Re: Secure Jini and Tomcat

Jeff Hyatt-Steel wrote:
> Hi
>
> Thanks everyone for their ideas, at this time I'd like to get tomcat working
> if possible as there is a lot of other stuff which is already working which
> I'd rather not change, the same for running it in Bantam, although if I
> really can't get things working I may go back to these options.
>
>
>
> In Answer to Mark Brouwers questions, (in reverse order as the first one is
> the longest):

>>Something else you might try is to set a breakpoint at line 141 of
>>net.jini.jeri.ssl.FilterX509TrustManager (JTSK 2.1) and inspect the
>>trustmanager factory with a debugger to see which keystore it uses for
>>trust related questions.
>
> I tried this but couldn't seem to find the trustmanager factory and the
> trustmanager variable was null.
...
>>Did you try running Tomcat with logging set to FINER/FINEST for the
>>logger net.jini.jeri.ssl.client and what was the outcome of that.
>
> I hadn't originally but I have now and haven't found anything, however the
> section where it breaks is here and the equivalent section from it working
> outside of tomcat is below it.

> throws
> net.jini.io.UnsupportedConstraintException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
...
>
> For comparison here is the output of the stand alone version:
>
> with active []
> and idle []
> returns null
> May 15, 2007 4:16:40 PM net.jini.jeri.ssl.Utilities getClientSSLContextInfo
> FINEST: get client SSL context for CallContext[
>   SslEndpoint[test.XXX.net:8090]
>   clientSubject=Subject@4963f7a1
>   clientAuthRequired=false
>   clientPrincipals=[CN=test-web]
>   serverPrincipals=null
>   cipherSuites=[SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
> TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
> TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
> SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
> SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
> SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
> SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
> SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5,
> SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5,
> TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,
> SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,
> SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA]
>   integrity=required
> ]
> returns new javax.net.ssl.SSLContext@4d8ce14a
> May 15, 2007 4:16:40 PM net.jini.jeri.ssl.FilterX509TrustManager
> checkServerTrusted
> FINE: check server trusted succeeds for auth type DHE_DSS

I don't know much about how this should look, but it occurs to me that you
probably don't have the jsk-resources.jar in your class path so that the SPI
information can be found for the constraints validation.

Gregg Wonderly

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html