Re: filter-mapping
Martin Dubuc <[email protected]> Fri, 13 Feb 2009 14:53:28 -0500
| Newsgroups | gmane.comp.java.securityfilter.user |
|---|---|
| Message-ID | <[email protected]> |
--===============3729159823849440050== Content-Type: multipart/alternative; boundary=0015174c3b6acac0f80462d23052 --0015174c3b6acac0f80462d23052 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I investigated the problems I reported much deeper and, with help from the pointers you gave me, I was able to fix the issues with regards to CGI emulation and error handling. See below for more details. On Wed, Feb 11, 2009 at 3:36 PM, Christopher Schultz < chris-Nf+wZpSdgwfUvtVhod0YCwZWvwf/[email protected]> wrote: > Martin, > > On 2/11/2009 1:19 PM, Martin Dubuc wrote: > > I have experimented with security-filter the last few days and although > it > > solves some of the issues I was trying to fix for a long time, there are > > things I can't do anymore with this filter in place. > > > > One area of concern is CGI scripts. I use CGI emulation in Tomcat to run > > some legacy CGI scripts and it looks like these scripts are not > compatible > > with the security-filter. I also have some issues with some files, for > > instance the error.jsp file that should be displayed when an exception is > > thrown. Currently, when an exception occurs, the login form is presented > > instead of error.jsp (it looks like the system redirects to login.jsp > > instead of error.jsp). > > If you are getting login.jsp showing instead of error.jsp, then you > probably have your <security-constraint> elements (in > securityfilter-config.xml) set to something too restrictive. Remember if > error.jsp is protected, you'll be forced to login before you can see it ;) > I have looked into the error.jsp redirect issue and found that there were problems with my code. Nothing to worry about as far as securityfilter is concerned. > Can you explain a little more about the CGI stuff? I don't see why > securityfilter would be interfering with your CGI scripts. Can you give > me some more details? > I think I figured out what the problem is. The CGI scripts on my Web server were global to all applications. Is it possible that in that context when they are invoked, since they are not part of my application, the server thinks it needs to authenticate the user once again, which triggers the Web server to invoke the securityfilter? I solved my issue by moving the CGI scripts inside the application and now things are working as expected. > > I thought I might be able to get around these problems by specifying a > > filter mapping, but I can't get that to work. I would like to have the > > security filter applied only on files that end with the jsf extension > (for > > instance main.jsf), but I can't get this to work. If I specify a filter > > mapping /main.jsf, I can never get out of the login page (after I submit > the > > login page, the system redisplays the login page again and again). There > are > > no error logs reported in the catalina.out file. > > > > Even specifying a filter mapping of *.jsf does not work. If I specify the > > following filter: > > > > <filter-mapping> > > <filter-name>Security Filter</filter-name> > > <url-pattern>*.jsf</url-pattern> > > </filter-mapping> > > > > I get an HTTP status 404 when I try to access any page in my application. > > This looks like a legitimate filter mapping, and should only apply to > *.jsf files (see section 11 of the servlet spec for more information). > > Are saying that a filter-mapping for /main.jsf causes all pages to > redirect to the login page no matter what? That's odd, since > securityfilter should only be kicking-in for requests to /main.jsf. And, > if you use a filter-mapping of *.jsp then everything 404s? > > Hmm... if securityfilter were actually failing, I would expect a 500 > Internal Server Error, not a 404. > I am not sure why the filters didn't load properly, but in the end, I don't need to worry about this anymore. Moving the CGI scripts inside the application has cleared the redirection to login.jsp problem and I don't need special filters to bypass other filters like securityfilter. > Do you have container-managed security set up in Tomcat's server.xml as > well as securityfilter? That might be confusing things. Remember that > securityfilter-config.xml should contain all your <security-constraint> > setup, and web.xml should have none of this stuff leftover. Otherwise, > you'll have sf and Tomcat fighting each other. I am not sure if it makes any difference, but I had kept the security-role inside web.xml. I have since moved it into securityfilter-config.xml. It doesn't seem to make a difference one way or another. > Also note that you'll have to map j_security_check to securityfilter, > otherwise you'll never be able to log in ;) > > > When I run certain CGI scripts, I get this log: > > INFO: cgi: runCGI: bad header line "<html><head><meta > http-equiv="refresh" > > content="0;URL=/system/login.jsp"></head></html> > > > > It looks like when I try to run this script, the application redirects to > > login.jsp first and this confuses the CGI emulator. > > securityfilter uses 302 FOUND HTTP responses to perform redirections, > not META HTTP-EQUIV tricks. Whatever you are seeing here is coming from > somewhere else. > > > Some other CGI scripts, the application just transitions to the login > page > > and I don't see any error or info logs in catalina.out. > > > > Do you understand what might be happening and is there a solution? > > Honestly, I have no idea what's going on. Let's get some more info. Try > to keep your responses on the mailing list. > > -chris > > Thanks for your help. It was important for me to be told that securityfilter should be able to work with error handling and CGI emulation. Martin --0015174c3b6acac0f80462d23052 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable I investigated the problems I reported much deeper and, with help from the = pointers you gave me, I was able to fix the issues with regards to CGI emul= ation and error handling. See below for more details.<br><br><div class=3D"= gmail_quote"> On Wed, Feb 11, 2009 at 3:36 PM, Christopher Schultz <span dir=3D"ltr"><= <a href=3D"mailto:chris-Nf+wZpSdgwfUvtVhod0YCwZWvwf/[email protected]">[email protected]= t</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"borde= r-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-le= ft: 1ex;"> Martin,<br> <div class=3D"Ih2E3d"><br> On 2/11/2009 1:19 PM, Martin Dubuc wrote:<br> > I have experimented with security-filter the last few days and althoug= h it<br> > solves some of the issues I was trying to fix for a long time, there a= re<br> > things I can't do anymore with this filter in place.<br> ><br> > One area of concern is CGI scripts. I use CGI emulation in Tomcat to r= un<br> > some legacy CGI scripts and it looks like these scripts are not compat= ible<br> > with the security-filter. I also have some issues with some files, for= <br> > instance the error.jsp file that should be displayed when an exception= is<br> > thrown. Currently, when an exception occurs, the login form is present= ed<br> > instead of error.jsp (it looks like the system redirects to login.jsp<= br> > instead of error.jsp).<br> <br> </div>If you are getting login.jsp showing instead of error.jsp, then you<b= r> probably have your <security-constraint> elements (in<br> securityfilter-config.xml) set to something too restrictive. Remember if<br= > error.jsp is protected, you'll be forced to login before you can see it= ;)<br> </blockquote><div><br>I have looked into the error.jsp redirect issue and f= ound that there were problems with my code. Nothing to worry about as far a= s securityfilter is concerned.<br><br></div><blockquote class=3D"gmail_quot= e" style=3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt = 0.8ex; padding-left: 1ex;"> <br> Can you explain a little more about the CGI stuff? I don't see why<br> securityfilter would be interfering with your CGI scripts. Can you give<br> me some more details?<br> <div class=3D"Ih2E3d"></div></blockquote><div><br>I think I figured out wha= t the problem is. The CGI scripts on my Web server were global to all appli= cations. Is it possible that in that context when they are invoked, since t= hey are not part of my application, the server thinks it needs to authentic= ate the user once again, which triggers the Web server to invoke the securi= tyfilter? I solved my issue by moving the CGI scripts inside the applicatio= n and now things are working as expected.<br> <br></div><blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid= rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div cl= ass=3D"Ih2E3d"><br> > I thought I might be able to get around these problems by specifying a= <br> > filter mapping, but I can't get that to work. I would like to have= the<br> > security filter applied only on files that end with the jsf extension = (for<br> > instance main.jsf), but I can't get this to work. If I specify a f= ilter<br> > mapping /main.jsf, I can never get out of the login page (after I subm= it the<br> > login page, the system redisplays the login page again and again). The= re are<br> > no error logs reported in the catalina.out file.<br> ><br> </div><div><div></div><div class=3D"Wj3C7c">> Even specifying a filter m= apping of *.jsf does not work. If I specify the<br> > following filter:<br> ><br> > <filter-mapping><br> > <filter-name>Security Filter</fil= ter-name><br> > <url-pattern>*.jsf</url-pattern&g= t;<br> > </filter-mapping><br> ><br> > I get an HTTP status 404 when I try to access any page in my applicati= on.<br> <br> </div></div>This looks like a legitimate filter mapping, and should only ap= ply to<br> *.jsf files (see section 11 of the servlet spec for more information).<br> <br> Are saying that a filter-mapping for /main.jsf causes all pages to<br> redirect to the login page no matter what? That's odd, since<br> securityfilter should only be kicking-in for requests to /main.jsf. And,<br= > if you use a filter-mapping of *.jsp then everything 404s?<br> <br> Hmm... if securityfilter were actually failing, I would expect a 500<br> Internal Server Error, not a 404.<br> </blockquote><div><br>I am not sure why the filters didn't load properl= y, but in the end, I don't need to worry about this anymore. Moving the= CGI scripts inside the application has cleared the redirection to login.js= p problem and I don't need special filters to bypass other filters like= securityfilter.<br> <br></div><blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid= rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br> Do you have container-managed security set up in Tomcat's server.xml as= <br> well as securityfilter? That might be confusing things. Remember that<br> securityfilter-config.xml should contain all your <security-constraint&g= t;<br> setup, and web.xml should have none of this stuff leftover. Otherwise,<br> you'll have sf and Tomcat fighting each other. </blockquote><div><= br>I am not sure if it makes any difference, but I had kept the security-ro= le inside web.xml. I have since moved it into securityfilter-config.xml. It= doesn't seem to make a difference one way or another.<br> <br></div><blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid= rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br> Also note that you'll have to map j_security_check to securityfilter,<b= r> otherwise you'll never be able to log in ;)<br> <div class=3D"Ih2E3d"><br> > When I run certain CGI scripts, I get this log:<br> > INFO: cgi: runCGI: bad header line "<html><head><m= eta http-equiv=3D"refresh"<br> > content=3D"0;URL=3D/system/login.jsp"></head></h= tml><br> ><br> > It looks like when I try to run this script, the application redirects= to<br> > login.jsp first and this confuses the CGI emulator.<br> <br> </div>securityfilter uses 302 FOUND HTTP responses to perform redirections,= <br> not META HTTP-EQUIV tricks. Whatever you are seeing here is coming from<br> somewhere else.<br> <div class=3D"Ih2E3d"><br> > Some other CGI scripts, the application just transitions to the login = page<br> > and I don't see any error or info logs in catalina.out.<br> ><br> > Do you understand what might be happening and is there a solution?<br> <br> </div>Honestly, I have no idea what's going on. Let's get some more= info. Try<br> to keep your responses on the mailing list.<br> <br> -chris<br> <br> </blockquote></div><br>Thanks for your help. It was important for me to be = told that securityfilter should be able to work with error handling and CGI= emulation.<br><br>Martin<br><br> --0015174c3b6acac0f80462d23052-- --===============3729159823849440050== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H --===============3729159823849440050== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ securityfilter-user mailing list securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/securityfilter-user --===============3729159823849440050==--