You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Stefán Freyr Stefánsson <st...@decode.is> on 2000/09/18 13:09:57 UTC
Directory listing problem and two way authentication bugfix/enhancement
Hello.
I've been working on getting two way authentication to work in Tomcat 3.2
for some time now and I've finally gotten it to work. I want to post a
bugfix to the problem but I'm not sure how to do that. I modified the
SSLSocketFactory class and used the <Parameter name="clientAuth"
value"true"> within the <Connector> tag to specify whether client
authentication is required or not. I don't know if this is prefferable or
not (I saw some discussion on having seperate keystores per virtual host...
and this would not work really well with that concept since this solution
only works on the connector) but it may help some people who would like
client authentication in their project. So my point is... I need
information about where to send the updated version of SSLSocketFactory
class. I'm attatching it to this letter in case someone wants to use it.
For those who choose to use it here's an example of the <Connector> tag in
server.xml:
<Connector className="org.apache.tomcat.service.PoolTcpConnector">
<Parameter name="handler"
value="org.apache.tomcat.service.http.HttpConnectionHandler"/>
<Parameter name="port"
value="443"/>
<Parameter name="socketFactory"
value="org.apache.tomcat.net.SSLSocketFactory" />
<Parameter name="clientAuth"
value="true" />
</Connector>
But now I have another problem. The directory listing problem. I had
problems getting the basic authentication (server authentication) to work to
begin with... After a while of wondering and posting to this list I received
an answer from Ismael Blesa Part. He told me that what I was experiencing
was a "directory listing problem". This problem behaves in a way that if
you type in https://localhost/ on your browser the webserver is redirecting
the browser to the address http://localhost:443/index.html instead of
https://localhost/index.html which is a bad thing since the browser then
doesn't know that he's talking through SSL.
So what I need to do next is fix this problem in Tomcat. If anyone can help
me get started with that I would appreciate it very much... where does the
code reside that is responsible for this redirection?
Thanks very much in advance,
Stefan Freyr
Re: Directory listing problem and two way authentication bugfix/enhancement
Posted by Warner Onstine <wa...@warneronstine.com>.
If you checked out the file using cvs you should do a diff on that file and
send the mail to tomcat-dev with the subject [PATCH] and the file name. I
believe that should do the trick. (If there is a better way, please let me
know as well ;-)
-warner
----- Original Message -----
From: "Stefan Freyr Stefansson" <st...@decode.is>
To: <to...@jakarta.apache.org>
Cc: <cm...@yahoo.com>
Sent: Wednesday, September 20, 2000 3:56 AM
Subject: RE: Directory listing problem and two way authentication
bugfix/enhancement
> <Connector className="org.apache.tomcat.service.PoolTcpConnector">
> <Parameter name="handler"
>
> value="org.apache.tomcat.service.http.HttpConnectionHandler"/>
> <Parameter name="port"
> value="443"/>
> <Parameter name="socketFactory"
> value="org.apache.tomcat.net.SSLSocketFactory" />
> <Parameter name="clientAuth"
> value="true" />
> <Parameter name="keystore"
> value="c:\002.keystore" />
> <Parameter name="keypass"
> value="passphrase" />
> <Parameter name="secure"
> value="true" />
> </Connector>
>
> This is how the server.xml should look when using the updated
> SSLSocketFactory class I posted. You were right... adding the "secure"
> parameter did the trick with the directory listing problem... now it
> redirects from https://localhost to https://localhost/index.html.
>
> So everything is working fine and dandy now but you should probably add
the
> line <Parameter name="secure" value="true" /> to the SSL part of the
> server.xml (the part where you say "uncomment for ssl support") and put
that
> in circulation... This solution doesn't really jump out when you have
this
> problem ;o)
>
> I still haven't received any answer about how to post a bugfix like the
> SSLSocketFactory... How do I formally submit a bugfix like that?
>
> Kind regards, Stefan.
>
> -----Original Message-----
> From: cmanolache@yahoo.com [mailto:cmanolache@yahoo.com]
> Sent: 18. september 2000 15:15
> To: tomcat-dev@jakarta.apache.org
> Subject: Re: Directory listing problem and two way authentication
> bugfix/enhancement
>
>
> > an answer from Ismael Blesa Part. He told me that what I was
experiencing
> > was a "directory listing problem". This problem behaves in a way that
if
> > you type in https://localhost/ on your browser the webserver is
> redirecting
> > the browser to the address http://localhost:443/index.html instead of
> > https://localhost/index.html which is a bad thing since the browser then
> > doesn't know that he's talking through SSL.
> >
>
> Can you try to add "secure="true"" to the tcp connector configuration ?
> This is supposed to let tomcat know it's a secure connection.
>
> ( it's very hard to detect this - the adapter may use a different
> implementation than JSSE, or it may use TCP to get requests from
> Apache+SSL, etc ).
>
> Let me know if this helps.
>
> Costin
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>
>
RE: Directory listing problem and two way authentication bugfix/enhancement
Posted by Stefan Freyr Stefansson <st...@decode.is>.
<Connector className="org.apache.tomcat.service.PoolTcpConnector">
<Parameter name="handler"
value="org.apache.tomcat.service.http.HttpConnectionHandler"/>
<Parameter name="port"
value="443"/>
<Parameter name="socketFactory"
value="org.apache.tomcat.net.SSLSocketFactory" />
<Parameter name="clientAuth"
value="true" />
<Parameter name="keystore"
value="c:\002.keystore" />
<Parameter name="keypass"
value="passphrase" />
<Parameter name="secure"
value="true" />
</Connector>
This is how the server.xml should look when using the updated
SSLSocketFactory class I posted. You were right... adding the "secure"
parameter did the trick with the directory listing problem... now it
redirects from https://localhost to https://localhost/index.html.
So everything is working fine and dandy now but you should probably add the
line <Parameter name="secure" value="true" /> to the SSL part of the
server.xml (the part where you say "uncomment for ssl support") and put that
in circulation... This solution doesn't really jump out when you have this
problem ;o)
I still haven't received any answer about how to post a bugfix like the
SSLSocketFactory... How do I formally submit a bugfix like that?
Kind regards, Stefan.
-----Original Message-----
From: cmanolache@yahoo.com [mailto:cmanolache@yahoo.com]
Sent: 18. september 2000 15:15
To: tomcat-dev@jakarta.apache.org
Subject: Re: Directory listing problem and two way authentication
bugfix/enhancement
> an answer from Ismael Blesa Part. He told me that what I was experiencing
> was a "directory listing problem". This problem behaves in a way that if
> you type in https://localhost/ on your browser the webserver is
redirecting
> the browser to the address http://localhost:443/index.html instead of
> https://localhost/index.html which is a bad thing since the browser then
> doesn't know that he's talking through SSL.
>
Can you try to add "secure="true"" to the tcp connector configuration ?
This is supposed to let tomcat know it's a secure connection.
( it's very hard to detect this - the adapter may use a different
implementation than JSSE, or it may use TCP to get requests from
Apache+SSL, etc ).
Let me know if this helps.
Costin
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: Directory listing problem and two way authentication bugfix/enhancement
Posted by cm...@yahoo.com.
> an answer from Ismael Blesa Part. He told me that what I was experiencing
> was a "directory listing problem". This problem behaves in a way that if
> you type in https://localhost/ on your browser the webserver is redirecting
> the browser to the address http://localhost:443/index.html instead of
> https://localhost/index.html which is a bad thing since the browser then
> doesn't know that he's talking through SSL.
>
Can you try to add "secure="true"" to the tcp connector configuration ?
This is supposed to let tomcat know it's a secure connection.
( it's very hard to detect this - the adapter may use a different
implementation than JSSE, or it may use TCP to get requests from
Apache+SSL, etc ).
Let me know if this helps.
Costin