[Book Information] Apache TomEE Cookbook

2013-08-23 Thread Gurkan Erdogdu
Hi Tomcat users, I have written a small cook book about Apache TomEE (Apache Tomcat + Web Profile Stack). My book Apache TomEE Cookbook published by Amazon Create Space. This is the first book in the market related to Apache TomEE. I thought that you can also interest with this book. You can

OT: Re: what if I lost the keystore which generate the CSR

2013-08-23 Thread Jan Vávra
Well, the original cert will be revoked and you can create new CSR and reapply new cert. With Thawte we did this one year ago without a problem. Contact Thawte support. Jan. Sorry I am a beginner about ssl cert. according to

Re: Tomcat 7 / Java 7 with TLS 1.2 algorithms

2013-08-23 Thread Aurélien Terrestris
It seems incorrect to me because RFC 5246 in 1.2 Major Differences from TLS 1.1 says this : .. All cipher suites in this document use P_SHA256. .. Added HMAC-SHA256 cipher suites I can't read anywhere that SHA384 and others SHOULD or MUST be implemented. Other RFCs updating this 5246 (5746,

how to log unauthorized https access attempts (secure=true clientAuth=true)

2013-08-23 Thread Ja kub
Hallo I use https with client cert authentication Connector protocol=...Http11NioProtocol SSLEnabled=true scheme=https secure=true clientAuth=true sslProtocol=TLS keystoreFile=...jks key..Pass=... keystoreType=JKS truststoreFile=...jks trust..Pass=.. / AccessLogValve cannot be

Re: Fwd: Tomcat 7 / Java 7 with TLS 1.2 algorithms

2013-08-23 Thread Aurélien Terrestris
Hi the JSSE Reference Guide defines which possibilities for anyone implementing a JSSE provider (let's call it an API if you want). Oracle's provider only implements a part of this API, misleading you to believe SHA384 is available when it's unfortunately not. About Bouncy Castle, I believe they

Re: how to log unauthorized https access attempts (secure=true clientAuth=true)

2013-08-23 Thread Mark Thomas
On 23/08/2013 11:02, Ja kub wrote: Hallo I use https with client cert authentication Connector protocol=...Http11NioProtocol SSLEnabled=true scheme=https secure=true clientAuth=true sslProtocol=TLS keystoreFile=...jks key..Pass=... keystoreType=JKS truststoreFile=...jks

Re: how to log unauthorized https access attempts (secure=true clientAuth=true)

2013-08-23 Thread Ja kub
Thx for response, Will it be developed in next releases of tomcat 7? Or it won't because there is no such need, and such issues should be handled some other way? If some other way is recommended, than how should such functionality be handled? Regards Jakub On Fri, Aug 23, 2013 at 1:09 PM, Mark

Re: how to log unauthorized https access attempts (secure=true clientAuth=true)

2013-08-23 Thread Mark Thomas
On 23/08/2013 12:28, Ja kub wrote: Thx for response, Will it be developed in next releases of tomcat 7? There are currently no plans to do so. Or it won't because there is no such need, and such issues should be handled some other way? It is simply a case that, to date, no one has wanted

Re: is it possible to dynamically add servlets and websocket endpoints during startup based on our own configuration settings?

2013-08-23 Thread Mark Thomas
On 22/08/2013 19:32, Bob DeRemer wrote: I’m in the process of developing a configurable server application which must handle various protocols, but the respective endpoints must be configurable. Specifically, I would like to programmatically add both HTTP servlet(s) as well as WebSocket

RE: is it possible to dynamically add servlets and websocket endpoints during startup based on our own configuration settings?

2013-08-23 Thread Bob DeRemer
-Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Friday, August 23, 2013 8:14 AM To: Tomcat Users List Subject: Re: is it possible to dynamically add servlets and websocket endpoints during startup based on our own configuration settings? On 22/08/2013

Re: is it possible to dynamically add servlets and websocket endpoints during startup based on our own configuration settings?

2013-08-23 Thread Mark Thomas
On 23/08/2013 13:28, Bob DeRemer wrote: -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Friday, August 23, 2013 8:14 AM To: Tomcat Users List Subject: Re: is it possible to dynamically add servlets and websocket endpoints during startup based on our own

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread toddfas
Thanks very much for the quick response Niki! I went down the configurator path too, but then I could not find a way to pass the cookie values into the ServerEndPoint.onOpen where I need to use it. I tried passing it via session.getRequestParameterMap() but that is a

RE: is it possible to dynamically add servlets and websocket endpoints during startup based on our own configuration settings?

2013-08-23 Thread Spencer Lamont R CONTR USSTRATCOM/J646
http://www.gizmag.com/helmmate-bicycle-helmet-seat-cover/28798/ LaMont Spencer - ITCC - Contractor McCallie Assoc. J646 Mid - Tier Support Comm:232-1733 | DSN:272-1733 -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Friday, August 23, 2013 7:40 AM To: Tomcat Users

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread Niki Dokovski
On Fri, Aug 23, 2013 at 7:03 PM, toddfas todd...@gmail.com wrote: Thanks very much for the quick response Niki! I went down the configurator path too, but then I could not find a way to pass the cookie values into the ServerEndPoint.onOpen where I need to use it. I tried passing it via

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread toddfas
Our existing web app has custom session management (does not use JSESSIONID) and stores the session identifier in a cookie. The cookie is marked httpOnly (and secure) so the client side Javascript opening the websocket does not have access to it. I want to use this session identifier in

Re: Mapping security role outside of servlet specification

2013-08-23 Thread Stefan Mayr
Am 11.06.2013 19:42, schrieb Felix Schumacher: Am 05.06.2013 13:42, schrieb Ilya Kazakevich: Hello, I use probe app for several tomcats. It's security model is based on servlet API security: security roles and constraints are provided in web.xml and mapped for each servlet it has. I use

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread Nick Williams
In the modifyHandshake method of your Configurator, you can call getUserProperties on the EndpointConfig argument. This returns a modifiable MapString, Object that you can add values to. After modifyHandshake returns and before onOpen is called, the values from that map are copied to the

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread Nick Williams
On Aug 23, 2013, at 1:25 PM, Nick Williams wrote: In the modifyHandshake method of your Configurator, you can call getUserProperties on the EndpointConfig argument. This returns a modifiable MapString, Object that you can add values to. After modifyHandshake returns and before onOpen is

Re: Having trouble with common.loader

2013-08-23 Thread D C
On Thu, Aug 22, 2013 at 2:51 PM, Konstantin Kolinko knst.koli...@gmail.comwrote: 2013/8/22 D C dc12...@gmail.com: On Thu, Aug 22, 2013 at 11:48 AM, Konstantin Kolinko knst.koli...@gmail.com wrote: 2013/8/22 Daniel Mikusa dmik...@gopivotal.com: On Aug 21, 2013, at 4:09 PM, David

Re: Tomcat 7.0 logging on different platforms

2013-08-23 Thread Tomcat Random
I've deleted any reference in logging.properties to the console. However the file rm'd catalina.out file still coming back on restarts. Any ideas? catalina,out is now also reporting java.util.logging.ErrorManager: 4: Unable to create [logs] Below is my altered logging.properties file:

Re: Fwd: Tomcat 7 / Java 7 with TLS 1.2 algorithms

2013-08-23 Thread Dennis Sosnoski
Thanks for clarifying the JSSE issue. It's a shame that JSSE can't make use of available JCE algorithms. I've just been trying to establish the limits of the Java 7 implementation, and I think I understand that now. Yes, the ECDHE ciphersuites are definitely the choice for strongest secrecy

Re: Tomcat 8 EL 3.0 Issue

2013-08-23 Thread Mark Thomas
On 20/08/2013 16:46, Daniel Mikusa wrote: Hello, I'm seeing some perplexing errors with a couple simple EL test. Dan, These look like bugs. I've taken a quick look at the first and it is fixable if we copy the smarter method finding code from ReflectionUtil in the implementation to the Util

Re: Mapping security role outside of servlet specification

2013-08-23 Thread Stefan Mayr
Am 23.08.2013 20:10, schrieb Stefan Mayr: Am 11.06.2013 19:42, schrieb Felix Schumacher: Am 05.06.2013 13:42, schrieb Ilya Kazakevich: Hello, I use probe app for several tomcats. It's security model is based on servlet API security: security roles and constraints are provided in web.xml and

Re: Tomcat 8 Websocket API - Cookies Headers

2013-08-23 Thread toddfas
On Fri, Aug 23, 2013 at 11:25 AM, Nick Williams nicho...@nicholaswilliams.net wrote: In the modifyHandshake method of your Configurator, you can call getUserProperties on the EndpointConfig argument. This returns a modifiable MapString, Object that you can add values to. After modifyHandshake