Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (athena.apache.org: local policy)
From: dB. <dblock@dblock.org>
To: Tomcat Users List <users@tomcat.apache.org>
Date: Tue, 2 Nov 2010 18:03:46 -0400
Subject: RE: Tomcat 5.5: how doesone configure an authenticator valve?
Thread-Topic: Tomcat 5.5: how doesone configure an authenticator valve?
Thread-Index: Act6iwGcwTVqCoLsTaujh8PoiBUQIgARFm2QAAKNs3A=
Message-ID: 
 <AF5EF1769D564645A9ACC947375F0D0215A97B9ABE@winxbeus13.exchange.xchg>
References: 
 <AF5EF1769D564645A9ACC947375F0D0215A95EEAE3@winxbeus13.exchange.xchg>
 <AANLkTi=z7y7r41+ihaCyz5uVfZ1Dy4LHn_YCVRtvaKUu@mail.gmail.com>
 <AF5EF1769D564645A9ACC947375F0D0215A97B9AAA@winxbeus13.exchange.xchg>
In-Reply-To: 
 <AF5EF1769D564645A9ACC947375F0D0215A97B9AAA@winxbeus13.exchange.xchg>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

After some more code-reading I found the problem. Looking at the implementa=
tion of response.sendError in TC5, it's clear that it dumps whatever header=
s you added prior to the call. Changing this to setStatus fixed the problem=
. I assume this means that Tomcat doesn't get a chance to render it's custo=
m 401 page, but I might be speculating.

I'd appreciate if someone shed some light on which way the code below shoul=
d be implemented (setStatus/sendError/something else?) in various versions =
of Tomcat.

Thx
dB.

dB. @ dblock.org=20
Moscow|Geneva|Seattle|New York


-----Original Message-----
From: dB. [mailto:dblock@dblock.org]=20
Sent: Tuesday, November 02, 2010 4:55 PM
To: Tomcat Users List
Subject: RE: Tomcat 5.5: how doesone configure an authenticator valve?

Thanks for your help. I should have done this (logging) in the first place,=
 sorry. The filter is invoked properly.=20
The new problem is that the headers aren't added (or sent to the client). T=
he code looks like this:

			response.addHeader("WWW-Authenticate", "Negotiate");
			response.addHeader("WWW-Authenticate", "NTLM");
			response.setHeader("Connection", "close");
			response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
			response.flushBuffer();=09

This is executed for sure (put a logging statement in front of it) but has =
no effect, the response looks like a boilerplate 401.=20
Where did my WWW-Authenticate headers and "Connection: close" go? (Maybe it=
 helps, it does work in 6.x).

Thx
dB.

PS: you're looking at some intermediate waffle check-in, the namespace was =
renamed at some point, it's waffle.apache.

dB. @ dblock.org=20
Moscow|Geneva|Seattle|New York


-----Original Message-----
From: Konstantin Kolinko [mailto:knst.kolinko@gmail.com]
Sent: Tuesday, November 02, 2010 8:39 AM
To: Tomcat Users List
Subject: Re: Tomcat 5.5: how doesone configure an authenticator valve?

2010/11/2 dB. <dblock@dblock.org>:
> I am trying to help someone with a Tomcat 5.5 implementation of waffle (w=
affle.codeplex.com). It has authenticator valve that works well with tc6.
> I declare a valve inside the web app:
>
> Context.xml
>
> <?xml version=3D'1.0' encoding=3D'utf-8'?> <Context>
> =A0<Valve className=3D"waffle.apache.NegotiateAuthenticator"=20
> principalFormat=3D"fqn" roleFormat=3D"both" />
> =A0<Realm className=3D"waffle.apache.WindowsRealm" /> </Context>
>

Note, that META-INF/context.xml  (case matters!) is copied to $CATALINA_BAS=
E\conf\Catalina\localhost\<yourapp>.xml  when the webappication starts for =
the first time.  You can have a stale copy there.

I would suggest you to enable more detailed logging.

Something like adding the following line to conf/logging.properties:
waffle.apache.NegotiateAuthenticator.level=3DFINE

BTW, the waffle docs say "waffle.apache.NegotiateAuthenticator", but in the=
 source code it is "waffle.tomcat.NegotiateAuthenticator", i.e.
a different package

http://waffle.codeplex.com/SourceControl/changeset/view/52761#1097376


Are there any interesting messages in the log filess already?

Best regards,
Konstantin Kolinko

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org