Why won't eclipse app instance run in https - eclipse

I am maintaining a servlet application previously developed in Eclipse Helios. I have the servlet instance war file and it runs fine in my Tomcat 7.0 on windows and I receive the correct web responses in SoapUI. It runs with SSL encryption and the url in SoapUI states;
https://localhost:8443/ProjectName/etc/etc
But after retrieving the original code from SVN into Eclipse Helios, I can get it to start okay running through the imported Tomcat but it does not seem to start using SSL in Eclipse Helios and the URL in the Eclipse tab states;
http://localhost:8000/ProjectName/etc/etc
And so when I attempt to run a web request in SoapUI it reacts like the servlet instance is not running. What am I doing wrong?

This solution is supplied for MAC, can follow the same strategy for windows as well.
Step 1) Generate the certificate with java keytool utility by navigating to bin folder of java installation directory
LM-MAA-22004958:etc rkala$ cd /Applications/corona-java-1.1.0/jdk-7u45-macosx-x64/Contents/Home/bin
LM-MAA-22004958:bin rkala$ keytool -genkey -alias myappcert -keyalg RSA -keystore myapp.keystore
Enter keystore password:
Re-enter new password:
What is your first and last name?
[Unknown]: localhost.xyz.com
What is the name of your organizational unit?
[Unknown]: my
What is the name of your organization?
[Unknown]: my
What is the name of your City or Locality?
[Unknown]: my
What is the name of your State or Province?
[Unknown]: my
What is the two-letter country code for this unit?
[Unknown]: my
Is CN=localhost.xyz.com, OU=my, O=my, L=my, ST=my, C=my correct?
[no]: yes
Enter key password for <myappcert>
(RETURN if same as keystore password):
Step 2): Copy the generated myapp.keystore file to tomcat /conf directory
LM-MAA-22004958:bin rkala$ mv myapp.keystore /Users/rkala/Downloads/apache-tomcat-7.0.93/conf
LM-MAA-22004958:bin rkala$ cd /Users/rkala/Downloads/apache-tomcat-7.0.93/bin
LM-MAA-22004958:bin rkala$ ./startup.sh
Using CATALINA_BASE: /Users/rkala/Downloads/apache-tomcat-7.0.93
Using CATALINA_HOME: /Users/rkala/Downloads/apache-tomcat-7.0.93
Using CATALINA_TMPDIR: /Users/rkala/Downloads/apache-tomcat-7.0.93/temp
Using JRE_HOME: /Applications/corona-java-1.1.0/jdk-7u45-macosx-x64/Contents/Home
Using CLASSPATH: /Users/rkala/Downloads/apache-tomcat-7.0.93/bin/bootstrap.jar:/Users/rkala/Downloads/apache-tomcat-7.0.93/bin/tomcat-juli.jar
Hit the browser with url https://localhost:8443 and you are good to go
Step 3) Modify both server.xml with the same config provided below
1.Tomcat server.xml -> Path: /Users/rkala/Downloads/apache-tomcat-7.0.93/conf/server.xml
2.Under eclipse workspace server folder,modify the server.xml here as well
Add the tls config below this section of commented code. I used port 8443 for https
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector
SSLEnabled="true"
clientAuth="false"
keyAlias="myappcert"
keystoreFile="/Users/rkala/Downloads/apache-tomcat-7.0.93/conf/myapp.keystore"
keystorePass="password which you supplied while generating the certificate using keytool"
maxThreads="200"
port="8443"
scheme="https"
secure="true"
sslProtocol="TLS"
/>
Step 4) Catalina policy permission:
Modify the catalina.policy file located in /conf folder of tomcat installation directory
Search for below keyword(grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar) and replace all the code with single line as mentioned below
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
permission java.security.AllPermission;
};
Step 5) Modify the eclipse.ini file and add the below entries and then restart the eclipse.
-vmargs
-Djavax.net.ssl.trustStore=/Users/rkala/Downloads/apache-tomcat-7.0.93/conf/myapp.keystore
-Djavax.net.ssl.trustStorePassword=password which you supplied at step 1
Now you should be able to launch the application and will be able to access it via https

I assume you are referring to running tomcat from within Eclipse. By default the server instances managed by Eclipse (projects in their own right) each have their own separate copies of the tomcat config files (server.xml, context.xml, tomcat-users.xml etc) based on the locally installed runtime version selected at creation. So if the SSL connector is not enabled within that configuration then it won't be started. This allows you to have more than one tomcat instance running at the same time, each with a different config.
To edit the configuration for an Eclipse managed tomcat instance, look for Servers in the project explorer, open your instance and edit the server.xml to uncomment the SSL connector tag which will look something like:
<Connector SSLEnabled="true" clientAuth="false" maxThreads="150" port="8443" protocol="HTTP/1.1" scheme="https" secure="true" sslProtocol="TLS"/>
You may also need to create a keystore for tomcat if you haven't already - see the docs for more info: http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html.
Restart tomcat from within Eclipse and try the secure address. Hope that helps.

I deleted the server in Eclipse and add it again and now everything appears to be working. Thanks to all who viewed and inputted.

Related

MacOS - Port 443 required by Tomcat v7.0 Server at localhost is already in use

I try to run a local tomcat7 server from my Eclipse on port 443.
But when I try to start it I get the following error:
Port 443 required by Tomcat v7.0 Server at localhost is already in
use. The server may already be running in another process, or a system
process may be using the port. To start this server you will need to
stop the other process or change the port number(s).
I looked around and saw a few answers to similar questions but can't get it to work.
I tried running Eclise as ROOT
$ sudo open /Applications/Eclipse.app
I also made sure that nothing is running on port 443
$ lsof -i :443
This returns nothing
When I go to 127.0.0.1:443 (http and https), I get the following result:
This site can’t be reached
127.0.0.1 refused to connect.
my local tomcat (defined in Eclipse) server.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--><!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
--><Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
<!-- Security listener. Documentation at /docs/config/listeners.html
<Listener className="org.apache.catalina.security.SecurityListener" />
-->
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener SSLEngine="on" className="org.apache.catalina.core.AprLifecycleListener"/>
<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
<Listener className="org.apache.catalina.core.JasperListener"/>
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase"/>
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" redirectPort="443"/>
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />
-->
<!-- Define a SSL HTTP/1.1 Connector on port 443
This connector uses the BIO implementation that requires the JSSE
style configuration. When using the APR/native implementation, the
OpenSSL style configuration is required as described in the APR/native
documentation -->
<Connector port="443"
protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keyAlias="dev-tomcat-cert-es"
keystoreFile="<the correct path to the keystore file>"
keystorePass="<the correct password>"
/>
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="443"/>
<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine defaultHost="localhost" name="Catalina">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
</Realm>
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" pattern="%h %l %u %t "%r" %s %b" prefix="localhost_access_log." suffix=".txt"/>
<Context docBase="ct-server" path="/app" reloadable="true" source="org.eclipse.jst.jee.server:ct-server"/></Host>
</Engine>
</Service>
</Server>
I am wondering if MacOs is running something on this port that I can't see.
Or if there is some kind of loop in my configuration which tries to connect twice to the port.
I am using MacOs-Sierra
Any help would be appreciated.
Thanks.
Follow one single step:
1) Delete the server you have created.
a)then create new server ofcourse (i hv attached screenshots for steps)
[Delete your current server][1]
For Creating new server:
1)create new server and delete previously added Configure Environment Variable
Create new server (1)
[click on configure environment variables][3]
[remove the previously added variable and create new][4]
while adding new click next and look for your installed jre
This error shows up if you installed tomcat on MacOs-Sierra using brew.
#Michael-O is right - you need to be root.
One good way to get round that is to bind to 8443 instead of 443. Changing ports unleashes another error about the server not starting within the set timeout.
Either that or the "document does not exist error" will hit first.
The hurdles aren't few. The easiest option - install tomcat using a zip file.
Go to https://tomcat.apache.org/download-70.cgi, download a zip, unzip it and in Eclipse, create a new server and specify "tomcat installation directory" as the unzipped file.

Tomcat Eclipse ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I configured Tomcat 7 for SSL. I generate the keystore like this
keytool -genkey -alias tomcat -keyalg RSA
in the server.xml, i have
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keyAlias="tomcat" keystoreFile="/Users/xxxxx/.keystore" keystorePass="changeit" />
If I run tomcat directly, $TOMCAT_HOME/bin/startup.sh, when I access https://localhost:8443 from Chrome, at least i got the warning of untrusted certificate, etc...
However, if I start Tomcat from Eclipse, it keep getting this error
localhost uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
I even added the ciphers to the Connector, but still same error
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keyAlias="tim" keystoreFile="/Users/z0029mb/.keystore" keystorePass="changeit"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"/>
JAVA_HOME is jdk1.8.0_101, for both Eclipse and Tomcat, running on OS X. So why does Eclipse Tomcat plugin interfere anything with Tomcat starting up that make Tomcat behave differently?
If you use SHA-1 hash function, you might have to re-key the certificate from your Certificate Authority (CA) to use SHA-2. This is because SHA-1 is potentially unsecure.
1) Generate a CSR (Certificate Signing Request)
2) Submit CSR to your CA
3) After your CA issues the certificate files, download and install them based on your server type and CA's instructions.

Eclipse + RunJettyRun + Spring MVC: how to set SSL for testing?

I am using Eclipse (Luna) and RunJettyRun to develop a Spring MVC website on Windows 7. I would like to test whether it works on SSL for certain pages or directories.
I have a self-assigned SSL certificate (file: .keystore) in C:\Users\Me with the default password "changeit".
In my Spring's security context, I have the following:
<http auto-config="false" use-expressions="true" request-matcher="regex" >
....
<intercept-url pattern="^\/login$" requires-channel="https" />
<port-mappings>
<port-mapping http="8080" https="8443"/>
</port-mappings>
</http>
When I click http://localhost:8080/login, I am redirected to https://localhost:8443/login (which works as expected) and I get the following message in Chrome:
This webpage is not available
This is understandable because I haven't setup anything for port 8443.
How to set SSL for port 8443 in my situation? Googled quite a bit, but what I found is mostly about setup for standalone Jetty.
Thanks for any pointers and input!

Issue while configuring Kerberos on Websphere Application Server

Team,
I have a question on Single Sign On using Kerberos Authentication.
We have generated a keytab file for the domain like "POC.MAIL.COM" and our server is hosted on "SW.MAIL.COM". As our application runs on Websphere Application Server, we tried to set the Kerberos configuration as given in the document (page no:167)http://www.redbooks.ibm.com/redbooks/pdfs/sg247771.pdf .
We are facing the an error saying that "Cannot get credential for principal service HTTP/server1.SW.MAIL.COM#SW.MAIL.COM". Can someone help me in resolving the issue..?
Please post a comment if any additional information is required..
When I try to set the krb5.conf and keytab file on "Kerberos Authentication Mechanism page", we are getting this error.
When I ran the command klist as per your input, I got the output as below
"Key table: /etc/krb5/pocsso.keytab
Number of entries: 1
[1.] principal: HTTP/server1.sw.mail.com#POC.MAIL.COM
KVNO: 12
"
UPDATE
.
Ticket cache: FILE:/tmp/krb5cc_38698
Default principal: pocsso1#POC.MAIL.COM
Valid starting Expires Service principal
01/09/2014 16:15 02/09/2014 02:21 krbtgt/POC.MAIL.COM#POC.MAIL.COM
renew until 08/09/2014 16:15
Specify it only on the Global security > SPNEGO web authentication, not on the Kerberos configuration page. If keytab path is correct in your krb5.conf file, it is enough to provide just path to conf file (keytab is optional).
UPDATE
In the filter definition you should have:
Host name: server1.sw.mail.com
Kerberos realm name: POC.MAIL.COM
Filter criteria: yourFilterCriteria
Trim Kerberos realm from principal name - checked
See configuration details here: Enabling and configuring SPNEGO web authentication using the administrative console
Minimal configuration in web.xml for Java EE security. And you have to have Application Security enabled in the server configuration, and mapped userRole to some users/groups from registry.
<security-constraint>
<display-name>constraint</display-name>
<web-resource-collection>
<web-resource-name>all resources</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>userRole</role-name>
</auth-constraint>
</security-constraint>
A bit of a late answer.
Regenerate the keytab file by running the ktpass command as:
ktpass -out file.keytab -princ HTTP/server1.SW.MAIL.COM#POC.MAIL.COM -mapuser your-user -pass your-pwd -ptype KRB5_NT_PRINCIPAL
Solving the error:
org.ietf.jgss.GSSException, major code: 11, minor code: 0
major string: General failure, unspecified at GSSAPI level
minor string: Cannot get credential for principal HTTP/appserver.example.com#EXAMPLE.COM
boils downs to the following rules when generating the keytab file:
The principal service must follow the format
<service name>/<fully qualified hostname>#KerberosRealm
Double check the spelling of the principal service
The service name must be all upper case, that is HTTP and not http
The Kerberos realm must also be all upper case, and
The host name must be found in the /etc/host file or the DNS server.
Sources:
http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/usec_kerb_auth_mech.html
http://www.redbooks.ibm.com/redbooks/pdfs/sg247771.pdf (page 477)

link apache web server on port 80 and tomcat webapp on port 8080

On port 80 I have normal apache web server.
On port 8080 I have tomcat with client and server side stuff.
My goal is:
www.mydomain.com renders a static and SEO friendly index.html while javascript stuff is loading.
In the header of this index.html I load www.mydomain.com:8080/myapp/stuff.js
stuff.js is compiled with gwt and calls a RootLayoutPanel.get().add(nice_panel) which will remove static content and show dynamic widgets. It also calls servlets (server side code).
Problem: for security reasons, browsers wont let me load www.mydomain.com:8080/myapp/stuff.js because it is on a different port.
Wrong attempt: I tried to create a symlink from "normal" apache web server directory to the tomcat webapp containing stuff.js. I am now able to load stuff.js because its url is: www.mydomain.com/mysymlink_to_tomcat/stuff.js. But stuff.js is not able anymore to call servlets on server side again because of browsers security rules ("XMLHttpRequest cannot load ... origin ...is not allowed by Access-Control-Allow-Origin").
I would like to avoid the "crazy" solution of redirect from index.html to tomcat with header('location: http://mydomain.com:8080/another_index_on_tomcat.html'). This solution works but it has many drawbacks (SEO...)
What would be the best approach ?
Thanks.
You have basically two solutions:
make it work with the 2 origins: use the xsiframe linker in GWT to allow the page on :80 to load the script from :8080 (for readers: it's not about loading, it's about what the script does).
Add the following to your `gwt.xml:
<add-linker name='xsiframe' />
That unfortunately won't solve your issue with GWT-RPC (o whatever you use to talk to the server). For that, there's CORS.
use a single origin: use Apache's mod_proxy (or mod_jk) to proxy your Tomcat through your Apache. Nobody will ever use :8080, everything will go through :80. See Using Tomcat with Apache HTTPD and a proxy at https://developers.google.com/web-toolkit/doc/latest/DevGuideServerCommunication#DevGuideRPCDeployment
And of course there's also the solution of ditching the HTTPD and serving everything with Tomcat (recent Java and Tomcat versions have fixed their slowness issues).
I'm not sure if this would avoid the security error, but you could try an iframe. On apache, you have the index and an iframe to the tomcat, where the JS loads inside the iframe. Dunno if that will help with the SEO problem.
The best solution would be to redirect the port 80 calls to 8080 on apache when the client call is asking for a tomcat application.
Install mod_jk on apache and configure it to mount a context on the path you want
example: (edit /mods_enabled/jk.conf)
# Configure access to jk-status and jk-manager
# If you want to make this available in a virtual host,
# either move this block into the virtual host
# or copy it logically there by including "JkMountCopy On"
# in the virtual host.
# Add an appropriate authentication method here!
<Location /jk-status>
# Inside Location we can omit the URL in JkMount
JkMount jk-status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
<Location /jk-manager>
# Inside Location we can omit the URL in JkMount
JkMount jk-manager
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
JkMount /*/myAppDir/* ajp13
Then add a virtual host in your site settings (edit /apache2/sites-enabled/)
<VirtualHost *:80>
. Here is the rest of the
. of the config of
. the host
# Tomcat jk connector settings
JkMount /*.jsp ajp13_worker
JkMount /myAppDir/* ajp13_worker
JkMount /myAppDir* ajp13_worker
JKMount /manager* ajp13_worker
JkMount /manager/* ajp13_worker
</VirtualHost>
And you should also edit the server.xml file and inside the tag write and comment the previous Host name="localhost"
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<Host name="localhost" appBase="webapps" unpackWARs="true"
autoDeploy="true" >
<Context path="/" docBase="/var/lib/tomcat7/webapps/myAppDir/"
debug="0" reloadable="true" />
<!-- please notes on logs down below -->
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="/var/lib/tomcat7/logs" prefix="tomcat_access_"
suffix=".log" pattern="common" resolveHosts="false" />
</Host>
The only thing left to do is edit the workers.properties file and add
worker.myapp2.port=8009
worker.myapp2.host=localhost
worker.myapp2.type=ajp13
worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=ajp13_worker
Then you should be set to work, and when a url containing the myAppDir appears, the apache server will redirect the calls to tomcat the answer will come back from apache.