Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <48AAFF8B.30703@christopherschultz.net>
Date: Tue, 19 Aug 2008 13:14:51 -0400
From: Christopher Schultz <chris@christopherschultz.net>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: https & j_security_check apparently Solved :P
References: <BLU119-W3261EEA210B632D8C56769FB740@phx.gbl>
 <489D04ED.5000706@christopherschultz.net>
   <BLU119-W542B1A21A22910DE001D90FB770@phx.gbl> <489DC7B6.8060703@apache.org>
   <BLU119-W22BB8E84789208DDD01731FB770@phx.gbl>
  <BLU119-W380E5992985060823F06E7FB730@phx.gbl>
  <48A30423.1020209@christopherschultz.net>
  <BLU119-W326D9021A1BE4ED59DFBDAFB730@phx.gbl>
  <48A309EB.5040305@christopherschultz.net>
  <BLU119-W20137673BB8DFE939E044FFB730@phx.gbl>
  <48A31D87.7000602@christopherschultz.net>
  <BLU119-W1333B2C7A6F098A4C12D94FB720@phx.gbl>
  <48A45D72.1020507@christopherschultz.net>
  <BLU119-W3A4AC89498871780D9B44FB6D0@phx.gbl>
  <48A59C51.20807@christopherschultz.net>
  <BLU119-W32D961A9320C4C9D4BFFF9FB6D0@phx.gbl>
  <48A5B7D5.2070802@christopherschultz.net>
  <BLU119-W52151F9D98F22195DF3864FB690@phx.gbl>
 <BLU119-W511F8507CF255F868A2ACEFB690@phx.gbl>
In-Reply-To: <BLU119-W511F8507CF255F868A2ACEFB690@phx.gbl>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julio,

Julio César Chaves Fernández wrote:
> I'm sorry but i read the previous question and now that i notice i
> doesn't make any sense given that apache is connecting tomcat by AJP
> connector ... the question would be if there is a way to redirect a
> request over http for an application that has a confidential
> transport guarantee defined in the application not through the port
> defined in the AJP connector but by port 443?

If you want all traffic to be handled by Apache httpd and mod_jk in this
way:

Client --- HTTP  (80)  ---> Apache httpd --- AJP (8100) ---> Tomcat
Client --- HTTPS (443) ---> Apache httpd --- AJP (8100) ---> Tomcat

Then you need only a single connector:

<Connector port="8100" protocol="AJP/1.3" />

(Plus any other settings you want to add).

Apache httpd will handle all of the HTTPS stuff for you. Remove all
other connectors from Tomcat.

If you want to be able to support alternate ports that go directly to
Tomcat, like this:

Client --- HTTP  (80)  ---> Tomcat
Client --- HTTPS (443) ---> Tomcat

Then you will need two connectors:

<Connector port="80" />
<Connector port="443" scheme="https" sslProtocol="TLS"/>

(Plus any other settings you want to add).

If you want to support both configurations at the same time, you will
need 3 connectors, but each with unique port numbers. Something like this:

Client --- HTTP  (80)  ---> Apache httpd --- AJP (8100) ---> Tomcat
Client --- HTTPS (443) ---> Apache httpd --- AJP (8100) ---> Tomcat
Client --- HTTP  (8080) ---> Tomcat
Client --- HTTPS (8443) ---> Tomcat

<Connector port="8100" protocol="AJP/1.3" />    <!-- for AJP   -->
<Connector port="8080" redirectPort="8443" />   <!-- for HTTP  -->
<Connector port="8443" scheme="https" sslProtocol="TLS"/>

If you want to use port 443 as the redirect port for your 8080
connector, then go ahead and do it. However, to me it only makes sense
to support /either/ direct-to-Tomcat /or/ via-Apache-httpd configurations.

- -chris

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkiq/4sACgkQ9CaO5/Lv0PC7dwCgky/b57zH2RYKBc14jPo1mNXQ
/g8AnAhjkevlaEyaoG0B7Pz3txgn8FFp
=BhcA
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org