Re: how to prevent user access to JSP pages?

2018-08-18 Thread Terence M. Bandoian
On 8/17/2018 8:52 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 8/17/18 3:54 AM, Mark Thomas wrote: On 16/08/18 18:19, Berneburg, Cris J. - US wrote: Due to security concerns and general fussiness on my part, I'd like to prevent users from requesting

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Alex O'Ree
Ok, I've picked up Chris's patch and was able to cobble together something. Is there any guidance as to how a web app can subscribe to something like this? I was thinking a singleton class with a register/unregister, but I'm not sure how the tc community feels about singletons. It could also cause

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Alex O'Ree
after looking at the code, it's not a simple 1 liner and would require a number of api changes. I was able to get it working, but it is a large change set. Anyone that extends or builds a custom one of these: -Realm -AuthenticatorBase requires some changes. They are quick to make but it's a large

programmatically adding new users to tomcat-users.xml

2018-08-18 Thread Alex O'Ree
I'd like to provide users a mechanism to create their own user accounts via browser instead of requiring access to the server + editing xml files. I found this solution here https://stackoverflow.com/a/39770319/1203182 and i found the APIs here

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Alex O'Ree
Cool beans. I can do a PR if there's interest. On Sat, Aug 18, 2018 at 7:59 AM, Christopher Schultz < ch...@christopherschultz.net> wrote: > Mark and Alex, > > > On Aug 18, 2018, at 05:46, Mark Thomas wrote: > > > >> On 18/08/18 10:36, Olaf Kock wrote: > >> > >>> On 18.08.2018 03:58, Alex O'Ree

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Christopher Schultz
Mark and Alex, > On Aug 18, 2018, at 05:46, Mark Thomas wrote: > >> On 18/08/18 10:36, Olaf Kock wrote: >> >>> On 18.08.2018 03:58, Alex O'Ree wrote: >>> Is it possible to configure the user lockout realm to log what ip address >>> the failed login attempt came from? I know the information

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Mark Thomas
On 18/08/18 10:36, Olaf Kock wrote: > > On 18.08.2018 03:58, Alex O'Ree wrote: >> Is it possible to configure the user lockout realm to log what ip address >> the failed login attempt came from? I know the information needed will >> also >> be in the access log but added it to the "attempt to

Re: user lockout realm, logging ip addresses

2018-08-18 Thread Olaf Kock
On 18.08.2018 03:58, Alex O'Ree wrote: Is it possible to configure the user lockout realm to log what ip address the failed login attempt came from? I know the information needed will also be in the access log but added it to the "attempt to login from a locked account" message would be super