> v6.0.29 (Java 6). When we tried to access the home page, it shows
> the source code of the home page.

Sounds like your DocumentRoot points to your webapp's appbase.

Is your home page a JSP? If so, does it show the JSP source, or does
it show the HTML source?

> Does anyone know what is the difference between Tomcat 5.5.27 and 
> Tomcat 6.0.29?

You could try reading both the ChangeLog and the migration guide.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8ZvHgACgkQ9CaO5/Lv0PA2PQCfZx0Z56gTNz6qkVu7Ego25Y4g
a+UAnjeELkcBUcTSCyj0KShgHcfKyFll
=MItK
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Caching of protected static content with Expires header: Expires Thu, 01 Jan 1970 03:00:00 EET?

2012-01-20 Thread Violeta Georgieva
And if I want to cache a protected resource only locally what I should do?

Thanks

2012/1/20 

> Violeta Georgieva  wrote:
>
> >Hi,
> >
> >If the static content is not protected then by default it is cached and
> >the
> >corresponding headers are set - see screenshot1 & screenshot2.
> >but when I put it as protected content the following headers are set:
> >Cache-control:private and Expires header: Expires Thu, 01 Jan 1970
> >03:00:00
> >EET - see screenshot3 & screenshot4
> >My question is why the expires header is set with this value? Doesn't
> >this
> >prevent caching?
>
> Yes. That is the point.
>
> Mark
>
>
> >
> >I'm running Tomcat 7.0.23
> >
> >Thanks in advance
> >Regards
> >Violeta
> >
>  >-
> >To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >For additional commands, e-mail: users-h...@tomcat.apache.org
>
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>


Re: BonCode AJP Connector 1.0rc ready - AJP from IIS to Tomcat

2012-01-20 Thread Jordan Michaels
Sweet!

Is there a changelog between the 0.91 release to the 1.0rc release?

Thanks Bilal!

-Jordan

- Original Message -
From: "Bilal S" 
To: "Tomcat Users List" 
Sent: Thursday, January 19, 2012 12:13:00 PM
Subject: BonCode AJP Connector 1.0rc ready - AJP from IIS to Tomcat

After close to a year of development and help of countless volunteers
version 1.0rc is finally available.
Many thanks to all the people that helped. This was done despite the
discouragement from the Apache foundation how nuts we were to even try to
improve this old horse.
We simply needed a better way to connect IIS and Tomcat, that addressed
issues that have emerged over the years. Just to name a few:  easier setup,
better management, more throughput, etc.

http://tomcatiis.riaforge.org/

As usual feedback is appreciated.


Cheers,
Bilal

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Apache mod_jk proxy for Tomcat v6.0.29

2012-01-20 Thread Ruiyuan Jiang
Hi, all

We have an Apache (v2.0.59) mod_jk on HPUX 11.23 and Tomcat v6.0.29 (Java 6). 
When we tried to access the home page, it shows the source code of the home 
page. On the same HPUX host, the same Apache server serves many virtual hosts 
that use mod_jk and the Tomcat 5.5.27 (Java 1.5) no problem. We tried to 
upgrade Apache from 2.0.59 to 2.2.15 but no luck. We also tried to point to the 
same application with Tomcat v5.5.27 and Apache 2.2.15 and then the home page 
shows correctly. Does anyone know what is the difference between Tomcat 5.5.27 
and Tomcat 6.0.29? Thanks.

Ryan Jiang





This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended 
recipient, please notify the sender immediately by 
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.


Re: Single virtual tomcat application which serves multiple contexts

2012-01-20 Thread Egor Samarkhanov
André,

Thanks for your notes! Please see my comments inline.

AW> Personal opinion:

AW> By putting some considerable effort into it, it is certainly possible to do 
something like 
AW> that, by rewriting URLs and/or proxying and/or making all your pages refer 
to the context 
AW> etc..

AW> But the question is : why ?
AW> If
AW> - you have many, many "clients"
Yes, I do have really many clients, and hope to get even more.
And in future I'd like to implement a failover solution with Tomcat
cluster. If i have these many applications deployed, then they will
be deployed on all nodes. I guess it would be much better if one
node contains a single application which can serve any client
(plus session replication). This way the cluster would be more
effective.

AW> - or you application is so big that having multiple copies of it totally 
fills your disk
It's pretty big, but the disk space is not the real concern, but
the memory. Many deployments of the same application consume lots of
PermGen.

AW> - or your application for "client1" needs to share data with the 
application for "client2"
No, it doesn't.

AW> then it may be worth thinking about this.

AW> But otherwise, you probably would immensely simplify your life by using a 
separate virtual 
AW> host for each client, and have for each virtual host a separate appBase, in 
which you just 
AW> deploy a copy of your application.

By the way, I was thinking about virtual hosts, but I didn't find any
solution yet to add new virtual hosts at runtime (to tomcat, or to apache
httpd).

AW> Think of the security issues otherwise, to avoid one client being ever able 
to access the 
AW> data of another;

Good point.

AW> or think of what happens when one of these clients in the future asks you
AW> for that little change just for him.. etc..

Yes, thinking about it all the time. But we didn't have such cases for
2 years, and if it happens - we would deploy the customized version to
some other, separate environment.


So, where do I start if I decide to go with the single virtual
application? Did someone try doing such things?



-- 
Best regards,
Egor Samarkhanov (ego...@actimind.com)
Actimind, Inc.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Per-user management rights

2012-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Tim,

On 1/20/12 11:30 AM, Tim De Pauw wrote:
> Not sure; a quick test seemed to suggest this, but I may have been
> doing something wrong. If I have two hosts X and Y that resolve to
> the same IP, can I still use AJP to forward requests to the
> respective Tomcat host?

Absolutely. AJP forwards everything from the web server to Tomcat.
Tomcat can determine which virtual host should service the request
just like the web server can.

> Regardless, I came across an old discussion [1], which suggests 
> implementing a servlet filter to check the authenticated user
> against an ACL, and throwing a 403 if necessary. I hacked a filter
> together, placed the class file under
> /webapps/manager/WEB-INF/classes, mapped it to /text/* in
> /webapps/manager/WEB-INF/web.xml, and I was good to go!

That will definitely work.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Zm3AACgkQ9CaO5/Lv0PDwsACfaY5OJYMt5jPms9Y3vxB3YcYe
sNsAni3yxlXvaSwkZYBJ0THRN0DubbKU
=E9d/
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Per-user management rights

2012-01-20 Thread Tim De Pauw
Not sure; a quick test seemed to suggest this, but I may have been doing 
something wrong. If I have two hosts X and Y that resolve to the same 
IP, can I still use AJP to forward requests to the respective Tomcat host?


Regardless, I came across an old discussion [1], which suggests 
implementing a servlet filter to check the authenticated user against an 
ACL, and throwing a 403 if necessary. I hacked a filter together, placed 
the class file under /webapps/manager/WEB-INF/classes, mapped it to 
/text/* in /webapps/manager/WEB-INF/web.xml, and I was good to go!


Tim

[1] 
http://grokbase.com/t/tomcat.apache.org/users/2003/04/mananger-roles/10m2nulzpoufgawoj6xp2bfyxcr4


On 1/20/2012 5:00 PM, Christopher Schultz wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Tim,

On 1/20/12 10:35 AM, Tim De Pauw wrote:

Multiple hosts probably won't solve this problem either. I'm using
AJP, which doesn't seem to play well with vhosts.


Wait, what?

In what way does AJP not play well with vhosts?

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Zj6YACgkQ9CaO5/Lv0PBPYwCfbfYEdMGVGcSYcem+7PKmqZFB
VTkAn3P1JIFjt/shlOxlneGmnRz8wbst
=Zail
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



--
Tim De Pauw 
Vakgroep Informatica
Geassocieerde faculteit Toegepaste Ingenieurswetenschappen
Hogeschool Gent
http://tiwi.be/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Single virtual tomcat application which serves multiple contexts

2012-01-20 Thread André Warnier

Egor Samarkhanov wrote:

Hello !

I have multiple clients:
  client 1 - 40 users
  client 2 - 50 users
  client 3 - 60 users

And I have a web application that is supposed to serve the clients.
The application is deployed into Tomcat. Each client has it's own database.

What I want to implement is the single web application instance which
servers all  the clients. The client (and the database to connect to)
is identified by the context path from the URL.

I.e. I imply the following scenario:

1. Some user requestes the http://mydomain.com/client1/
2. Tomcat invokes a single instance of my application (no matter
   which  context is requested)
3. My application processes the rest of the request thinking that it's
   deployed to /client1 context path, i.e. all redirect or relative URLs
   should be resolved against http://mydomain.com/client1/

When the client 2 requests the http://mydomain.com/client2/, I want my
application (the same instance) now process it just like if it was
deployed to /client2 context path.

Is this possible in Tomcat?


Personal opinion:

By putting some considerable effort into it, it is certainly possible to do something like 
that, by rewriting URLs and/or proxying and/or making all your pages refer to the context 
etc..


But the question is : why ?
If
- you have many, many "clients"
- or you application is so big that having multiple copies of it totally fills 
your disk
- or your application for "client1" needs to share data with the application for 
"client2"
then it may be worth thinking about this.

But otherwise, you probably would immensely simplify your life by using a separate virtual 
host for each client, and have for each virtual host a separate appBase, in which you just 
deploy a copy of your application.


Think of the security issues otherwise, to avoid one client being ever able to access the 
data of another; or think of what happens when one of these clients in the future asks you 
for that little change just for him.. etc..


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Single virtual tomcat application which serves multiple contexts

2012-01-20 Thread Pid
On 20/01/2012 15:56, Egor Samarkhanov wrote:
> Hello !
> 
> I have multiple clients:
>   client 1 - 40 users
>   client 2 - 50 users
>   client 3 - 60 users
> 
> And I have a web application that is supposed to serve the clients.
> The application is deployed into Tomcat. Each client has it's own database.
> 
> What I want to implement is the single web application instance which
> servers all  the clients. The client (and the database to connect to)
> is identified by the context path from the URL.
> 
> I.e. I imply the following scenario:
> 
> 1. Some user requestes the http://mydomain.com/client1/
> 2. Tomcat invokes a single instance of my application (no matter
>which  context is requested)
> 3. My application processes the rest of the request thinking that it's
>deployed to /client1 context path, i.e. all redirect or relative URLs
>should be resolved against http://mydomain.com/client1/
> 
> When the client 2 requests the http://mydomain.com/client2/, I want my
> application (the same instance) now process it just like if it was
> deployed to /client2 context path.
> 
> Is this possible in Tomcat?

No, it's not.

If you want to build a multi-tenant application, you should:

1. Make your application the ROOT application.
2. Then use the first part of the path to determine which tenant.
3. Use the path data to select a configuration as required.

What is the benefit in making it one application?


p



-- 

[key:62590808]



signature.asc
Description: OpenPGP digital signature


Re: Per-user management rights

2012-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Tim,

On 1/20/12 10:35 AM, Tim De Pauw wrote:
> Multiple hosts probably won't solve this problem either. I'm using
> AJP, which doesn't seem to play well with vhosts.

Wait, what?

In what way does AJP not play well with vhosts?

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8Zj6YACgkQ9CaO5/Lv0PBPYwCfbfYEdMGVGcSYcem+7PKmqZFB
VTkAn3P1JIFjt/shlOxlneGmnRz8wbst
=Zail
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Single virtual tomcat application which serves multiple contexts

2012-01-20 Thread Egor Samarkhanov
Hello !

I have multiple clients:
  client 1 - 40 users
  client 2 - 50 users
  client 3 - 60 users

And I have a web application that is supposed to serve the clients.
The application is deployed into Tomcat. Each client has it's own database.

What I want to implement is the single web application instance which
servers all  the clients. The client (and the database to connect to)
is identified by the context path from the URL.

I.e. I imply the following scenario:

1. Some user requestes the http://mydomain.com/client1/
2. Tomcat invokes a single instance of my application (no matter
   which  context is requested)
3. My application processes the rest of the request thinking that it's
   deployed to /client1 context path, i.e. all redirect or relative URLs
   should be resolved against http://mydomain.com/client1/

When the client 2 requests the http://mydomain.com/client2/, I want my
application (the same instance) now process it just like if it was
deployed to /client2 context path.

Is this possible in Tomcat?


thanks in advance

-- 
Best regards,
Egor Samarkhanov (ego...@actimind.com)
Actimind, Inc.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Per-user management rights

2012-01-20 Thread Tim De Pauw

Thanks for your reply.

I don't suppose there's an alternative to the Manager app floating 
around that would allow this? I came across a commercial solution at 
some point (which I forgot to bookmark, apparently), but that's not 
really an option.


Multiple hosts probably won't solve this problem either. I'm using AJP, 
which doesn't seem to play well with vhosts.


I guess I'll either have to trust my users (actually, students), or cook 
up something filesystem-based. Pity, but oh well.


Tim

On 1/20/2012 4:23 PM, Mark Thomas wrote:

On 20/01/2012 15:19, Tim De Pauw wrote:

I assume I'm doing something fundamentally wrong here, but the docs
don't seem to cover this sort of thing explicitly. I guess I could
create separate hosts for each app and user, but that seems tedious and
unnecessary.

Any pointers? Thanks.


You can't do what you want to do with the Manager app. It doesn't
support that granularity of security. You can control individual
operations but not the combination of operation *and* context.

Multiple hosts would give you more control but a user would still be
able to deploy any context on the host on which they had deploy permission.

Mark


--
Tim De Pauw 
Vakgroep Informatica
Geassocieerde faculteit Toegepaste Ingenieurswetenschappen
Hogeschool Gent
http://tiwi.be/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Per-user management rights

2012-01-20 Thread Mark Thomas
On 20/01/2012 15:19, Tim De Pauw wrote:
> I assume I'm doing something fundamentally wrong here, but the docs
> don't seem to cover this sort of thing explicitly. I guess I could
> create separate hosts for each app and user, but that seems tedious and
> unnecessary.
> 
> Any pointers? Thanks.

You can't do what you want to do with the Manager app. It doesn't
support that granularity of security. You can control individual
operations but not the combination of operation *and* context.

Multiple hosts would give you more control but a user would still be
able to deploy any context on the host on which they had deploy permission.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Per-user management rights

2012-01-20 Thread Tim De Pauw

Hi all,

I'm trying to configure Tomcat so that a separate login is required to 
deploy certain apps. Let's say I have a '/someapp' context, which I 
would like 'someuser' to deploy remotely. However, 'someuser' cannot 
deploy apps to '/someotherapp', and conversely, 'someotheruser' cannot 
touch '/someapp'.


So far, I tried to add a Context to server.xml (I know it's discouraged) 
for the app, containing a memory realm that has its own user list:



  


The file realm.someapp.xml simply contains:


  


But now, I'm mostly stuck. I'm guessing 'someuser' would also have to 
have access to the manager app in order to deploy, but that would mean 
that this user would also have management access to other people's apps.


I assume I'm doing something fundamentally wrong here, but the docs 
don't seem to cover this sort of thing explicitly. I guess I could 
create separate hosts for each app and user, but that seems tedious and 
unnecessary.


Any pointers? Thanks.

Kind regards,

--
Tim De Pauw 
Vakgroep Informatica
Geassocieerde faculteit Toegepaste Ingenieurswetenschappen
Hogeschool Gent
http://tiwi.be/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Unable to sendViaPost to url...... .... java.net.SocketTimeoutException: Read timed out

2012-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Bert,

On 1/18/12 4:22 PM, Bert Verhees wrote:
> I have done my testing, and at this moment, it seems that I found
> the problem, I forgot to close a databaseconnection in a function
> which is called a zillion times. Just one line of code, and the
> problem was solved.

Consider doing the following:

In your development environment, set maxActive in your connection pool
to "1". Also set the "logAbandoned" and similar settings to catch
resources that you don't properly close.

With maxActive="1", your webapp will stop dead for several minutes
while the connection pool starves waiting for the one missing
connection to (never) be returned to the pool before killing it and
creating a new one. Trust me: you'll notice when that happens.

We have the logAbandoned stuff even set in production just in case we
don't notice something in development.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8ZhQoACgkQ9CaO5/Lv0PAd9ACfXiOQju6eLIMpB14bZhbkip/B
WjoAoJYJLf+vpYqh3IGYumI7zizO6Ggp
=cCmq
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: [SOLVED] Cannot inherit from final class

2012-01-20 Thread aaron.stromas
I'm aware of that. The reason I went with such an old version of Spring is that 
Axis2 POJO Spring example uses that version of Spring (1.2.8).
The applicationContext.xml uses the DOCROOT element, not XML name spaces, not 
XML namespaces, so I did not want to vary too many things at the same time.

-a

-Original Message-
From: Pid [mailto:p...@pidster.com] 
Sent: Friday, January 20, 2012 4:33 AM
To: Tomcat Users List
Subject: Re: [SOLVED] Cannot inherit from final class

On 19/01/2012 22:36, aaron.stro...@rsa.com wrote:
> Ugm. Axis2 sample uses it, so did I

So Spring 3.1 is now out and the internetz says that Spring 1.2.8 was released 
8 May 2006.  Is this a production system, might I ask?


p

> -Original Message-
> From: Pid [mailto:p...@pidster.com]
> Sent: Thursday, January 19, 2012 5:32 PM
> To: Tomcat Users List
> Subject: Re: [SOLVED] Cannot inherit from final class
> 
> On 19/01/2012 21:38, aaron.stro...@rsa.com wrote:
>> deployed in it a web service using Spring  v1.2.8
> 
> Are you really using Spring 1.2.8?
> 
> 
> p
> 


-- 

[key:62590808]


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Caching of protected static content with Expires header: Expires Thu, 01 Jan 1970 03:00:00 EET?

2012-01-20 Thread Francis GALIEGUE
On Fri, Jan 20, 2012 at 15:05,   wrote:
> Violeta Georgieva  wrote:
>
[...]
>>My question is why the expires header is set with this value? Doesn't
>>this
>>prevent caching?
>
> Yes. That is the point.
>

But there is no need for an expires header if you don't want caching.
It is enough to "Cache-control: no-cache" (or "no-store", though the
latter wreaks havoc on IE and downloads) or, if you are _still_ using
HTTP/1.0, "Pragma: no-cache". The "Expires" is not needed at all.

-- 
Francis Galiegue
ONE2TEAM
Ingénieur système
Mob : +33 (0) 683 877 875
Tel : +33 (0) 178 945 552
f...@one2team.com
40 avenue Raymond Poincaré
75116 Paris

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize class javax.servlet.http.Cookie

2012-01-20 Thread Guillermo GARCIA OCHOA
As suggested, the problem was the security manager:

Most of our login related classes are the CATALINA_BASE/lib folder. So 
uncommenting this lines in the catalina.policy files fix the problem:

// If using a per instance lib directory, i.e. ${catalina.base}/lib,
// then the following permission will need to be uncommented
grant codeBase "file:${catalina.base}/lib/-" {
 permission java.security.AllPermission;
};

Thanks to Konstantin Kolinko for the quick hint!

PS: Why the exception is not clear enough??

-Original Message-
From: Guillermo GARCIA OCHOA [mailto:guillermo.garcia-oc...@inova-software.com] 
Sent: vendredi 20 janvier 2012 13:11
To: Tomcat Users List
Subject: RE: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize 
class javax.servlet.http.Cookie

Answers inline ...

-Original Message-
From: Konstantin Kolinko [mailto:knst.koli...@gmail.com]
Sent: vendredi 20 janvier 2012 13:06
To: Tomcat Users List
Subject: Re: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize 
class javax.servlet.http.Cookie

2012/1/20 Guillermo GARCIA OCHOA :
> I have an application that use j_security for a form-based authentication. 
> When the application is deployed for the first time (or the tomcat is 
> restarted) user gets this exception when trying access a protected content 
> directly (without login).
>
> GRAVE: Servlet.service() for servlet [default] in context with path 
> [/mycontext]  threw exception [Could not initialize class 
> javax.servlet.http.Cookie] with root cause
>
>    java.lang.NoClassDefFoundError: Could not initialize class 
> javax.servlet.http.Cookie
>
>    at
> org.apache.catalina.core.ApplicationSessionCookieConfig.createSessionC
> ookie(ApplicationSessionCookieConfig.java:127)
>
>    at
> org.apache.catalina.connector.Request.doGetSession(Request.java:2875)
>
>    at
> org.apache.catalina.connector.Request.getSession(Request.java:2307)
>
>    at
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction
> .run(RequestFacade.java:216)
>
>    at
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction
> .run(RequestFacade.java:205)
>
>    at java.security.AccessController.doPrivileged(Native Method)
>
>    at
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.j
> ava:894)
>
>    at
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.j
> ava:909)
>
>    at
> javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletReq
> uestWrapper.java:238)
>
>    at
> com.mycompany.myfilter.SaasComponentImpl.getTenantId(SaasComponentImpl
> .java:284)
>
> The excepted behaviour is to redirect the user to the login form and when the 
> user logs in redirect him to the requested protected resource.
>
> But the weird thing is this works correctly if the first request send to the 
> rebooted server ask for the login form!!! It seems that after this tomcat 
> find and load correctly the cookie class and then all the request are handled 
> as expected.
>
> Why tomcat cannot find the Cookie class that is for sure in the 
> lib/servlet-api.jar? IMHO, no mmetter when this class is asked to be load for 
> the first time ... it should be there for any valve, servlet, filter, etc ... 
> I'm right?
>
> PS: This was working fine before the app was migrated from tomcat 6.
>

1. Your exact version of Tomcat x.y.z =? 

*** Tomcat 7.0.23

2. Your OS

* Windows server 2008

3. Do you think that you are running with Java's SecurityManager enabled? [1]

*** Is enabled whit  the same configurations that we used to use with 
tomcat 6

4. Is there anything else in the logs?

* Nothing else

I thing that the "Could not initialize class" message means that the class is 
found, but its initialization failed.

I wonder though why it is not an instance of ExceptionInInitializerError.

[1] http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Caching of protected static content with Expires header: Expires Thu, 01 Jan 1970 03:00:00 EET?

2012-01-20 Thread markt
Violeta Georgieva  wrote:

>Hi,
>
>If the static content is not protected then by default it is cached and
>the
>corresponding headers are set - see screenshot1 & screenshot2.
>but when I put it as protected content the following headers are set:
>Cache-control:private and Expires header: Expires Thu, 01 Jan 1970
>03:00:00
>EET - see screenshot3 & screenshot4
>My question is why the expires header is set with this value? Doesn't
>this
>prevent caching?

Yes. That is the point.

Mark


>
>I'm running Tomcat 7.0.23
>
>Thanks in advance
>Regards
>Violeta
>
>-
>To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>For additional commands, e-mail: users-h...@tomcat.apache.org



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Caching of protected static content with Expires header: Expires Thu, 01 Jan 1970 03:00:00 EET?

2012-01-20 Thread Francis GALIEGUE
On Fri, Jan 20, 2012 at 14:03, Violeta Georgieva  wrote:
> Hi,
>
> If the static content is not protected then by default it is cached and the
> corresponding headers are set - see screenshot1 & screenshot2.
> but when I put it as protected content the following headers are set:
> Cache-control:private and Expires header: Expires Thu, 01 Jan 1970 03:00:00
> EET - see screenshot3 & screenshot4
> My question is why the expires header is set with this value? Doesn't this
> prevent caching?
>
> I'm running Tomcat 7.0.23
>

I take it you are using Tomcat's caching directives, so...

Show us the relevant portions of the configuration file.

-- 
Francis Galiegue
ONE2TEAM
Ingénieur système
Mob : +33 (0) 683 877 875
Tel : +33 (0) 178 945 552
f...@one2team.com
40 avenue Raymond Poincaré
75116 Paris

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Cannot rid of expired Certificate ...

2012-01-20 Thread Justin Larose
> From: Andrew Erskine 
> To: Tomcat Users List 
> Date: 01/20/2012 06:05 AM
> Subject: RE: Cannot rid of expired Certificate ...
> 
> -Original Message-
> From: Pid [mailto:p...@pidster.com]
> Sent: 20 January 2012 11:00
> To: Tomcat Users List
> Subject: Re: Cannot rid of expired Certificate ...
> On 20/01/2012 10:52, Andrew Erskine wrote:
> > So how do I do that .. I'm only replying to questions ..
> S0, scroll down a bit...
> > On 20 Jan 2012, at 10:51, "André Warnier"  wrote:
> ... and reply below
> >> "Top post" is like this : when I reply to a message, at the top 
> of the message.
> >> It makes it much harder to follow the logic flow of a conversation.
> >>
> >> Andrew Erskine wrote:
> >>> Top post ?
> ... each point.
> 
> p
> 
> >>> Win2003svr
> >>>
> >>> Yes correct store .. the only one I've been using .. did try and
> clear the cache on firefox will try ie
> >>>
> >>
> >> Answering below the question is much clearer.
> >>
> >> like this ? .. aha
> >>
> >>

Andrew,

When you hit the reply button use the option that says "Reply with 
Internet-Style history". That will add the ">"'s to all the previous 
comments and then you comment under each relevant one. =)

- Justin

**
This email and any files transmitted with it are intended solely for 
the use of the individual or agency to whom they are addressed. 
If you have received this email in error please notify the Navy 
Exchange Service Command e-mail administrator. This footnote 
also confirms that this email message has been scanned for the
presence of computer viruses.

Thank You!
**



RE: Cannot rid of expired Certificate ...

2012-01-20 Thread Brooke Hedrick
On Jan 20, 2012 6:47 AM, "Brooke Hedrick" 
wrote:
>
> H
>
> On Jan 20, 2012 4:23 AM, "Andrew Erskine"  wrote:
> >
> > Top post ?
> >
> > Win2003svr
> >
> > Yes correct store .. the only one I've been using .. did try and clear
the cache on firefox will try ie
> >
> > Thanks.
> > -Original Message-
> > From: Pid [mailto:p...@pidster.com]
> > Sent: 20 January 2012 09:51
> > To: Tomcat Users List
> > Subject: Re: Cannot rid of expired Certificate ...
> >
> > On 20/01/2012 02:28, Brooke Hedrick wrote:
> > > Are you sure you updated the correct keystore?  Which o/s are you
running?
> >
> > (Please don't top post.)
> >
> > It's worth noting that some browsers appear to cache certs and
sometimes changes are not immediately apparent.
> >
> >
> > p
> >
> > > On Jan 19, 2012 2:54 PM, "Darryl Lewis" 
wrote:
> > >
> > >> Did you restart tomcat?
> > >>
> > >> On 20/01/12 5:00 AM, "Andrew Erskine"  wrote:
> > >>
> > >>> I have a self certificate that expired today.
> > >>>
> > >>>
> > >>>
> > >>> I removed the certificate from the keystore which the server.xml is
> > >>> pointin= g at and generated a new one with the same alias and I can
> > >>> see that cert in=  the keystore.
> > >>>
> > >>>
> > >>>
> > >>> I've been through all my certificate locations on firefox and
> > >>> removed any i= nstance
> > >>>
> > >>>
> > >>>
> > >>> On restarting tomcat and starting a new browser the website is still
> > >>> saying=  I have an expired certificate - so where is this being
> > >>> picked up
> > >> >from ? an= d is there a step I'm missing ?
> > >>>
> > >>>
> > >>>
> > >>>
> > >>>
> > >>> Thanks.
> > >>>
> > >>
> > >>
> > >> -
> > >> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > >> For additional commands, e-mail: users-h...@tomcat.apache.org
> > >>
> > >>
> > >
> >
> >
> > --
> >
> > [key:62590808]
> >
> >
> > -
> > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
>
> Where is your keystore located?  When running on with Tomcat poviding the
cert, as I recall, there were 2 options of keystore placement.  If you are
using APR you can specify the location.  If not, it assumes it has to look
under your 'profile' home.  So, c:/documents ands settings/... or
c:/users/...  Are you using APR?

Another question...  To rule out the browser, have you tried using openssl
to retrieve tthe certificate?


RE: Cannot rid of expired Certificate ...

2012-01-20 Thread Brooke Hedrick
H

On Jan 20, 2012 4:23 AM, "Andrew Erskine"  wrote:
>
> Top post ?
>
> Win2003svr
>
> Yes correct store .. the only one I've been using .. did try and clear
the cache on firefox will try ie
>
> Thanks.
> -Original Message-
> From: Pid [mailto:p...@pidster.com]
> Sent: 20 January 2012 09:51
> To: Tomcat Users List
> Subject: Re: Cannot rid of expired Certificate ...
>
> On 20/01/2012 02:28, Brooke Hedrick wrote:
> > Are you sure you updated the correct keystore?  Which o/s are you
running?
>
> (Please don't top post.)
>
> It's worth noting that some browsers appear to cache certs and sometimes
changes are not immediately apparent.
>
>
> p
>
> > On Jan 19, 2012 2:54 PM, "Darryl Lewis" 
wrote:
> >
> >> Did you restart tomcat?
> >>
> >> On 20/01/12 5:00 AM, "Andrew Erskine"  wrote:
> >>
> >>> I have a self certificate that expired today.
> >>>
> >>>
> >>>
> >>> I removed the certificate from the keystore which the server.xml is
> >>> pointin= g at and generated a new one with the same alias and I can
> >>> see that cert in=  the keystore.
> >>>
> >>>
> >>>
> >>> I've been through all my certificate locations on firefox and
> >>> removed any i= nstance
> >>>
> >>>
> >>>
> >>> On restarting tomcat and starting a new browser the website is still
> >>> saying=  I have an expired certificate - so where is this being
> >>> picked up
> >> >from ? an= d is there a step I'm missing ?
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> Thanks.
> >>>
> >>
> >>
> >> -
> >> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>
> >>
> >
>
>
> --
>
> [key:62590808]
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>

Where is your keystore located?  When running on with Tomcat poviding the
cert, as I recall, there were 2 options of keystore placement.  If you are
using APR you can specify the location.  If not, it assumes it has to look
under your 'profile' home.  So, c:/documents ands settings/... or
c:/users/...  Are you using APR?


RE: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize class javax.servlet.http.Cookie

2012-01-20 Thread Guillermo GARCIA OCHOA
Answers inline ...

-Original Message-
From: Konstantin Kolinko [mailto:knst.koli...@gmail.com] 
Sent: vendredi 20 janvier 2012 13:06
To: Tomcat Users List
Subject: Re: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize 
class javax.servlet.http.Cookie

2012/1/20 Guillermo GARCIA OCHOA :
> I have an application that use j_security for a form-based authentication. 
> When the application is deployed for the first time (or the tomcat is 
> restarted) user gets this exception when trying access a protected content 
> directly (without login).
>
> GRAVE: Servlet.service() for servlet [default] in context with path 
> [/mycontext]  threw exception [Could not initialize class 
> javax.servlet.http.Cookie] with root cause
>
>    java.lang.NoClassDefFoundError: Could not initialize class 
> javax.servlet.http.Cookie
>
>    at 
> org.apache.catalina.core.ApplicationSessionCookieConfig.createSessionC
> ookie(ApplicationSessionCookieConfig.java:127)
>
>    at 
> org.apache.catalina.connector.Request.doGetSession(Request.java:2875)
>
>    at 
> org.apache.catalina.connector.Request.getSession(Request.java:2307)
>
>    at 
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction
> .run(RequestFacade.java:216)
>
>    at 
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction
> .run(RequestFacade.java:205)
>
>    at java.security.AccessController.doPrivileged(Native Method)
>
>    at 
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.j
> ava:894)
>
>    at 
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.j
> ava:909)
>
>    at 
> javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletReq
> uestWrapper.java:238)
>
>    at 
> com.mycompany.myfilter.SaasComponentImpl.getTenantId(SaasComponentImpl
> .java:284)
>
> The excepted behaviour is to redirect the user to the login form and when the 
> user logs in redirect him to the requested protected resource.
>
> But the weird thing is this works correctly if the first request send to the 
> rebooted server ask for the login form!!! It seems that after this tomcat 
> find and load correctly the cookie class and then all the request are handled 
> as expected.
>
> Why tomcat cannot find the Cookie class that is for sure in the 
> lib/servlet-api.jar? IMHO, no mmetter when this class is asked to be load for 
> the first time ... it should be there for any valve, servlet, filter, etc ... 
> I'm right?
>
> PS: This was working fine before the app was migrated from tomcat 6.
>

1. Your exact version of Tomcat x.y.z =? 

*** Tomcat 7.0.23

2. Your OS

* Windows server 2008

3. Do you think that you are running with Java's SecurityManager enabled? [1]

*** Is enabled whit  the same configurations that we used to use with 
tomcat 6

4. Is there anything else in the logs?

* Nothing else

I thing that the "Could not initialize class" message means that the class is 
found, but its initialization failed.

I wonder though why it is not an instance of ExceptionInInitializerError.

[1] http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize class javax.servlet.http.Cookie

2012-01-20 Thread Konstantin Kolinko
2012/1/20 Guillermo GARCIA OCHOA :
> I have an application that use j_security for a form-based authentication. 
> When the application is deployed for the first time (or the tomcat is 
> restarted) user gets this exception when trying access a protected content 
> directly (without login).
>
> GRAVE: Servlet.service() for servlet [default] in context with path 
> [/mycontext]  threw exception [Could not initialize class 
> javax.servlet.http.Cookie] with root cause
>
>    java.lang.NoClassDefFoundError: Could not initialize class 
> javax.servlet.http.Cookie
>
>    at 
> org.apache.catalina.core.ApplicationSessionCookieConfig.createSessionCookie(ApplicationSessionCookieConfig.java:127)
>
>    at org.apache.catalina.connector.Request.doGetSession(Request.java:2875)
>
>    at org.apache.catalina.connector.Request.getSession(Request.java:2307)
>
>    at 
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:216)
>
>    at 
> org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:205)
>
>    at java.security.AccessController.doPrivileged(Native Method)
>
>    at 
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:894)
>
>    at 
> org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:909)
>
>    at 
> javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:238)
>
>    at 
> com.mycompany.myfilter.SaasComponentImpl.getTenantId(SaasComponentImpl.java:284)
>
> The excepted behaviour is to redirect the user to the login form and when the 
> user logs in redirect him to the requested protected resource.
>
> But the weird thing is this works correctly if the first request send to the 
> rebooted server ask for the login form!!! It seems that after this tomcat 
> find and load correctly the cookie class and then all the request are handled 
> as expected.
>
> Why tomcat cannot find the Cookie class that is for sure in the 
> lib/servlet-api.jar? IMHO, no mmetter when this class is asked to be load for 
> the first time ... it should be there for any valve, servlet, filter, etc ... 
> I'm right?
>
> PS: This was working fine before the app was migrated from tomcat 6.
>

1. Your exact version of Tomcat x.y.z =?
2. Your OS = ?
3. Do you think that you are running with Java's SecurityManager enabled? [1]

4. Is there anything else in the logs?

I thing that the "Could not initialize class" message means that the
class is found, but its initialization failed.

I wonder though why it is not an instance of ExceptionInInitializerError.


[1] http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat 7 - java.lang.NoClassDefFoundError: Could not initialize class javax.servlet.http.Cookie

2012-01-20 Thread Guillermo GARCIA OCHOA
I have an application that use j_security for a form-based authentication. When 
the application is deployed for the first time (or the tomcat is restarted) 
user gets this exception when trying access a protected content directly 
(without login).

GRAVE: Servlet.service() for servlet [default] in context with path 
[/mycontext]  threw exception [Could not initialize class 
javax.servlet.http.Cookie] with root cause

java.lang.NoClassDefFoundError: Could not initialize class 
javax.servlet.http.Cookie

at 
org.apache.catalina.core.ApplicationSessionCookieConfig.createSessionCookie(ApplicationSessionCookieConfig.java:127)

at org.apache.catalina.connector.Request.doGetSession(Request.java:2875)

at org.apache.catalina.connector.Request.getSession(Request.java:2307)

at 
org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:216)

at 
org.apache.catalina.connector.RequestFacade$GetSessionPrivilegedAction.run(RequestFacade.java:205)

at java.security.AccessController.doPrivileged(Native Method)

at 
org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:894)

at 
org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:909)

at 
javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:238)

at 
com.mycompany.myfilter.SaasComponentImpl.getTenantId(SaasComponentImpl.java:284)

The excepted behaviour is to redirect the user to the login form and when the 
user logs in redirect him to the requested protected resource.

But the weird thing is this works correctly if the first request send to the 
rebooted server ask for the login form!!! It seems that after this tomcat find 
and load correctly the cookie class and then all the request are handled as 
expected.

Why tomcat cannot find the Cookie class that is for sure in the 
lib/servlet-api.jar? IMHO, no mmetter when this class is asked to be load for 
the first time ... it should be there for any valve, servlet, filter, etc ... 
I'm right?

PS: This was working fine before the app was migrated from tomcat 6.



RE: Cannot rid of expired Certificate ...

2012-01-20 Thread Andrew Erskine

-Original Message-
From: Pid [mailto:p...@pidster.com] 
Sent: 20 January 2012 11:00
To: Tomcat Users List
Subject: Re: Cannot rid of expired Certificate ...

On 20/01/2012 10:52, Andrew Erskine wrote:
> So how do I do that .. I'm only replying to questions ..

So, scroll down a bit...

> On 20 Jan 2012, at 10:51, "André Warnier"  wrote:

... and reply below

>> "Top post" is like this : when I reply to a message, at the top of the 
>> message.
>> It makes it much harder to follow the logic flow of a conversation.
>>
>> Andrew Erskine wrote:
>>> Top post ?

... each point.


p


>>> Win2003svr
>>>
>>> Yes correct store .. the only one I've been using .. did try and clear the 
>>> cache on firefox will try ie
>>>
>>
>> Answering below the question is much clearer.
>>
>> like this ? .. aha
>>
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>


-- 

[key:62590808]



Re: Cannot rid of expired Certificate ...

2012-01-20 Thread Pid
On 20/01/2012 10:52, Andrew Erskine wrote:
> So how do I do that .. I'm only replying to questions ..

So, scroll down a bit...

> On 20 Jan 2012, at 10:51, "André Warnier"  wrote:

... and reply below

>> "Top post" is like this : when I reply to a message, at the top of the 
>> message.
>> It makes it much harder to follow the logic flow of a conversation.
>>
>> Andrew Erskine wrote:
>>> Top post ?

... each point.


p


>>> Win2003svr
>>>
>>> Yes correct store .. the only one I've been using .. did try and clear the 
>>> cache on firefox will try ie
>>>
>>
>> Answering below the question is much clearer.
>>
>> --> your answer here :
>>
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>


-- 

[key:62590808]



signature.asc
Description: OpenPGP digital signature


Re: Cannot rid of expired Certificate ...

2012-01-20 Thread Andrew Erskine
So how do I do that .. I'm only replying to questions ..

On 20 Jan 2012, at 10:51, "André Warnier"  wrote:

> "Top post" is like this : when I reply to a message, at the top of the 
> message.
> It makes it much harder to follow the logic flow of a conversation.
> 
> Andrew Erskine wrote:
>> Top post ?
>> 
>> Win2003svr
>> 
>> Yes correct store .. the only one I've been using .. did try and clear the 
>> cache on firefox will try ie
>> 
> 
> Answering below the question is much clearer.
> 
> --> your answer here :
> 
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 


Re: Cannot rid of expired Certificate ...

2012-01-20 Thread André Warnier

"Top post" is like this : when I reply to a message, at the top of the message.
It makes it much harder to follow the logic flow of a conversation.

Andrew Erskine wrote:

Top post ?

Win2003svr

Yes correct store .. the only one I've been using .. did try and clear the 
cache on firefox will try ie



Answering below the question is much clearer.

--> your answer here :


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Cannot rid of expired Certificate ...

2012-01-20 Thread Andrew Erskine
Top post ?

Win2003svr

Yes correct store .. the only one I've been using .. did try and clear the 
cache on firefox will try ie

Thanks.
-Original Message-
From: Pid [mailto:p...@pidster.com] 
Sent: 20 January 2012 09:51
To: Tomcat Users List
Subject: Re: Cannot rid of expired Certificate ...

On 20/01/2012 02:28, Brooke Hedrick wrote:
> Are you sure you updated the correct keystore?  Which o/s are you running?

(Please don't top post.)

It's worth noting that some browsers appear to cache certs and sometimes 
changes are not immediately apparent.


p

> On Jan 19, 2012 2:54 PM, "Darryl Lewis"  wrote:
> 
>> Did you restart tomcat?
>>
>> On 20/01/12 5:00 AM, "Andrew Erskine"  wrote:
>>
>>> I have a self certificate that expired today.
>>>
>>>
>>>
>>> I removed the certificate from the keystore which the server.xml is 
>>> pointin= g at and generated a new one with the same alias and I can 
>>> see that cert in=  the keystore.
>>>
>>>
>>>
>>> I've been through all my certificate locations on firefox and 
>>> removed any i= nstance
>>>
>>>
>>>
>>> On restarting tomcat and starting a new browser the website is still 
>>> saying=  I have an expired certificate - so where is this being 
>>> picked up
>> >from ? an= d is there a step I'm missing ?
>>>
>>>
>>>
>>>
>>>
>>> Thanks.
>>>
>>
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>
>>
> 


-- 

[key:62590808]


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Cannot rid of expired Certificate ...

2012-01-20 Thread Pid
On 20/01/2012 02:28, Brooke Hedrick wrote:
> Are you sure you updated the correct keystore?  Which o/s are you running?

(Please don't top post.)

It's worth noting that some browsers appear to cache certs and sometimes
changes are not immediately apparent.


p

> On Jan 19, 2012 2:54 PM, "Darryl Lewis"  wrote:
> 
>> Did you restart tomcat?
>>
>> On 20/01/12 5:00 AM, "Andrew Erskine"  wrote:
>>
>>> I have a self certificate that expired today.
>>>
>>>
>>>
>>> I removed the certificate from the keystore which the server.xml is
>>> pointin= g at and generated a new one with the same alias and I can see
>>> that cert in=  the keystore.
>>>
>>>
>>>
>>> I've been through all my certificate locations on firefox and removed any
>>> i= nstance
>>>
>>>
>>>
>>> On restarting tomcat and starting a new browser the website is still
>>> saying=  I have an expired certificate - so where is this being picked up
>> >from ? an= d is there a step I'm missing ?
>>>
>>>
>>>
>>>
>>>
>>> Thanks.
>>>
>>
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>
>>
> 


-- 

[key:62590808]



signature.asc
Description: OpenPGP digital signature


Re: [SOLVED] Cannot inherit from final class

2012-01-20 Thread Pid
On 19/01/2012 22:36, aaron.stro...@rsa.com wrote:
> Ugm. Axis2 sample uses it, so did I

So Spring 3.1 is now out and the internetz says that Spring 1.2.8 was
released 8 May 2006.  Is this a production system, might I ask?


p

> -Original Message-
> From: Pid [mailto:p...@pidster.com] 
> Sent: Thursday, January 19, 2012 5:32 PM
> To: Tomcat Users List
> Subject: Re: [SOLVED] Cannot inherit from final class
> 
> On 19/01/2012 21:38, aaron.stro...@rsa.com wrote:
>> deployed in it a web service using Spring  v1.2.8
> 
> Are you really using Spring 1.2.8?
> 
> 
> p
> 


-- 

[key:62590808]



signature.asc
Description: OpenPGP digital signature