Secure Jini and Tomcat

Hi



I have a system which is running on jini2_1 and blitz. I also have a tomcat
server acting as a web services bridge to act as a jini client. We are now
looking to implement jini security.



After much work, all of the jini services and clients are running - with the
exception of Tomcat. When ever I try to use one of the published classes
through the tomcat server I get an exception. The web application that deals
with soap calls is axis 1.1 and the tomcat version is 5.028.

Here is the exception I get:



INFO: Exception occurred while attempting to register with the lookup
service event mechanism

java.rmi.ConnectIOException: I/O exception connecting to
BasicObjectEndpoint[af795904-cfe7-4a3f-89d2-3b5dd160ed5a,SslEndpoint[test.XX
X.net:8090]]; nested exception is:

      net.jini.io.UnsupportedConstraintException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target

      at
net.jini.jeri.BasicInvocationHandler.wrapSafeIOException(BasicInvocationHand
ler.java:893)

      at
net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(BasicInvocationH
andler.java:711)

      at
net.jini.jeri.BasicInvocationHandler.invokeRemoteMethod(BasicInvocationHandl
er.java:659)

      at
net.jini.jeri.BasicInvocationHandler.invoke(BasicInvocationHandler.java:528)

      at com.sun.jini.reggie.$Proxy0.notify(Unknown Source)

      at com.sun.jini.reggie.RegistrarProxy.notify(RegistrarProxy.java:139)

      at
net.jini.lookup.ServiceDiscoveryManager.registerListener(ServiceDiscoveryMan
ager.java:3633)

      at
net.jini.lookup.ServiceDiscoveryManager.access$700(ServiceDiscoveryManager.j
ava:605)

      at
net.jini.lookup.ServiceDiscoveryManager$LookupCacheImpl$RegisterListenerTask
.run(ServiceDiscoveryManager.java:888)

      at
com.sun.jini.thread.TaskManager$TaskThread.run(TaskManager.java:331)

Caused by: net.jini.io.UnsupportedConstraintException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target

      at
net.jini.jeri.ssl.SslConnection.establishCallContext(SslConnection.java:195)

      at net.jini.jeri.ssl.SslEndpointImpl.connect(SslEndpointImpl.java:847)

      at
net.jini.jeri.connection.ConnectionManager.connect(ConnectionManager.java:22
8)

      at
net.jini.jeri.connection.ConnectionManager$ReqIterator.next(ConnectionManage
r.java:629)

      at
net.jini.jeri.BasicObjectEndpoint$1.next(BasicObjectEndpoint.java:371)

      at
net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(BasicInvocationH
andler.java:708)

      ... 8 more

Caused by: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target

      at
com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)

      at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1518)

      at
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)

      at
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)

      at
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandsh
aker.java:848)

      at
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshake
r.java:106)

      at
com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)

      at
com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)

      at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:818
)

      at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocket
Impl.java:1030)

      at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java
:1057)

      at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java
:1041)

      at
net.jini.jeri.ssl.SslConnection.establishSuites(SslConnection.java:251)

      at
net.jini.jeri.ssl.SslConnection.establishNewSocket(SslConnection.java:240)

      at
net.jini.jeri.ssl.SslConnection.establishCallContext(SslConnection.java:155)

      ... 13 more

Caused by: sun.security.validator.ValidatorException: PKIX path building
failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
to find valid certification path to requested target

      at
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:221)

      at
sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:145)

      at sun.security.validator.Validator.validate(Validator.java:203)

      at
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509Tru
stManagerImpl.java:172)

      at
net.jini.jeri.ssl.FilterX509TrustManager.checkServerTrusted(FilterX509TrustM
anager.java:99)

      at
net.jini.jeri.ssl.ClientAuthManager.checkServerTrusted(ClientAuthManager.jav
a:265)

      at
com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLCont
extImpl.java:320)

      at
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandsh
aker.java:841)

      ... 23 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

      at
sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBui
lder.java:236)

      at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:194)

      at
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:216)

      ... 30 more



The server with tomcat on has the required certificates and the tomcat has
had its server.xml file edited to point to the certificates and when tomcat
is run with the -Djavax.net.debug=ssl option it shows that the certificates
are picked up. Also I know the certificates are correct as running same
method called in the web call as a stand alone program (on the same machine
as tomcat is running) works fine.

Just wondered if anyone had any ideas why trying to run something from a web
call results in a security exception but running it independently on the
same machine works?



Any idea would be appreciated.

Thanks.



--

Jeff Hyatt-Steel
CDO2

Albert Buildings

49 Queen Victoria Street

London

EC4N 4SA
Tel: +44 (0)845 456 4460
Fax: +44 (0)845 456 4461
 <http://www.cdo2.com> www.cdo2.com







--

Jeff Hyatt-Steel
CDO2

Albert Buildings

49 Queen Victoria Street

London

EC4N 4SA
Tel: +44 (0)845 456 4460
Fax: +44 (0)845 456 4461
 <http://www.cdo2.com> www.cdo2.com




===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html