You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@commons.apache.org by Jorge Morales Pou <jm...@tid.es> on 2004/03/04 09:29:21 UTC
Re[2]: [HttpClient] Trying to obtain a realm to send the correct
authentication
Hi,
Something strange is happening to me. I packetsniff a normal request
through the browser, and off-course everything goes fine, but when i
try to do a connection through httpclient to a protected resource I
donŽt get the 401 HTTP header, even more, I donŽt get any hHTTP
header at all in the response. Can it be a server problem?
I donŽt think it has anything to do with the server, but itŽs so
weird that I can`t understand anything?
Can anybody throw a light on this?
----- [ El 03/03/2004 commons-user@jakarta.apache.org dijo: ] ----------->
> Hi Jorge,
> There are a couple of options here.
> 1) use a null realm in setCredentials(). This will cause the
> credentials to match for all realms on the given host.
> 2) Manually parse the returned 'WWW-Authenticate' header for the realm.
> #2 is definitely a hack. This problem is being worked on for the next
> major HttpClient release (probably 3.0).
> Mike
> Jorge Morales Pou wrote:
>> Hi,
>> I have a web-application protected by an ISAPI filter. For loggin
>> off users we have implemented a varying realm system, where the
>> realm changes from time to time, thus itŽs not always the same.
>>
>> We want to access some protected resources from Java, but we dontŽt
>> have a realm to use in the
>> HttpClient.getState().setCredentials(...)
>> We want to make a connection to obtain the realm, and then Create
>> the credentials with these realm, and a UsernamePasswordCredentials,
>> but donŽt know how to do it.
>> Is it posible to open a connection, and from the 401 response read
>> the realm to use it further?
>>
>> Thanks from Spain.
>> Saludos,
>> -----------------------
>> "No hay mujer fea,
>> sólo belleza exótica."
>> -----------------------
>> Jorge Morales Pou
>> Telefónica I+D, Madrid.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail:
>> commons-user-help@jakarta.apache.org
>>
----------------------------------------|
Saludos,
-----------------------
"Es usted la mujer más bella que he visto en mi vida...
lo cual no dice mucho en mi favor."
GROUCHO MARX
-----------------------
Jorge Morales Pou
jmp07_ARROBA_tid.es
913371123
Telefónica I+D, Madrid.
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org
Re: [httpClient] Performance and reverse DNS lookup
Posted by Michael Becke <be...@u.washington.edu>.
Hello Christian,
I don't know much about the internal workings of JSSE and it's DNS
behavior, but here's a stab in the dark... It seems that a new
instance of SSLSocketFactory is being created in every call to
getSocketFactory(). My guess is that any caching (DNS and otherwise)
is done by the socket factories. Creating a new instance every time
may cause some problems here.
Mike
On Mar 4, 2004, at 4:35 AM, Christian Myrvold wrote:
> Greetings,
>
> I does not seem like my first mail went through so I am gonna try
> again. In short I have a performance problem with the HttpClient when
> using https agains private networks over dialup/PPP connections. DNS
> records are not available for the webservers I am connecting to. When
> I go connect through my application (which is a sort of a httpsproxy),
> performance is significally slower then when i connect directly to the
> webserver. Allthough when I add correct DNS records (both forward and
> reverse) to my DNS-server, I get a good performance gain. So, I am
> asuming it is the reverse lookup of the DNS that is consuming time.
> Actually I can se from debugging that it is the part where a new
> socket/connection is beeing created that is timeconsuming. So I am
> wondering if there is a way to turn off the reverse lookup in the
> HttpClient or SSL library? I am using the SSLSocketFactory I found on
> these mailinglist. Please see below.
>
> As additional information I can add that I use the whole URL to
> connect. When I create a method i use for an example an URL like this
> in the constructor: https://192.168.20.3. Is this ok? Or should I use
> another way to add the IP-address to avoid reverse lookup?
>
> Also I would like to know if there is any good tips or hints for
> performance in general for the HttpClient?
>
> Help is greatly appreciated!
>
> Best Regards,
> Christian Myrvold
>
> ************
> /*
> * ProxySSLSocketFactory.java
> *
> * Created on 3. mars 2004, 14:36
> */
>
> package no.mitec.sacs.application.proxy;
>
> /**
> *
> * @author cm
> */
> import java.io.IOException;
> import java.net.InetAddress;
> import java.net.Socket;
> import java.net.UnknownHostException;
> import java.security.cert.CertificateException;
> import java.security.cert.X509Certificate;
>
> import javax.net.ssl.SSLContext;
> import javax.net.ssl.SSLSocketFactory;
> import javax.net.ssl.TrustManager;
> import javax.net.ssl.X509TrustManager;
>
> import
> org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory;
>
> public class ProxySSLSocketFactory implements
> SecureProtocolSocketFactory
> {
> private static class TM implements X509TrustManager
> {
> public X509Certificate[] getAcceptedIssuers()
> {
> return new X509Certificate[0];
> }
>
> public void checkClientTrusted(X509Certificate[] arg0, String
> arg1) throws CertificateException
> {
> }
>
> public void checkServerTrusted(X509Certificate[] arg0, String
> arg1) throws CertificateException
> {
> }
> }
>
> private static SSLSocketFactory getSocketFactory()
> {
> try
> {
> SSLContext context = SSLContext.getInstance("SSL");
> context.init(null, new TrustManager[] {new TM()}, null);
> return context.getSocketFactory();
> }
> catch (Exception e)
> {
> throw new RuntimeException(e);
> }
> }
>
> public Socket createSocket(String host, int port, InetAddress
> clientHost,
> int clientPort) throws IOException, UnknownHostException
> {
> return getSocketFactory().createSocket(host, port, clientHost,
> clientPort);
> }
>
> public Socket createSocket(String host, int port)
> throws IOException, UnknownHostException
> {
> return getSocketFactory().createSocket(host, port);
> }
>
> public Socket createSocket(Socket socket, String host, int port,
> boolean autoClose) throws IOException, UnknownHostException
> {
> return getSocketFactory().createSocket(socket, host, port,
> autoClose);
> }
> }
> ************
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org
[httpClient] Performance and reverse DNS lookup
Posted by Christian Myrvold <ch...@mitec.no>.
Greetings,
I does not seem like my first mail went through so I am gonna try again.
In short I have a performance problem with the HttpClient when using
https agains private networks over dialup/PPP connections. DNS records
are not available for the webservers I am connecting to. When I go
connect through my application (which is a sort of a httpsproxy),
performance is significally slower then when i connect directly to the
webserver. Allthough when I add correct DNS records (both forward and
reverse) to my DNS-server, I get a good performance gain. So, I am
asuming it is the reverse lookup of the DNS that is consuming time.
Actually I can se from debugging that it is the part where a new
socket/connection is beeing created that is timeconsuming. So I am
wondering if there is a way to turn off the reverse lookup in the
HttpClient or SSL library? I am using the SSLSocketFactory I found on
these mailinglist. Please see below.
As additional information I can add that I use the whole URL to connect.
When I create a method i use for an example an URL like this in the
constructor: https://192.168.20.3. Is this ok? Or should I use another
way to add the IP-address to avoid reverse lookup?
Also I would like to know if there is any good tips or hints for
performance in general for the HttpClient?
Help is greatly appreciated!
Best Regards,
Christian Myrvold
************
/*
* ProxySSLSocketFactory.java
*
* Created on 3. mars 2004, 14:36
*/
package no.mitec.sacs.application.proxy;
/**
*
* @author cm
*/
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory;
public class ProxySSLSocketFactory implements SecureProtocolSocketFactory
{
private static class TM implements X509TrustManager
{
public X509Certificate[] getAcceptedIssuers()
{
return new X509Certificate[0];
}
public void checkClientTrusted(X509Certificate[] arg0, String
arg1) throws CertificateException
{
}
public void checkServerTrusted(X509Certificate[] arg0, String
arg1) throws CertificateException
{
}
}
private static SSLSocketFactory getSocketFactory()
{
try
{
SSLContext context = SSLContext.getInstance("SSL");
context.init(null, new TrustManager[] {new TM()}, null);
return context.getSocketFactory();
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
public Socket createSocket(String host, int port, InetAddress
clientHost,
int clientPort) throws IOException, UnknownHostException
{
return getSocketFactory().createSocket(host, port, clientHost,
clientPort);
}
public Socket createSocket(String host, int port)
throws IOException, UnknownHostException
{
return getSocketFactory().createSocket(host, port);
}
public Socket createSocket(Socket socket, String host, int port,
boolean autoClose) throws IOException, UnknownHostException
{
return getSocketFactory().createSocket(socket, host, port,
autoClose);
}
}
************
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org
Re: Re[2]: [HttpClient] Trying to obtain a realm to send the correct authentication
Posted by Michael Becke <be...@u.washington.edu>.
Hi Jorge,
Difficult to say from what you've said. Please post a wire log showing
this problem
<http://jakarta.apache.org/commons/httpclient/logging.html>.
Mike
On Mar 4, 2004, at 3:29 AM, Jorge Morales Pou wrote:
> Hi,
>
> Something strange is happening to me. I packetsniff a normal request
> through the browser, and off-course everything goes fine, but when i
> try to do a connection through httpclient to a protected resource I
> donŽt get the 401 HTTP header, even more, I donŽt get any hHTTP
> header at all in the response. Can it be a server problem?
> I donŽt think it has anything to do with the server, but itŽs so
> weird that I can`t understand anything?
>
> Can anybody throw a light on this?
>
>
> ----- [ El 03/03/2004 commons-user@jakarta.apache.org dijo: ]
> ----------->
>> Hi Jorge,
>
>> There are a couple of options here.
>
>> 1) use a null realm in setCredentials(). This will cause the
>> credentials to match for all realms on the given host.
>> 2) Manually parse the returned 'WWW-Authenticate' header for the
>> realm.
>
>> #2 is definitely a hack. This problem is being worked on for the next
>> major HttpClient release (probably 3.0).
>
>> Mike
>
>> Jorge Morales Pou wrote:
>
>>> Hi,
>>> I have a web-application protected by an ISAPI filter. For loggin
>>> off users we have implemented a varying realm system, where the
>>> realm changes from time to time, thus itŽs not always the same.
>>>
>>> We want to access some protected resources from Java, but we dontŽt
>>> have a realm to use in the
>>> HttpClient.getState().setCredentials(...)
>>> We want to make a connection to obtain the realm, and then Create
>>> the credentials with these realm, and a
>>> UsernamePasswordCredentials,
>>> but donŽt know how to do it.
>>> Is it posible to open a connection, and from the 401 response read
>>> the realm to use it further?
>>>
>>> Thanks from Spain.
>>> Saludos,
>>> -----------------------
>>> "No hay mujer fea,
>>> sólo belleza exótica."
>>> -----------------------
>>> Jorge Morales Pou
>>> Telefónica I+D, Madrid.
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
>>> For additional commands, e-mail:
>>> commons-user-help@jakarta.apache.org
>>>
>
> ----------------------------------------|
>
>
>
> Saludos,
> -----------------------
> "Es usted la mujer más bella que he visto en mi vida...
> lo cual no dice mucho en mi favor."
> GROUCHO MARX
> -----------------------
> Jorge Morales Pou
> jmp07_ARROBA_tid.es
> 913371123
> Telefónica I+D, Madrid.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org