Re: *** Payara, GlassFish or Tomcat ***

2022-07-20 Thread Christopher Schultz
Amn, On 7/12/22 17:59, Amn wrote: Nu-B here. Reading about Payara, GlassFish and Tomcat, I feel confused as to which would be the best server to learn about when learning Jakarta EE. I would use whichever you can download, install, and launch with the least hassle. For Tomcat, that's just:

Re: [OT] issues with Tomcat to Siteminder communication post mod-proxy setup

2022-07-20 Thread Christopher Schultz
Jon, On 7/13/22 12:16, jonmcalexan...@wellsfargo.com.INVALID wrote: Here is the error we are getting. The login form, hosted by Tomcat, does a POST to the /login/login.fcc for siteminder which is on the HTTPD server and is not behind the proxypass or proxypassreverse.

Re: Secondary Authentication method for application

2022-07-20 Thread Christopher Schultz
Tim, On 7/12/22 10:09, Tim K wrote: Hello, I currently have a custom realm in Tomcat 9 that uses form authentication (j_username/j_password POST to j_security_check). I'm looking to create a secondary way to establish an authenticated session. I want to allow trusted sources to be able to

[ANN] Apache Tomcat 9.0.65 available

2022-07-20 Thread Rémy Maucherat
The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.65. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.65 is a bugfix and

[ANN] Apache Tomcat 10.1.0-M17 (beta) available

2022-07-20 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.0-M17 (beta). Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Server Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations

RE: TLS Weak Cipher Keys for Key Exchange.

2022-07-20 Thread jonmcalexander
To possibly answer my own question, it appears that this can be done on the java command line: set the system property jdk.security.defaultKeySize with the algorithm and its desired default key size. For example, to test a DSA default keysize of 2048, specify

TLS Weak Cipher Keys for Key Exchange.

2022-07-20 Thread jonmcalexander
Good afternoon. Recently a new Qualys QID vulnerability was released, QID: 38863 - Cryptographically Weak Key Exchange Size, which deals with weak cipher key exchange key values. I know that we can add a cipher list in the TLS Connector in the server.xml, but is there a way to specify a Key

Re: AW: AW: AW: AW: Filehandle left open when using sendfile

2022-07-20 Thread Mark Thomas
20 Jul 2022 12:09:46 Thomas Hoffmann (Speed4Trade GmbH) : Hello Mark, I briefly want to ask whether the internal discussion about the open JVM file handle when using sendfile/Memory-Mapped-Files resulted in any conclusions? We opted to document the risk of file locking and left the

AW: AW: AW: AW: Filehandle left open when using sendfile

2022-07-20 Thread Thomas Hoffmann (Speed4Trade GmbH)
Hello Mark, I briefly want to ask whether the internal discussion about the open JVM file handle when using sendfile/Memory-Mapped-Files resulted in any conclusions? Thanks in advance! Thomas > -Ursprüngliche Nachricht- > Von: Mark Thomas > Gesendet: Montag, 20. Juni 2022 22:13 > An: