Patrick Flaherty wrote:
On Mar 24, 2013, at 2:56 PM, André Warnier wrote:
Harris, Jeffrey E. wrote:
-----Original Message-----
From: Patrick Flaherty [mailto:pflah...@rampageinc.com]
Sent: Sunday, March 24, 2013 12:18 PM
To: Tomcat Users List
Subject: Re: runtime.exec "cmd.exe /C net use"
On Mar 24, 2013, at 10:24 AM, Harris, Jeffrey E. wrote:
-----Original Message-----
From: Patrick Flaherty [mailto:pflah...@rampageinc.com]
Sent: Sunday, March 24, 2013 10:20 AM
To: Tomcat Users List
Subject: Re: runtime.exec "cmd.exe /C net use"
On Mar 23, 2013, at 10:00 PM, David Kerber wrote:
On 3/23/2013 8:13 PM, Harris, Jeffrey E. wrote:
Hi,
Thanks for all the input. I know about service logins being only
able
to use UNC paths (not drive letters) to access network shares. I
know
the service login & password have to have a matching account on the
server with the shares in order for the tomcat app to use (access)
those shares. We do all of this. Out tomcat app depends on network
shares to function and it always has worked as long as the service
login account matches an account on the server with the shares.
What I'm trying to do in an html interface is make a pulldown menu
list of my mapped drives as a location for our database backup. It's
a preference setup to where an automated scheduled backup will write
the backups. I'm using "net use" to produce what you would expect
for
output (all the mapped network drives) and parsing the output to
produce the pulldown menu item containing the unc portion gleaned
from the "net use" output. I need the unc portion as this is what a
tomcat app needs. No matter what I do outside the app I cannot
produce the effectively empty list that the app is producing. I'm
logged into Windows as the same account as the service and I open a
command prompt and see all my mapped drives via "net use". I have
tried UAC on and off and it changes nothing. I added a simple "dir"
to the app and I can get that output but not the "net use"
output. I do know it has to do with the service as I said because
when tomcat is started via the startup.bat it works great.
Maybe it is a Windows question but thought someone may have had some
similar experience.
Thanks for eveyone's thoughts.
-Pat
You still have not answered how the mapping are being made in the
first place. Is the service account dynamically setting the mapping
using net use, or through the Windows API? Are you relying on static
mappings in the user account profile?
Hi Jeffrey,
The drive mapping are happening through the Windows Explorer interface.
The file server is browsed and the shares on the file server are mapped
by right-clicking the share, mapping it to a drive letter and I check
the checkbox "Reconnect at logon". Then I start my app.
(I'm not using any user profiles.)
-Pat
Jeffrey Harris
Pat,
I do not think that will work for a service account. The drive
mappings are stored in the user profile,
and since I do not think service accounts access user profiles, the
service account will not remap
the drives when using the account to start a service (it will when
you actually log in interactively with
the account). You can try setting some custom environment variables
in the user profile (not the system profile)
and see if they are accessible by the service account using the set
command as a test to see if mapping
might be accessible.
What you probably need to do is actually set the drive mappings using
the Windows API dynamically when Tomcat starts,
or use UNCs. I know you want to display the drive mappings, but you
could fake the display by doing a net use >myfilemappings.txt from
the command line (when logged into the account), and just calling the
file to display the mappings. Obviously, if the mappings change, you
would have to redo the file.
I think those are your only options. You might want to do a Google
search and see if there is a way for
service accounts to use remembered mapped drives.
I routinely use "net use \\hostname\share" from inside programs
running as Windows Services (not in Java, though, but it should not
matter). "Drive letters" don't work.
The exact form I use is :
net use \\hostname\sharename <password> /USER:<userid>
And then later I can open/read/write/close files as
"\\hostname\sharename\filepath".
It works, but I have noticed one "quirk" in my programs : after doing
the "net use", the very first access to the share doesn't work and
returns an error. The second access and all subsequent ones work
though. I have no idea why this is, but I have just adapted my
programs to work around this issue (by doing a first dummy access and
ignoring the result), and never had any problem since. (**)
To be able to do this, the Service *cannot* run as the LocalSystem or
LocalService user. By design in Windows, these special users do not
have access to any "Windows network" functions or resources. Any
"normal" user (*) will do, depending on the environment (such as, if
the current host is a member of a Windows Domain, and the Windows
network resource is defined in that domain, then the user will need to
be a Domain user; if the resource is a share on a Linux Samba host
e.g., then any user will do, as long as it is known to Samba).
This all concerns only "Windows network" resources. Anything accessed
via standard TCP/IP protocols (HTTP, NFS, FTP, SSL..) works, even when
running as one of these special users.
As a not very precise technical definition, "Windows network
resources" are all the things like "shares" (network directories),
Windows network printers, anything that is accessed via the SMB or
CIFS protocol, anything that requires the usage of a "workgroup" or
"domain" name, etc.
(*) with one additional caveat : the user must be granted the "right
to run services".
(**) Maybe this is a hint to the OP : what happens if you ignore the
result of the first command call, and try the same command a second
time ?
And I agree : there a bit of hocus-pocus here, but then many things
are, in a Windows environment.
You are not hearing me. The drives are mapped and set to reconnect at
logon. Therefore if I reboot my machine the network drive mapping are in
place after
logging in. I *do not* try and map a drive from within my app. My app
has full access to the network shares as soon as my app is up. No
problem with network
shares and my app !
Well, only if your app is running on your computer though. As soon as your app is moved
somewhere else, it will stop working unless you set up that computer the same way.
My app needs to read and write to those network
share to function and has no problems.
The problem is after I'm up and running, I try to run "cmd.exe /C net
use" from within the app it does not return any mapped drives. it returns:
net use
New connections will be remembered.
There are no entries in the list.
Again, the return above happen only when running as a service but works
fine when tomcat starts from startup.bat in a console. Works fine means
it returns drive letter, unc equivalent etc ... basically what you
normally see when you have mapped network drives and run "net use" from
cmd.exe.
It make no sense I know but I'm at a loss.
Yes, it does make sense. When something is running as a Service under a given user-id, it
does not have the same environment as when you login to a computer with that same user-id.
The "service environment" is different from the "interactive login" environment.
In how many ways exactly under Windows, I do not know; but many. (One of the ways is that
a Service does not have a console, while your interactive session does; that alone already
make a lot of programs act differently. Another way is the permissions, which are
different between services and interactive users).
The crux of the matter is : if you want your Service (whatever program it runs in whatever
programming language) to have access to certain resources, you should make sure that it is
the service itself which acquires/connect to these resources, and not rely on, for
example, "mappings" that have been made under another environment, to be present in the
service environment.
Think of it as follows : when you - personally - login to the machine, you get a "session"
under your user-id. And then inside that session you run Tomcat, as an application, within
that same session.
When a service starts, it does its own login and it gets a different "session", also under
the same user-id, but a different session anyway.
And there is nothing that says that everything that you have in your interactive user
session is automatically there in that (separate) service session. And if anything is, it
may just be a bug in this particular Windows version, and may go away at the next version.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
