John Palmer
2014-01-28 17:41:18 UTC
We have two similar production environments which use:
request.getAttribute("javax.servlet.request.X509Certificate")
for several purposes.
These use tomcat behind IIS using the Jakarta connector (aka reverse proxy)
and have been running since 2006 and 2011 respectively without significant
issues ... other than perhaps insufficient memory (and sometimes IIS can't
talk to Tomcat and everything has to be restarted, multiple times, to
resolve).
We're trying to upgrade/replace these servers with 64-bit Windows OS due
to memory constraints caused by the use of 32-bit OS, and these attributes
(and related SSL attributes in Tomcat) are now returning NULL in our DEV
environment
Old environment:
IIS 5.0 on WIndows Server 2003 SP2, Jakarta Isapi Redirector 1.2.37, TomCat
7.0.47
(While researching "how to set up Jakarta Isapi Redirector in IIS 7.5 with
a 64-bit Windows 2008" I saw multiple people reporting issues with poor
performance, lockups etc, and decided we would try Bon Code instead.)
New Environment
IIS 7.5 on Win Server 2008 R2, Bon Code 1.0.17, TomCat 7.0.47
IIS is configured with Client Cert Required; browser is being prompted for
cert, and cert info is being sent to IIS.
According to Bon Code logs, request headers are being populated with plenty
of information, including client cert and client issuer cert information.
It looks like Tomcat is receiving these request headers, but is not
populating the request attributes related to SSL and Cert information, but
I can't see why in the logs, even after turning the logs to ALL and wading
through the copious output.
After looking through the Tomcat source multiple times, I don't see how the
AJP connector can populate these request attributes at all - but it is in
our current (32-bit OS) environment.
-----------------------------
I understand that Tomcat is NOT doing the SSL connection itself - IIS is,
just as Apache Web Server can be made to do, but my understanding is that
Tomcat should be able to populate these attributes from information sent
with the request throught the AJP connector (eg, in the Request Headers),
That seems to be working wonderfully in our current environment...
I suspect that I simply have something not configured properly - but is it
IIS 7.5, Bon Code, or Tomcat?
After multiple attempts to resolve this I'm at a loss..
your help appreciated...
-------------------------------------------------------------------------
Tomcat Server.xml (AJP connector):
<Connector URIEncoding="*UTF-8*" enableLookups=" *false*" port="*8029*"
protocol="*AJP/1.3*" redirectPort="*8443*" />
(added tomcatAuthentication=" *false*", scheme="https" secure="true"
without making any difference)
Bon Code config:
<Settings>
<Server>localhost</Server>
<Port>8029</Port>
<EnableRemoteAdmin>False</EnableRemoteAdmin>
<EnableHeaderDataSupport>True</EnableHeaderDataSupport>
<ForceSecureSession>False</ForceSecureSession>
<AllowEmptyHeaders>False</AllowEmptyHeaders>
<LogLevel>4</LogLevel>
<LogDir>c:\temp</LogDir>
</Settings>
(Added <ForceSecureSession>True</ForceSecureSession>
-- this caused SSL session ID:
*getAttribute(javax.servlet.request.ssl_session)
*to populate. No other difference).
-----------------------
code in jsp file to show these attributes:
/** prints the request headers being passed in.... */
out.println ("<br><br>Request Headers: <br>");
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String headerName = headerNames.nextElement();
String headerValue = request.getHeader(headerName);
out.println(headerName + " = " + headerValue + "<br>");
}
/** returns plenty of stuff for Bon Code, very little for Jakarta */
*/** *not** reported by request.getAttributeNames() ! */
out.println("<br><br>SSL Attributes: <br>");
out.println("javax.servlet.request.cipher_suite: " +
request.getAttribute("javax.servlet.request.cipher_suite") + "<BR>");
out.println("javax.servlet.request.key_size: " +
request.getAttribute("javax.servlet.request.key_size") + "<BR>");
out.println("javax.servlet.request.X509Certificate: " +
request.getAttribute("javax.servlet.request.X509Certificate") + "<BR>");
out.println("javax.servlet.request.ssl_session: " +
request.getAttribute("javax.servlet.request.ssl_session") + "<BR>");
out.println("SSL_PROTOCOL: " + request.getAttribute("SSL_PROTOCOL") +
"<BR>")
-----------------------
result:
SSL Attributes:
javax.servlet.request.cipher_suite: null
javax.servlet.request.key_size: 2048
javax.servlet.request.X509Certificate: null
javax.servlet.request.ssl_session: on
SSL_PROTOCOL: null
---------------------------------------------------------------------------------------
request.getAttribute("javax.servlet.request.X509Certificate")
for several purposes.
These use tomcat behind IIS using the Jakarta connector (aka reverse proxy)
and have been running since 2006 and 2011 respectively without significant
issues ... other than perhaps insufficient memory (and sometimes IIS can't
talk to Tomcat and everything has to be restarted, multiple times, to
resolve).
We're trying to upgrade/replace these servers with 64-bit Windows OS due
to memory constraints caused by the use of 32-bit OS, and these attributes
(and related SSL attributes in Tomcat) are now returning NULL in our DEV
environment
Old environment:
IIS 5.0 on WIndows Server 2003 SP2, Jakarta Isapi Redirector 1.2.37, TomCat
7.0.47
(While researching "how to set up Jakarta Isapi Redirector in IIS 7.5 with
a 64-bit Windows 2008" I saw multiple people reporting issues with poor
performance, lockups etc, and decided we would try Bon Code instead.)
New Environment
IIS 7.5 on Win Server 2008 R2, Bon Code 1.0.17, TomCat 7.0.47
IIS is configured with Client Cert Required; browser is being prompted for
cert, and cert info is being sent to IIS.
According to Bon Code logs, request headers are being populated with plenty
of information, including client cert and client issuer cert information.
It looks like Tomcat is receiving these request headers, but is not
populating the request attributes related to SSL and Cert information, but
I can't see why in the logs, even after turning the logs to ALL and wading
through the copious output.
After looking through the Tomcat source multiple times, I don't see how the
AJP connector can populate these request attributes at all - but it is in
our current (32-bit OS) environment.
-----------------------------
I understand that Tomcat is NOT doing the SSL connection itself - IIS is,
just as Apache Web Server can be made to do, but my understanding is that
Tomcat should be able to populate these attributes from information sent
with the request throught the AJP connector (eg, in the Request Headers),
That seems to be working wonderfully in our current environment...
I suspect that I simply have something not configured properly - but is it
IIS 7.5, Bon Code, or Tomcat?
After multiple attempts to resolve this I'm at a loss..
your help appreciated...
-------------------------------------------------------------------------
Tomcat Server.xml (AJP connector):
<Connector URIEncoding="*UTF-8*" enableLookups=" *false*" port="*8029*"
protocol="*AJP/1.3*" redirectPort="*8443*" />
(added tomcatAuthentication=" *false*", scheme="https" secure="true"
without making any difference)
Bon Code config:
<Settings>
<Server>localhost</Server>
<Port>8029</Port>
<EnableRemoteAdmin>False</EnableRemoteAdmin>
<EnableHeaderDataSupport>True</EnableHeaderDataSupport>
<ForceSecureSession>False</ForceSecureSession>
<AllowEmptyHeaders>False</AllowEmptyHeaders>
<LogLevel>4</LogLevel>
<LogDir>c:\temp</LogDir>
</Settings>
(Added <ForceSecureSession>True</ForceSecureSession>
-- this caused SSL session ID:
*getAttribute(javax.servlet.request.ssl_session)
*to populate. No other difference).
-----------------------
code in jsp file to show these attributes:
/** prints the request headers being passed in.... */
out.println ("<br><br>Request Headers: <br>");
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String headerName = headerNames.nextElement();
String headerValue = request.getHeader(headerName);
out.println(headerName + " = " + headerValue + "<br>");
}
/** returns plenty of stuff for Bon Code, very little for Jakarta */
*/** *not** reported by request.getAttributeNames() ! */
out.println("<br><br>SSL Attributes: <br>");
out.println("javax.servlet.request.cipher_suite: " +
request.getAttribute("javax.servlet.request.cipher_suite") + "<BR>");
out.println("javax.servlet.request.key_size: " +
request.getAttribute("javax.servlet.request.key_size") + "<BR>");
out.println("javax.servlet.request.X509Certificate: " +
request.getAttribute("javax.servlet.request.X509Certificate") + "<BR>");
out.println("javax.servlet.request.ssl_session: " +
request.getAttribute("javax.servlet.request.ssl_session") + "<BR>");
out.println("SSL_PROTOCOL: " + request.getAttribute("SSL_PROTOCOL") +
"<BR>")
-----------------------
result:
SSL Attributes:
javax.servlet.request.cipher_suite: null
javax.servlet.request.key_size: 2048
javax.servlet.request.X509Certificate: null
javax.servlet.request.ssl_session: on
SSL_PROTOCOL: null
---------------------------------------------------------------------------------------