Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of seema165@hotmail.com designates
 157.55.1.168 as permitted sender)
Message-ID: <DUB119-W153427149B110FA43D5C2B82500@phx.gbl>
Content-Type: multipart/alternative;
	boundary="_05698a1d-08ab-4249-bf77-312be7d52102_"
From: Seema Patel <seema165@hotmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Subject: RE: java.net.UnknownHostException: Failed to negotiate with a
 suitable domain controller for xxx
Date: Thu, 1 Aug 2013 12:02:34 +0100
Importance: Normal
In-Reply-To: <51FA332F.2000702@ice-sa.com>
References: <DUB119-W44CE670430613755F2097582570@phx.gbl>
 <DUB119-W17879920BA8D54F8A0034582500@phx.gbl>,<51FA332F.2000702@ice-sa.com>
MIME-Version: 1.0

--_05698a1d-08ab-4249-bf77-312be7d52102_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


> Date: Thu=2C 1 Aug 2013 12:06:39 +0200
> From: aw@ice-sa.com
> To: users@tomcat.apache.org
> Subject: Re: java.net.UnknownHostException: Failed to negotiate with a su=
itable domain controller for xxx
>=20
> Seema Patel wrote:
> > Hi=2C
> > =20
> > I am not sure if this is the right List to post this on=2C please advis=
e if it isn't and let me know where is best to post.
> > =20
> > I am getting the following error on one of our applications running on =
our intranet:
> > =20
> > 2013-07-31 17:15:11=2C180 [http-xxx.xxx.x.xxx-xx-x] ERROR org.apache.ca=
talina.core.ContainerBase.[Catalina].[localhost].[/forms].[action] - Servle=
t.service() for servlet action threw exception
> > java.net.UnknownHostException: Failed to negotiate with a suitable doma=
in controller for xxx.LOCAL
> > at jcifs.smb.SmbSession.getChallengeForDomain(SmbSession.java:187)
> > at jcifs.http.NtlmHttpFilter.negotiate(NtlmHttpFilter.java:150)
> > at jcifs.http.NtlmHttpFilter.doFilter(NtlmHttpFilter.java:114)
> > at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(App=
licationFilterChain.java:215)
> > at org.apache.catalina.core.ApplicationFilterChain.doFilter(Application=
FilterChain.java:188)
> > at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapper=
Valve.java:213)
> > at org.apache.catalina.core.StandardContextValve.invoke(StandardContext=
Valve.java:172)
> > at org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentic=
atorBase.java:465)
> > at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.=
java:127)
> > at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.=
java:117)
> > at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.j=
ava:393)
> > at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVa=
lve.java:108)
> > at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.ja=
va:174)
> > at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcess=
or.java:837)
> > at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.p=
rocess(Http11AprProtocol.java:640)
> > at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1=
287)
> > at java.lang.Thread.run(Unknown Source)
> > =20
>=20
> I believe that you should read this page carefully=2C in particular the b=
lue text at the=20
> beginning : http://jcifs.samba.org/src/docs/ntlmhttpauth.html
>=20
> Can you have a look at the WEB-INF/web.xml file *of your application*=2C =
and check if there=20
> is a servlet filter configured there=2C which matches the name above ?
>=20
> If so=2C make a backup copy of that web.xml file=2C and then edit it to r=
emove that filter=20
> from it=2C and try again.
> I am not quite sure=2C but it looks possible to me that you have a duplic=
ate authentication=20
> mechanism in use : one at the container (Tomcat) level=2C and one at the =
application level.
> And the one used at the application level is obsolete=2C unsupported=2C u=
nmaintained etc..
>=20

I have found out that JCIFS is no longer supported=2C but it will take a lo=
t of time=2C development and resources to update it to the recommended Jesp=
a.  In my web.xml file I have the following:

<filter>
        <filter-name>NtlmHttpFilter</filter-name>
        <filter-class>jcifs.http.NtlmHttpFilter</filter-class>
          =20
        <!--
            always needed for preauthentication / SMB signatures
        -->
        <init-param>
            <param-name>jcifs.smb.client.domain</param-name>
            <param-value>xxx</param-value>
        </init-param>
        <!-- SMB message signing requires a valid existing login -->
        <init-param>
            <param-name>jcifs.smb.client.username</param-name>
            <param-value>xxx</param-value>
        </init-param>
        <init-param>
            <param-name>jcifs.smb.client.password</param-name>
            <param-value>xxx</param-value>
        </init-param>
        <!-- Set the logging level -->
        <init-param>
            <param-name>jcifs.util.loglevel</param-name>
            <param-value>3</param-value>
        </init-param>
        <!--  allow non-IE browsers to use basic auth -->
        <init-param>
            <param-name>jcifs.http.insecureBasic</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>HRADGroupFilter</filter-name>
        <filter-class>xxx.ADGroupFilter</filter-class>
        <init-param>
            <param-name>AllowedGroups</param-name>
            <param-value>G-HR=2CG-MIS</param-value>
        </init-param>
    </filter>
        <filter>
        <filter-name>SuggestionsGroupFilter</filter-name>
        <filter-class>xxx.ADGroupFilter</filter-class>
        <init-param>
            <param-name>AllowedGroups</param-name>
            <param-value>xxx=2C xxx</param-value>
        </init-param>
    </filter>
   =20
    <filter-mapping>
        <filter-name>NtlmHttpFilter</filter-name>
        <url-pattern>/suggestions/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>SuggestionsGroupFilter</filter-name>
        <url-pattern>/suggestions/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>NtlmHttpFilter</filter-name>
        <url-pattern>/xxx/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>HRADGroupFilter</filter-name>
        <url-pattern>/xxx/xxx.do</url-pattern>
    </filter-mapping>


So=2C are you saying to just remove the following from the above?:
       <filter-name>NtlmHttpFilter</filter-name>
       <filter-class>jcifs.http.NtlmHttpFilter</filter-class>

Is there anything else in there that needs to be removed?  Sorry for my lac=
k of understanding=2C but this was all developed by previous developers=2C =
who are no longer working here and have left no documentation.

Thanks

>=20
> > In my tomcat/conf/server.xml file I have:
> > =20
> > <Realm className=3D"com.viatel.tomcatrealms.ADJNDIRealm"
> > debug=3D"01" resourceName=3D"ActiveDirectory"
> > connectionURL=3D"ldap://xxx:xxx"
> > alternativeURL=3D"ldap://xxx:xxx"
> > connectionName=3D"LDAP@xxx.local" connectionPassword=3D"xxx"
> > referrals=3D"follow" userBase=3D"dc=3Dvtlwavenet=2Cdc=3Dlocal"
> > userSearch=3D"(sAMAccountName=3D{0})" userSubtree=3D"true"
> > roleBase=3D"dc=3Dxxx=2Cdc=3Dlocal" roleSearch=3D"(member=3D{0})"
> > roleName=3D"cn" roleSubtree=3D"true" />
> > =20
> > I have 2 .war files running from this tomcat - 1) intranet portal A=2C =
2) intranet helpdesk page and also another intranet portal B (both run from=
 slightly different URLs).
> > When tomcat was restarted the intranet portal A runs=2C intranet portal=
 B runs but the intranet helpdesk portal doesn't run.  For this we get the =
error message shown above.
> > =20
> > I don't know if it is the java code=2C some setting in the tomcat catal=
ina base or if it is a tomcat network issue.
> > =20
> > We are running Tomcat 5.5.29.
> > java version "1.5.0_22"
> > Java(TM) 2 Runtime Environment=2C Standard Edition (build 1.5.0_22-b03)
> > Java HotSpot(TM) Client VM (build 1.5.0_22-b03=2C mixed mode=2C sharing=
)=20
> > It is on a Windows Server 2003 R2 SP2 VM box.
> > =20
> > Any help on this is appreciated.
> > Thanks in advance
> > =20
> > Seema
> > =20
> > =20
> > =20
> >  		 	   		 =20
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe=2C e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands=2C e-mail: users-help@tomcat.apache.org
>=20
 		 	   		  =

--_05698a1d-08ab-4249-bf77-312be7d52102_--