multiple truststores

[to...@ehome.hu]

Hi all,

I am trying to get to work two web applications with client-side SSL 
Authentication.
I have set up two connectors (port 443, 444) each with its own 
truststore.

Everything works fine so far, only the last step is mising.

People getting a connection through port 443 should only be able to 
use "Web Application 1".
People getting a connection through port 444 should only be able to 
use "Web Application 2".
How can i configure this?

I hope I wont need to hae two tomcat instances running for this.

Thank you and wish you nice WE,
Aron Katona

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: multiple truststores

[Jason Brittain <ja...@mulesource.com>]

Hi Aron.

You do not need two separate Tomcat instances for this.  In your server.xml
file, you'll notice that your HTTPS Connector elements are nested within a
Service element.  Also nested within the Service element is an Engine
element that in turn contains your Host(s) and Context(s), like this
(simplified):

<Server>
  <Service>
    <Connector port="443"/>
    <Connector port="444"/>
    <Engine>
      <Host name="yourhostname">
        <Context path="/webapp1"/>
        <Context path="/webapp2"/>
      </Host>
    </Engine>
  </Service>
</Server>

Tomcat matches up the Connectors with the Engine and the Engine's Hosts and
Contexts.  Tomcat also supports having more than one Service element in
server.xml, which means you can change the structure so that only one
connector is able send requests to one webapp, like this:

<Server>
  <Service name="Catalina">
    <Connector port="443"/>
    <Engine>
      <Host name="yourhostname">
        <Context path="/webapp1"/>
      </Host>
    </Engine>
  </Service>
  <Service name="Catalina444">
    <Connector port="444"/>
    <Engine>
      <Host name="yourhostname">
        <Context path="/webapp2"/>
      </Host>
    </Engine>
  </Service>
</Server>

--
Jason Brittain
MuleSoft <http://www.mulesoft.com>


On Fri, Oct 16, 2009 at 8:02 AM, <to...@ehome.hu> wrote:

> Hi all,
>
> I am trying to get to work two web applications with client-side SSL
> Authentication.
> I have set up two connectors (port 443, 444) each with its own truststore.
>
> Everything works fine so far, only the last step is mising.
>
> People getting a connection through port 443 should only be able to use
> "Web Application 1".
> People getting a connection through port 444 should only be able to use
> "Web Application 2".
> How can i configure this?
>
> I hope I wont need to hae two tomcat instances running for this.
>
> Thank you and wish you nice WE,
> Aron Katona
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

RE: multiple truststores

["Caldarale, Charles R" <Ch...@unisys.com>]

> From: tomcat@ehome.hu [mailto:tomcat@ehome.hu]
> Subject: multiple truststores
> 
> People getting a connection through port 443 should only be able to
> use "Web Application 1".
> People getting a connection through port 444 should only be able to
> use "Web Application 2".
> How can i configure this?

A <Connector> handles requests for a <Service>/<Engine> combination; if you have multiple <Connector> elements inside a given <Service>, requests via either can target any of the webapps handled by all <Host>s in the <Engine>.  So, you won't need two Tomcats, but you would need two <Service> elements to strictly segregate the requests on different ports.

Alternatively, you could use a filter or valve inside the <Context> for each webapp to reject requests that arrive on the wrong port for that webapp; this would be much simpler than having multiple <Service> elements.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.