Re: Secure Jini and Tomcat

Jeff i had the same hassle dude.

i think its somthing to do with 'classloaders' after hitting my head
againt a wall i steped back and desided to change from tomcat to
glassfish and if like magic it all works fine. so if u can change
application servers, try that mate (nicer app server tbh u'll never look
back).

ant

Jeff Hyatt-Steel wrote:
>
> Hi
>
>
>
> I have a system which is running on jini2_1 and blitz. I also have a
> tomcat server acting as a web services bridge to act as a jini client.
> We are now looking to implement jini security.
>
>
>
> After much work, all of the jini services and clients are running --
> with the exception of Tomcat. When ever I try to use one of the
> published classes through the tomcat server I get an exception. The
> web application that deals with soap calls is axis 1.1 and the tomcat
> version is 5.028.
>
> Here is the exception I get:
>
>
>
> INFO: Exception occurred while attempting to register with the lookup
> service event mechanism
>
> java.rmi.ConnectIOException: I/O exception connecting to
> BasicObjectEndpoint[af795904-cfe7-4a3f-89d2-3b5dd160ed5a,SslEndpoint[test.XXX.net:8090]];
> nested exception is:
>
>       net.jini.io.UnsupportedConstraintException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find valid certification path to requested target
>
>       at
> net.jini.jeri.BasicInvocationHandler.wrapSafeIOException(BasicInvocationHandler.java:893)
>
>       at
> net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(BasicInvocationHandler.java:711)
>
>       at
> net.jini.jeri.BasicInvocationHandler.invokeRemoteMethod(BasicInvocationHandler.java:659)
>
>       at
> net.jini.jeri.BasicInvocationHandler.invoke(BasicInvocationHandler.java:528)
>
>       at com.sun.jini.reggie.$Proxy0.notify(Unknown Source)
>
>       at
> com.sun.jini.reggie.RegistrarProxy.notify(RegistrarProxy.java:139)
>
>       at
> net.jini.lookup.ServiceDiscoveryManager.registerListener(ServiceDiscoveryManager.java:3633)
>
>       at
> net.jini.lookup.ServiceDiscoveryManager.access$700(ServiceDiscoveryManager.java:605)
>
>       at
> net.jini.lookup.ServiceDiscoveryManager$LookupCacheImpl$RegisterListenerTask.run(ServiceDiscoveryManager.java:888)
>
>       at
> com.sun.jini.thread.TaskManager$TaskThread.run(TaskManager.java:331)
>
> Caused by: net.jini.io.UnsupportedConstraintException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find valid certification path to requested target
>
>       at
> net.jini.jeri.ssl.SslConnection.establishCallContext(SslConnection.java:195)
>
>       at
> net.jini.jeri.ssl.SslEndpointImpl.connect(SslEndpointImpl.java:847)
>
>       at
> net.jini.jeri.connection.ConnectionManager.connect(ConnectionManager.java:228)
>
>       at
> net.jini.jeri.connection.ConnectionManager$ReqIterator.next(ConnectionManager.java:629)
>
>       at
> net.jini.jeri.BasicObjectEndpoint$1.next(BasicObjectEndpoint.java:371)
>
>       at
> net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(BasicInvocationHandler.java:708)
>
>       ... 8 more
>
> Caused by: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find valid certification path to requested target
>
>       at
> com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1518)
>
>       at
> com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
>
>       at
> com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
>
>       at
> com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:848)
>
>       at
> com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)
>
>       at
> com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)
>
>       at
> com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:818)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1030)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1057)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1041)
>
>       at
> net.jini.jeri.ssl.SslConnection.establishSuites(SslConnection.java:251)
>
>       at
> net.jini.jeri.ssl.SslConnection.establishNewSocket(SslConnection.java:240)
>
>       at
> net.jini.jeri.ssl.SslConnection.establishCallContext(SslConnection.java:155)
>
>       ... 13 more
>
> Caused by: sun.security.validator.ValidatorException: PKIX path
> building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find valid certification path to requested target
>
>       at
> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:221)
>
>       at
> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:145)
>
>       at sun.security.validator.Validator.validate(Validator.java:203)
>
>       at
> com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:172)
>
>       at
> net.jini.jeri.ssl.FilterX509TrustManager.checkServerTrusted(FilterX509TrustManager.java:99)
>
>       at
> net.jini.jeri.ssl.ClientAuthManager.checkServerTrusted(ClientAuthManager.java:265)
>
>       at
> com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLContextImpl.java:320)
>
>       at
> com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:841)
>
>       ... 23 more
>
> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
> unable to find valid certification path to requested target
>
>       at
> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:236)
>
>       at
> java.security.cert.CertPathBuilder.build(CertPathBuilder.java:194)
>
>       at
> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:216)
>
>       ... 30 more
>
>
>
> The server with tomcat on has the required certificates and the tomcat
> has had its server.xml file edited to point to the certificates and
> when tomcat is run with the --Djavax.net.debug=ssl option it shows
> that the certificates are picked up. Also I know the certificates are
> correct as running same method called in the web call as a stand alone
> program (on the same machine as tomcat is running) works fine.
>
> Just wondered if anyone had any ideas why trying to run something from
> a web call results in a security exception but running it
> independently on the same machine works?
>
>
>
> Any idea would be appreciated.
>
> Thanks.
>
>
>
> --
>
> Jeff Hyatt-Steel
> CDO^2
>
> Albert Buildings
>
> 49 Queen Victoria Street
>
> London
>
> EC4N 4SA
> Tel: +44 (0)845 456 4460
> Fax: +44 (0)845 456 4461
> www.cdo2.com <http://www.cdo2.com>
>
>
>
>
>
>
>
> --
>
> Jeff Hyatt-Steel
> CDO^2
>
> Albert Buildings
>
> 49 Queen Victoria Street
>
> London
>
> EC4N 4SA
> Tel: +44 (0)845 456 4460
> Fax: +44 (0)845 456 4461
> www.cdo2.com <http://www.cdo2.com>
>
>
>
> ===========================================================================
> To unsubscribe, send email to [email protected] and include in the
> body of the message "signoff JAVASPACES-USERS". For general help, send
> email to [email protected] and include in the body of the message
> "help".
>
> To view past JAVASPACES-USERS postings, please see:
> http://archives.java.sun.com/archives/javaspaces-users.html
>


===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html