You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Savitha Akella <sa...@gmail.com> on 2011/12/08 17:49:55 UTC
Securing only a single web application on Tomcat
Hi,
I have multiple applications hosted on my tomcat server which includes web
services, web applications etc.
To secure the web services, we made changes to server.xml ->connector
element and defined roles in tomcat-users.xml.
In the web services, we made changes in the web.xml to add the
security-constraint, security-role etc.
However, the problem we are facing is that all the web application hosted
on the Tomcat are prompting for certificate while accessing them.
Is there any way to restrict the security only to a single web component on
the Tomcat server rather than the entire server or all applications on the
server.
Thanks,
Savitha
Re: Securing only a single web application on Tomcat
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Savitha,
On 12/8/11 11:49 AM, Savitha Akella wrote:
> I have multiple applications hosted on my tomcat server which
> includes web services, web applications etc.
>
> To secure the web services, we made changes to server.xml
> ->connector element and defined roles in tomcat-users.xml.
The only change you can make to your connector to "secure" it would be
to make it into HTTPS. That doesn't really secure anything other than
the data that gets exchanged during the HTTP conversation.
> In the web services, we made changes in the web.xml to add the
> security-constraint, security-role etc.
>
> However, the problem we are facing is that all the web application
> hosted on the Tomcat are prompting for certificate while accessing
> them.
Which web.xml did you change? The one for your webapp in
WEB-INF/web.xml or the site-wide Tomcat default one in conf/web.xml?
> Is there any way to restrict the security only to a single web
> component on the Tomcat server rather than the entire server or all
> applications on the server.
Use WEB-INF/web.xml for your security-constraints, where they belong.
It appears you have modified the site-wide constraints which is why
they are applying to all webapps.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk7hALMACgkQ9CaO5/Lv0PBAHQCgjNPTJ46bkCyMFULiYtsVcmar
RVYAoKq/i/0HZZu+/PWyEKsOx4DlCmsm
=Xph9
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Securing only a single web application on Tomcat
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Savitha,
On 12/8/11 3:01 PM, Savitha Akella wrote:
> We are using tomcat version 7.0.11
You should upgrade if you have the chance. 7.0.23 is available and
there have been many improvements including fixes for security-related
bugs.
> Here are the changes we made in server.xml:
>
> <Connector SSLEnabled="true" clientAuth="true" keyAlias="tomcat"
> keyPass="xyz" keystoreFile="C:/Users/keystorepath/key.keystore"
> maxThreads="150" port="8443"
> protocol="org.apache.coyote.http11.Http11Protocol" scheme="https"
> secure="true" sslProtocol="TLS" trustMaxCertLength="10"
> truststoreFile="C:/Users/trustorepath/truststore.keystore"
> truststorePass="abc"/>
This is what you have now. I have no idea what you had before.
If the above connector is the only one you have, then everyone must
connect using HTTPS. Is that what you wanted?
Also, all clients must present a certificate because you have
clientAuth="true" which requires a certificate to connect.
If you want other webapps to allow non-HTTPS traffic, you'll need a
separate, non-secure HTTP connector. If you want one webapp to be able
to receive a Client SSL certificates but the others not demand them,
then you need to set clientAuth="want" instead of clientAuth="true"..
http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk7hJxAACgkQ9CaO5/Lv0PATwACguhTb7rOatNr3Nlgkm8+OSyvG
3TUAn3zxOB69eDMmgycDMrvNCp4+kTVq
=cs9i
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Securing only a single web application on Tomcat
Posted by Savitha Akella <sa...@gmail.com>.
Hi,
We are using tomcat version 7.0.11
Here are the changes we made in server.xml:
<Connector SSLEnabled="true" clientAuth="true" keyAlias="tomcat"
keyPass="xyz" keystoreFile="C:/Users/keystorepath/key.keystore"
maxThreads="150" port="8443"
protocol="org.apache.coyote.http11.Http11Protocol"
scheme="https" secure="true" sslProtocol="TLS" trustMaxCertLength="10"
truststoreFile="C:/Users/trustorepath/truststore.keystore"
truststorePass="abc"/>
here is my tomcat-users.xml
<tomcat-users>
<role rolename="manager"/>
<role rolename="admin"/>
<role rolename="developer"/>
<role rolename="manager-gui"/>
<role rolename="webservice"/>
<user username="admin" password="folsom!1"
roles="admin,manager,manager-gui" />
<user username="developer" password="folsom" roles="manager,manager-gui" />
<user username="EMAILADDRESS=abc@xyz.com, CN=certauth, OU=OU1, O=XYZ,
L=ABC, ST=CA, C=US" password=""
roles="webservice,admin,manager,manager-gui"/>
</tomcat-users>
I have changed the web.xml of my web services to refer to the role
configured in the tomcat-users.xml.
Here is the web.xml:
<security-constraint>
<display-name>ClientCertificateRequired</display-name>
<web-resource-collection>
<web-resource-name>MyWebService</web-resource-name>
<description></description>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description></description>
<role-name>webservice</role-name>
</auth-constraint>
<user-data-constraint>
<description></description>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>tomcat-users</realm-name>
</login-config>
<security-role>
<description></description>
<role-name>webservice</role-name>
</security-role>
In other web applications, I didnt make any changes in the web.xml of those
apps.
Regards,
Savitha
On Thu, Dec 8, 2011 at 9:43 AM, Daniel Mikusa <dm...@vmware.com> wrote:
> On Thu, 2011-12-08 at 08:49 -0800, Savitha Akella wrote:
> > Hi,
> >
> > I have multiple applications hosted on my tomcat server which includes
> web
> > services, web applications etc.
> >
> > To secure the web services, we made changes to server.xml ->connector
>
> What specifically did you change in server.xml?
>
> Please also list your connector configuration and what version of Tomcat
> you are using.
>
> Dan
>
> > element and defined roles in tomcat-users.xml.
> > In the web services, we made changes in the web.xml to add the
> > security-constraint, security-role etc.
> >
> > However, the problem we are facing is that all the web application hosted
> > on the Tomcat are prompting for certificate while accessing them.
> >
> > Is there any way to restrict the security only to a single web component
> on
> > the Tomcat server rather than the entire server or all applications on
> the
> > server.
> >
> > Thanks,
> > Savitha
>
Re: Securing only a single web application on Tomcat
Posted by Daniel Mikusa <dm...@vmware.com>.
On Thu, 2011-12-08 at 08:49 -0800, Savitha Akella wrote:
> Hi,
>
> I have multiple applications hosted on my tomcat server which includes web
> services, web applications etc.
>
> To secure the web services, we made changes to server.xml ->connector
What specifically did you change in server.xml?
Please also list your connector configuration and what version of Tomcat
you are using.
Dan
> element and defined roles in tomcat-users.xml.
> In the web services, we made changes in the web.xml to add the
> security-constraint, security-role etc.
>
> However, the problem we are facing is that all the web application hosted
> on the Tomcat are prompting for certificate while accessing them.
>
> Is there any way to restrict the security only to a single web component on
> the Tomcat server rather than the entire server or all applications on the
> server.
>
> Thanks,
> Savitha
Re: Securing only a single web application on Tomcat
Posted by Pid * <pi...@pidster.com>.
On 8 Dec 2011, at 23:41, Pid * <pi...@pidster.com> wrote:
> On 8 Dec 2011, at 16:50, Savitha Amelia <sa...@gmail.com> wrote:
>
>> Hi,
>>
>> I have multiple applications hosted on my tomcat server which includes web
>> services, web applications etc.
>>
>> To secure the web services, we made changes to server.xml ->connector
>> element and defined roles in tomcat-users.xml.
>> In the web services, we made changes in the web.xml to add the
>> security-constraint, security-role etc.
>>
>> However, the problem we are facing is that all the web application hosted
>> on the Tomcat are prompting for certificate while accessing them.
>>
>> Is there any way to restrict the security only to a single web component on
>> the Tomcat server rather than the entire server or all applications on the
>> server.
>
> Yes. Depends on what your requirement is and what you've done so far.
> Maybe you could tell exactly?
Ah, the perils of replying before all mail has downloaded...
p
>
>
> p
>
>
>
>>
>> Thanks,
>> Savitha
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Securing only a single web application on Tomcat
Posted by Pid * <pi...@pidster.com>.
On 8 Dec 2011, at 16:50, Savitha Amelia <sa...@gmail.com> wrote:
> Hi,
>
> I have multiple applications hosted on my tomcat server which includes web
> services, web applications etc.
>
> To secure the web services, we made changes to server.xml ->connector
> element and defined roles in tomcat-users.xml.
> In the web services, we made changes in the web.xml to add the
> security-constraint, security-role etc.
>
> However, the problem we are facing is that all the web application hosted
> on the Tomcat are prompting for certificate while accessing them.
>
> Is there any way to restrict the security only to a single web component on
> the Tomcat server rather than the entire server or all applications on the
> server.
Yes. Depends on what your requirement is and what you've done so far.
Maybe you could tell exactly?
p
>
> Thanks,
> Savitha
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org