How to run an application with different user to TC container

[Andrew Hunt <An...@nab.com.au>]

Hi
We have a Tomcat 7.0.39 instance with several applications running within it, but all running as the same user as the Tomcat instance.  We have a new application we are wanting to add, but this needs to run with a different user as it has different accesses it needs that cannot be granted to the other applications.  I have searched and read, but found anything that looks at this level of configuration.

For example, /opt/apache-tomcat-7.0.39/bin/startup.sh is executed as 'fewperms'.  It has an application /mydbprocessor that does stuff using a jdbc connection to a db that also executes as fewperms.  I am now adding an application /mydeployer that needs to have sudo rights that 'fewperms' may not have (company policy).

I would prefer not to have a separate instance of Tomcat to achieve this.  Everything I have seen / read about so far is how to access TC as a user with a different user, not how to run an application as a different user.

Thanks...Andrew

________________________________
The information contained in this email communication may be confidential. If you have received this email in error, please notify the sender by return email, delete this email and destroy any copy.
Any advice contained in this email has been prepared without taking into account your objectives, financial situation or needs. Before acting on any advice in this email, National Australia Bank Limited (NAB) recommends that you consider whether it is appropriate for your circumstances. If this email contains reference to any financial products, NAB recommends you consider the Product Disclosure Statement (PDS) or other disclosure document available from NAB, before making any decisions regarding any products.
If this email contains any promotional content that you do not wish to receive, please reply to the original sender and write "Don't email promotional material" in the subject.

Re: How to run an application with different user to TC container

[Christopher Schultz <ch...@christopherschultz.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

André,

On 5/16/13 3:23 AM, André Warnier wrote:
> Andrew Hunt wrote:
>> Hi We have a Tomcat 7.0.39 instance with several applications
>> running within it, but all running as the same user as the Tomcat
>> instance. We have a new application we are wanting to add, but
>> this needs to run with a different user as it has different
>> accesses it needs that cannot be granted to the other
>> applications.  I have searched and read, but found anything that
>> looks at this level of configuration.
>> 
>> For example, /opt/apache-tomcat-7.0.39/bin/startup.sh is executed
>> as 'fewperms'.  It has an application /mydbprocessor that does
>> stuff using a jdbc connection to a db that also executes as
>> fewperms.  I am now adding an application /mydeployer that needs
>> to have sudo rights that 'fewperms' may not have (company
>> policy).
>> 
>> I would prefer not to have a separate instance of Tomcat to
>> achieve this.  Everything I have seen / read about so far is how
>> to access TC as a user with a different user, not how to run an
>> application as a different user.
>> 
> 
> Well, you have to think that it would have to be the JVM which
> runs Tomcat which would need to be able to switch to another user
> on-the-fly, each time it runs that specific application. I do not
> think that this can easily be done (and there is probably nothing
> in Tomcat per se that would allow this).

+1

I don't know of a multi-user OS that allows a process to run as more
than one user at a time. You can switch-users, but the process must
have that privilege to begin with, and often once you switch (e.g. to
shed privileges), you can't get them back, so it's a one-way trip.

> So I believe that you have no choice but to run another instance
> under that separate user.

+1

> That is probably a good case for an Apache httpd front-end and 2
> Tomcat back-ends.

+1

I would also seriously reconsider running anything that requires
"sudo" access through Tomcat... you are just asking for trouble from
resource management all the way through security.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJRlakjAAoJEBzwKT+lPKRYR98P/1Ny0KUcbeFqa/w8k0XFlf3U
bmF2EhZA9LK8r30XNtBMVQMWNNFewDOwyjYCmLaSlgK8OmA76aFH8W8OMmCHo5tj
Sl8n0d4u48cTgZDTHVUdmYtNNhj8lE4KW7HeqFfu9eJ/VZInKbgs+9A8RqsaAjLw
d0afo7GgtlNQEiBjLffMcviQbXfHxgVa3If7NglnBsRpV+BbmFKjK8Ar8EnQ3IN8
i+3giyuAADX19MQOe3tNHE8yFZ47QB+eh1MArfW0W6TVfSylj0+Dfeh9GOO3ettL
bEKv/w6/teYEpxUO3J4ZxF4ZKFwhyiIvFQMtDWaiXzOOQ9r7779Mih2eHkPgeKCd
oCTL1BuXkTBqzfcH3+teH/51TfXOQHWIdP2X9NQWGjMsAlaiC6JgiuItz58/LCVw
ESEpek063MKuRXL8j8qpH5MS8kcb/6r2MAz4nIbsdFbaFX6HZlXzdTrdtm8Kp59H
ORIq2mjHIWPcDrcRVx+B+fPfwk2riqsKKYzbdatg6uzSBMcuu0rYdsQWTMcvWqEV
FZ1yA0Tr2jF/SDeOJ3D4SN5KZBUD0nhfqXdKpwwA+0s1Zd6xUtyvyeTeWTG607hJ
bTGpkVn/EmvkPoO5JKxIwMPcxBgldthdnK8UIpobx4Lik9AAc+nf4RVmUmq8vxtH
cNdhK8+KleAlkeoZ3GEq
=S2Y+
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: How to run an application with different user to TC container

[André Warnier <aw...@ice-sa.com>]

Andrew Hunt wrote:
> Hi
> We have a Tomcat 7.0.39 instance with several applications running within it, but all running as the same user as the Tomcat instance.  We have a new application we are wanting to add, but this needs to run with a different user as it has different accesses it needs that cannot be granted to the other applications.  I have searched and read, but found anything that looks at this level of configuration.
> 
> For example, /opt/apache-tomcat-7.0.39/bin/startup.sh is executed as 'fewperms'.  It has an application /mydbprocessor that does stuff using a jdbc connection to a db that also executes as fewperms.  I am now adding an application /mydeployer that needs to have sudo rights that 'fewperms' may not have (company policy).
> 
> I would prefer not to have a separate instance of Tomcat to achieve this.  Everything I have seen / read about so far is how to access TC as a user with a different user, not how to run an application as a different user.
> 

Well, you have to think that it would have to be the JVM which runs Tomcat which would 
need to be able to switch to another user on-the-fly, each time it runs that specific 
application.
I do not think that this can easily be done (and there is probably nothing in Tomcat per 
se that would allow this).
So I believe that you have no choice but to run another instance under that separate user.
That is probably a good case for an Apache httpd front-end and 2 Tomcat back-ends.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org