Re: Security Filter and Tomcat 7

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============2928511796328822214==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="------------enig7D8C7A0F20AF32C6A085E839"

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig7D8C7A0F20AF32C6A085E839
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Matt,

On 9/1/2011 7:17 PM, Matthew Hixson wrote:
> I am trying to get our webapp working with Tomcat 7 and am finding
> that Security Filter is failing because it is compiled against an
> older servlet spec.

The servlet spec is backward-compatible, so that's not the issue.

> Has Security Filter been obsoleted by Tomcat's
> <security-constraint> support?

<security-constraint> has been a part of the spec (it's not
Tomcat-specific) since the beginning. No spec changes have altered the
capabilities of securityfilter.

> Sep 01 15:58:25 INFO thr:14 u:- c:org.apache.jsp.e_jsp m:_jspService --=
- IN E.JSP ---
> java.lang.NoSuchMethodError:
org.apache.catalina.Realm.hasRole(Ljava/security/Principal;Ljava/lang/Str=
ing;)Z
> 	at org.securityfilter.realm.catalina.CatalinaRealmAdapter.isUserInRole=
(CatalinaRealmAdapter.java:108)

Tomcat's internal classes have changed. The CatalinaRealmAdapter was
built originally for a Tomcat 4/5 integration and, unfortunately, over
time it has diverged more and more from what sf expects and can use.

One solution is to provide "adapter" classes for all versions of Tomcat
(and WebLogic, and Jetty, and...). Another solution is to implement your
own Realm yourself. That's what I have done: I have a DataSourceRealm
built using some of Tomcat's code as a basis, but doesn't reference any
of Tomcat's classes, etc. This code runs happily on versions of Tomcat
going from 4.3 through the latest 7.0 (I know because I've been using sf
in this way through all those versions... actually skipped 5.0 to don't
take my word for it).

I've been asked for my DataSourceRealm implementation a few times, so
maybe it's time to put it into CVS. You can download it here at the
bottom of the page:
http://www.christopherschultz.net/projects/java/

-chris


--------------enig7D8C7A0F20AF32C6A085E839
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6EzTAACgkQ9CaO5/Lv0PDBIwCdFwgZKq4il1Djwc7INfNiH56o
2twAnAinrM+Q3wLKqko2S2QKNmu717js
=twqE
-----END PGP SIGNATURE-----

--------------enig7D8C7A0F20AF32C6A085E839--


--===============2928511796328822214==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
--===============2928511796328822214==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
securityfilter-user mailing list
securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/securityfilter-user

--===============2928511796328822214==--