Configuring Tomcat for multiple users

[Binding Servlet <bi...@gmail.com>]

Hi,

Is there a way to configure Tomcat so that servlets can be created by
multiple users without having to either place them in the webapps directory
and without updating conf/web.xml for every servlet? I know the invoker
servlet is available, but I have read that is insecure. Basically, the
effect I want is for users to be able to place servlets in their home
directory after the server is already running, and for those servlets to be
recognized by Tomcat, and for them to be confined to the user directory they
are contained in, providing a safe environment for multiple users to develop
servlets in. There is an Apache httpd server running which maps "~" url
patterns to username/public_html directory.


For example,

http://host/~username/webapp_public_name/

should be mapped to

/~username/public_html/actual_webapp_path/servlet_path/

where /~username/public_html/actual_webapp_path/ contains a WEB-INF folder
describing servlet mappings within that directory. However, servlets in
/~username/public_html/ should not be able to map to anything higher than
http://host/~username/ such as http://host/ or http://host/~username/../.

Even if I can't confine servlets in user's home directories to map only to
URLs corresponding to their username, is it at least possible to configure
Tomcat to allow live deployment from users home directories without enabling
the invoker servlet?

Any help would be appreciated.

Re: Configuring Tomcat for multiple users

[Binding Servlet <bi...@gmail.com>]

Ok, thanks for the replies. I will look into both these options.



On Mon, Feb 25, 2008 at 12:20 PM, Mark H. Wood <mw...@iupui.edu> wrote:

> Note that the user web application mechanism only recognizes one
> webapp per user.
>
> If you need more than that, you might write up a little gadget (to be
> run setuid) which collects and vets enough information to construct a
> context descriptor file and then deposits it in
> $CATALINA_HOME/config/Catalina/$HOST/$CONTEXTNAME.xml on the user's
> behalf.
>
> --
> Mark H. Wood, Lead System Programmer   mwood@IUPUI.Edu
> Typically when a software vendor says that a product is "intuitive" he
> means the exact opposite.
>
>

Re: Configuring Tomcat for multiple users

["Mark H. Wood" <mw...@IUPUI.Edu>]

Note that the user web application mechanism only recognizes one
webapp per user.

If you need more than that, you might write up a little gadget (to be
run setuid) which collects and vets enough information to construct a
context descriptor file and then deposits it in
$CATALINA_HOME/config/Catalina/$HOST/$CONTEXTNAME.xml on the user's
behalf.

-- 
Mark H. Wood, Lead System Programmer   mwood@IUPUI.Edu
Typically when a software vendor says that a product is "intuitive" he
means the exact opposite.

Re: Configuring Tomcat for multiple users

[Mark Thomas <ma...@apache.org>]

Binding Servlet wrote:
> Hi,
> 
> Is there a way to configure Tomcat so that servlets can be created by
> multiple users without having to either place them in the webapps directory
> and without updating conf/web.xml for every servlet? I know the invoker
> servlet is available, but I have read that is insecure. Basically, the
> effect I want is for users to be able to place servlets in their home
> directory after the server is already running, and for those servlets to be
> recognized by Tomcat, and for them to be confined to the user directory they
> are contained in, providing a safe environment for multiple users to develop
> servlets in. There is an Apache httpd server running which maps "~" url
> patterns to username/public_html directory.

Take a look at http://tomcat.apache.org/tomcat-6.0-doc/config/host.html

Search for user web applications.

Mark


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org