On Tue, 2016-02-16 at 14:31 -0500, Christopher Schultz wrote:
> On 2/16/16 11:50 AM, Dougherty, Gregory T., M.S. wrote:
> > I completely and totally trust my servlet with my data. I do not
> > in the least bit trust any other servlet running on that Tomcat
> > instance.
>
> Then those servlets
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/16/16 11:50 AM, Dougherty, Gregory T., M.S. wrote:
> On 2/16/16, 9:13 AM, "Christopher Schultz"
> wrote:
>
>
>> Gregory,
>>
>> On 2/15/16 11:18 AM, Dougherty, Gregory T., M.S. wrote:
>>> How to trade information with a specified URL
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
All,
Sorry about this. It seems Enigmail is ruining messages.
- -chris
On 2/16/16 2:09 PM, Christopher Schultz wrote:
>
> The information contained in this email and its attachments may be
> confidential. If you have received this email in error, p
The information contained in this email and its attachments may be confidential.
If you have received this email in error, please notify the sender by return
email,
delete this email and destroy any copy.
Any advice contained in this email has been prepared without taking into
account your objec
The information contained in this email and its attachments may be confidential.
If you have received this email in error, please notify the sender by return
email,
delete this email and destroy any copy.
Any advice contained in this email has been prepared without taking into
account your objec
binrvxcJ0gxtC.bin
Description: PGP/MIME version identification
On Feb 16, 2016 10:50 AM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> On 2/16/16, 9:13 AM, "Christopher Schultz"
> wrote:
>
>
> >Gregory,
> >
> >On 2/15/16 11:18 AM, Dougherty, Gregory T., M.S. wrote:
> >> How to trade information with a specified URL calling java code i
On 2/16/16, 9:13 AM, "Christopher Schultz"
wrote:
>Gregory,
>
>On 2/15/16 11:18 AM, Dougherty, Gregory T., M.S. wrote:
>> How to trade information with a specified URL calling java code in
>> tomcat/lib:
>>
>> 1: Servlet calls Decryptor.start (String whoIAm, int validator, int xOr)
>
>What prev
On Feb 12, 2016 2:35 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> You are correct, I¹m trying to authorize the web app, not the user.
I am going to start all the way back here and suggest that you abandon this
approach of authenticating a web "app".
This is unconvent
Gregory,
On 2/15/16 11:18 AM, Dougherty, Gregory T., M.S. wrote:
> How to trade information with a specified URL calling java code in
> tomcat/lib:
>
> 1: Servlet calls Decryptor.start (String whoIAm, int validator, int xOr)
What prevents the servlet from specifying whoIAm="someoneElse"?
> 2: C
How to trade information with a specified URL calling java code in
tomcat/lib:
1: Servlet calls Decryptor.start (String whoIAm, int validator, int xOr)
2: Code calls Servlet http get with id=randomly generated int
3: Servlet returns validator in response to the http get call. 0 is not a
valid val
Chris,
On 2/15/16, 9:20 AM, "Christopher Schultz"
wrote:
>-BEGIN PGP SIGNED MESSAGE-
>Hash: SHA1
>
>Gregory,
>
>On 2/12/16 6:46 PM, Dougherty, Gregory T., M.S. wrote:
>> Chris,
>>
>>
>> On 2/12/16, 5:27 PM, "Christopher Schultz"
>> wrote:
>>
>>> Gregory,
>>>
>>> On 2/12/16 4:19 PM,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Leo,
On 2/12/16 8:35 PM, Leo Donahue wrote:
> On Fri, Feb 12, 2016 at 5:46 PM, Dougherty, Gregory T., M.S. <
> dougherty.greg...@mayo.edu> wrote:
>
>> Chris,
>>
>>
>> On 2/12/16, 5:27 PM, "Christopher Schultz"
>> wrote:
>>
>>> Gregory,
>>>
>>>
Chris,
On 2/12/16, 7:35 PM, "Leo Donahue" wrote:
>On Fri, Feb 12, 2016 at 5:46 PM, Dougherty, Gregory T., M.S. <
>dougherty.greg...@mayo.edu> wrote:
>
>> Chris,
>>
>>
>> On 2/12/16, 5:27 PM, "Christopher Schultz"
>>
>> wrote:
>>
>> >Gregory,
>> >
>> >On 2/12/16 4:19 PM, Dougherty, Gregory T., M
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 6:46 PM, Dougherty, Gregory T., M.S. wrote:
> Chris,
>
>
> On 2/12/16, 5:27 PM, "Christopher Schultz"
> wrote:
>
>> Gregory,
>>
>> On 2/12/16 4:19 PM, Dougherty, Gregory T., M.S. wrote:
>>> On 2/12/16, 3:08 PM, "Leo Donahue"
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 7:03 PM, Dougherty, Gregory T., M.S. wrote:
> It appears I’ve done a poor job explaining the situation, so let me
> try again.
>
> We have multiple apps running on a production Tomcat server. Each
> one of those apps has one or m
Chris
[SNIP: Chris Schultz and Greg Dougherty]
> >>> The web app needs a DB password so it can connect to the DB.
> >>
> >> I disagree that the web app needs a password.
> >
> > The web app has to be able to read and write to the DB. That takes a
> > password.
>
> I agree with Leo: your app
On 15.02.2016 11:06, Christoph Nenning wrote:
Perhaps I¹m naïve, but I was looking for a Tomcat provided
³getCurrentURL
()² call, and assumed that nothing else could have that. :-)
Thank you for the SecurityManager suggestion, I hadn¹t thought about
that.
I¹ll look in to how much of a pain
> > Perhaps I¹m naïve, but I was looking for a Tomcat provided
> ³getCurrentURL
> > ()² call, and assumed that nothing else could have that. :-)
> >
> > Thank you for the SecurityManager suggestion, I hadn¹t thought about
> that.
> > I¹ll look in to how much of a pain that is.
>
>
> You can r
> Perhaps I¹m naïve, but I was looking for a Tomcat provided
³getCurrentURL
> ()² call, and assumed that nothing else could have that. :-)
>
> Thank you for the SecurityManager suggestion, I hadn¹t thought about
that.
> I¹ll look in to how much of a pain that is.
You can rebuild the url with
On Fri, Feb 12, 2016 at 5:46 PM, Dougherty, Gregory T., M.S. <
dougherty.greg...@mayo.edu> wrote:
> Chris,
>
>
> On 2/12/16, 5:27 PM, "Christopher Schultz"
> wrote:
>
> >Gregory,
> >
> >On 2/12/16 4:19 PM, Dougherty, Gregory T., M.S. wrote:
> >> On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
> >>
> >
On Fri, Feb 12, 2016 at 5:33 PM, Christopher Schultz <
ch...@christopherschultz.net> wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> Gregory,
> >
> > The web app needs a DB password so it can connect to the
> > DB.
>
> I disagree that the web app needs a password
Chris,
It appears I’ve done a poor job explaining the situation, so let me try
again.
We have multiple apps running on a production Tomcat server. Each one of
those apps has one or more passwords that belong to the app developers.
Generally we’re talking about DB passwords.
If you’re willing t
Chris,
On 2/12/16, 5:27 PM, "Christopher Schultz"
wrote:
>Gregory,
>
>On 2/12/16 4:19 PM, Dougherty, Gregory T., M.S. wrote:
>> On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
>>
>>
>>> On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
>>> dougherty.greg...@mayo.edu> wrote:
>> My definitio
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 4:49 PM, Dougherty, Gregory T., M.S. wrote:
> On 2/12/16, 3:29 PM, "Leo Donahue" wrote:
>
>
>> On Feb 12, 2016 3:19 PM, "Dougherty, Gregory T., M.S." <
>> dougherty.greg...@mayo.edu> wrote:
>>>
>>> On 2/12/16, 3:08 PM, "Leo Do
Chirs,
On 2/12/16, 5:19 PM, "Christopher Schultz"
wrote:
>-BEGIN PGP SIGNED MESSAGE-
>Hash: SHA1
>
>Gregory,
>
>On 2/12/16 3:35 PM, Dougherty, Gregory T., M.S. wrote:
>> You are correct, I¹m trying to authorize the web app, not the
>> user.
>>
>> Goal: I am trying to come up with a way
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 4:19 PM, Dougherty, Gregory T., M.S. wrote:
> On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
>
>
>> On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
>> dougherty.greg...@mayo.edu> wrote:
>>>
>>> The web app needs a DB passw
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 3:35 PM, Dougherty, Gregory T., M.S. wrote:
> You are correct, I¹m trying to authorize the web app, not the
> user.
>
> Goal: I am trying to come up with a way for a Tomcat app to
> securely store and retrieve the password it need
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Gregory,
On 2/12/16 2:49 PM, Dougherty, Gregory T., M.S. wrote:
> You can honestly tell who¹s calling you, since you can throw an
> exception, catch it, then look at the stack trace.
Sure. There are easier ways to do that (see Chuck's post), but it
d
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
André,
On 2/12/16 3:10 PM, André Warnier (tomcat) wrote:
> On 12.02.2016 20:49, Dougherty, Gregory T., M.S. wrote:
>> You can honestly tell who¹s calling you, since you can throw an
>> exception, catch it, then look at the stack trace.
>>
>> If you
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
André,
On 2/12/16 2:35 PM, André Warnier (tomcat) wrote:
> On 12.02.2016 20:08, Christopher Schultz wrote:
>> -BEGIN PGP SIGNED MESSAGE- Hash: SHA1
>>
>> André,
>>
>> On 2/12/16 1:11 PM, André Warnier (tomcat) wrote:
>>> Sorry, I lost the or
On 2/12/16, 3:40 PM, "Tim Watts" wrote:
>On Fri, 2016-02-12 at 20:35 +, Dougherty, Gregory T., M.S. wrote:
>> You are correct, I¹m trying to authorize the web app, not the user.
>>
>> Goal: I am trying to come up with a way for a Tomcat app to securely
>>store
>> and retrieve the password i
On 2/12/16, 3:29 PM, "Leo Donahue" wrote:
>On Feb 12, 2016 3:19 PM, "Dougherty, Gregory T., M.S." <
>dougherty.greg...@mayo.edu> wrote:
>>
>> On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
>>
>>
>> >On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
>> >dougherty.greg...@mayo.edu> wrote:
>> >>
On Fri, 2016-02-12 at 20:35 +, Dougherty, Gregory T., M.S. wrote:
> You are correct, I¹m trying to authorize the web app, not the user.
>
> Goal: I am trying to come up with a way for a Tomcat app to securely store
> and retrieve the password it needs to access a DB.
>
> My definition of ³sec
On Feb 12, 2016 3:19 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
>
>
> >On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
> >dougherty.greg...@mayo.edu> wrote:
> >>
> >> The web app needs a DB password so it can connec
On 2/12/16, 3:08 PM, "Leo Donahue" wrote:
>On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
>dougherty.greg...@mayo.edu> wrote:
>>
>> The web app needs a DB password so it can connect to the DB.
>
>I disagree that the web app needs a password.
The web app has to be able to read and write
On Feb 12, 2016 2:58 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> The web app needs a DB password so it can connect to the DB.
I disagree that the web app needs a password.
> None of the
> users have direct access to the DB.
Nor should they.
> The web app uses LDAp
On 2/12/16, 2:54 PM, "Leo Donahue" wrote:
>On Feb 12, 2016 2:50 PM, "Dougherty, Gregory T., M.S." <
>dougherty.greg...@mayo.edu> wrote:
>>
>> How does it validate itself to that common location, without a password
>>
>
>A. Stop top posting. You're killing me on my Android phone backspacing
>to
On Feb 12, 2016 2:50 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> How does it validate itself to that common location, without a password
>
A. Stop top posting. You're killing me on my Android phone backspacing to
where I want to reply.
B. What is "it"? The web a
How does it validate itself to that common location, without a password?
--
Gregory Dougherty
Sr. Analyst/Programmer | Information Technology
Information Technology
(507) 284-8493 | dougherty.greg...@mayo.edu
On 2/12/16, 2:46 PM, "Leo Donahue" wrote:
>On Feb 12, 2016 2:35 PM, "Dougherty
Oh, one thing I left out: Tomcat is running multiple web apps, each which
needs its own password(s).
Tomcat is run by the sys admin, who is presumed to be trusted. The sys
admin will be creating the public:private key pair in step 1.
The encryption code will be checked by multiple people, and is
On Feb 12, 2016 2:35 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> You are correct, I¹m trying to authorize the web app, not the user.
>
> Goal: I am trying to come up with a way for a Tomcat app to securely store
> and retrieve the password it needs to access a DB.
>
>
You are correct, I¹m trying to authorize the web app, not the user.
Goal: I am trying to come up with a way for a Tomcat app to securely store
and retrieve the password it needs to access a DB.
My definition of ³secure² includes ³there exist no files with an
unencrypted copy of the password². II
On 12.02.2016 21:00, Leo Donahue wrote:
On Feb 11, 2016 4:56 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
I would like to have a jar file in tomcat/lib that can be called from any
of the running web apps. I need for the code in the jar to behave
differently depending
> From: Dougherty, Gregory T., M.S. [mailto:dougherty.greg...@mayo.edu]
> Subject: Re: Is there a way for code running on Tomcat 7+ to determine the
> URL of the Web App it's running under?
> You can honestly tell who¹s calling you, since you can throw an exception,
> catch
On 12.02.2016 20:49, Dougherty, Gregory T., M.S. wrote:
You can honestly tell who¹s calling you, since you can throw an exception,
catch it, then look at the stack trace.
If you have an object, you can get its class, you can get what methods it
implements, and you can get its parent class and re
On Feb 11, 2016 4:56 PM, "Dougherty, Gregory T., M.S." <
dougherty.greg...@mayo.edu> wrote:
>
> I would like to have a jar file in tomcat/lib that can be called from any
of the running web apps. I need for the code in the jar to behave
differently depending on which web app called it.
I would agr
You can honestly tell who¹s calling you, since you can throw an exception,
catch it, then look at the stack trace.
If you have an object, you can get its class, you can get what methods it
implements, and you can get its parent class and recurse.
So that should let you figure out which class will
It is what I¹m looking for, except I need a way to get an object that I
can trust that implements that interface.
--
Gregory Dougherty
Sr. Analyst/Programmer | Information Technology
Information Technology
(507) 284-8493 | dougherty.greg...@mayo.edu
On 2/12/16, 12:11 PM, "André Warnier (tom
On 12.02.2016 20:08, Christopher Schultz wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
André,
On 2/12/16 1:11 PM, André Warnier (tomcat) wrote:
Sorry, I lost the original message, so I can't respond in-thread. I
only saw the last message, but to that, isn't this what the Op is
asking fo
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
André,
On 2/12/16 1:11 PM, André Warnier (tomcat) wrote:
> Sorry, I lost the original message, so I can't respond in-thread. I
> only saw the last message, but to that, isn't this what the Op is
> asking for :
>
> http://tomcat.apache.org/tomcat-7.0
Sorry, I lost the original message, so I can't respond in-thread.
I only saw the last message, but to that, isn't this what the Op is asking for :
http://tomcat.apache.org/tomcat-7.0-doc/servletapi/javax/servlet/http/HttpServletRequest.html
No matter which jar these things are in, if these metho
Perhaps I¹m naïve, but I was looking for a Tomcat provided ³getCurrentURL
()² call, and assumed that nothing else could have that. :-)
Thank you for the SecurityManager suggestion, I hadn¹t thought about that.
I¹ll look in to how much of a pain that is.
--
Gregory Dougherty
Sr. Analyst/Programme
On 11/02/2016 22:56, Dougherty, Gregory T., M.S. wrote:
> I would like to have a jar file in tomcat/lib that can be called from any of
> the running web apps. I need for the code in the jar to behave differently
> depending on which web app called it. It is not in this case possible for
> the
54 matches
Mail list logo
