Fwd: Secure Jini and Tomcat

---------- Forwarded message ----------
From: Tom Cellucci <[email protected]>
Date: May 14, 2007 4:29 PM
Subject: Re: Secure Jini and Tomcat
To: Jeff Hyatt-Steel <[email protected]>

Hi Jeff,

I'm not sure if you could consider a change like this, but you could
probably solve your Tomcat problem by hosting your Jini services in a
 Bantam container.  Bantam wraps your Jini service implementations in a WAR
that you can deploy into Tomcat or other servlet engine, and it provides a
JERI implementation that uses the web server's HTTP sockets for
communication.  With Tomcat configured for HTTPS over port 443, for
instance, your Jini services would transparently send all JERI messages
SSL-encrypted through the Tomcat-provided socket.

Bantam is relatively new and has some other features that might not be
helpful in your situation where the services are already written and
configured.  In particular it requires a Spring Framework-based
configuration format that is different than the stock FileProvider
configuration that comes with the JSK.  Still, if you're required to deploy
to Tomcat, Bantam might suit your purpose.
You can check it out at http://bantam.dev.java.net.

-Tom


On 5/14/07, Jeff Hyatt-Steel <[email protected]> wrote:
>
>  Hi
>
>
>
> I have a system which is running on jini2_1 and blitz. I also have a
> tomcat server acting as a web services bridge to act as a jini client. We
> are now looking to implement jini security.
>
>
>
> After much work, all of the jini services and clients are running – with
> the exception of Tomcat. When ever I try to use one of the published classes
> through the tomcat server I get an exception. The web application that deals
> with soap calls is axis 1.1 and the tomcat version is 5.028.
>
> Here is the exception I get:
>
>
>
> INFO: Exception occurred while attempting to register with the lookup
> service event mechanism
>
> java.rmi.ConnectIOException: I/O exception connecting to
> BasicObjectEndpoint[af795904-cfe7-4a3f-89d2-3b5dd160ed5a,SslEndpoint[test.XXX.net:8090<http://test.xxx.net:8090/>]];
> nested exception is:
>
>       net.jini.io.UnsupportedConstraintException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException : unable to
> find valid certification path to requested target
>
>       at net.jini.jeri.BasicInvocationHandler.wrapSafeIOException(
> BasicInvocationHandler.java:893)
>
>       at net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(
> BasicInvocationHandler.java:711)
>
>       at net.jini.jeri.BasicInvocationHandler.invokeRemoteMethod(
> BasicInvocationHandler.java:659)
>
>       at net.jini.jeri.BasicInvocationHandler.invoke(
> BasicInvocationHandler.java:528)
>
>       at com.sun.jini.reggie.$Proxy0.notify(Unknown Source)
>
>       at com.sun.jini.reggie.RegistrarProxy.notify(RegistrarProxy.java
> :139)
>
>       at net.jini.lookup.ServiceDiscoveryManager.registerListener(
> ServiceDiscoveryManager.java:3633)
>
>       at net.jini.lookup.ServiceDiscoveryManager.access$700(
> ServiceDiscoveryManager.java:605)
>
>       at
> net.jini.lookup.ServiceDiscoveryManager$LookupCacheImpl$RegisterListenerTask.run
> (ServiceDiscoveryManager.java:888)
>
>       at com.sun.jini.thread.TaskManager$TaskThread.run(TaskManager.java
> :331)
>
> Caused by: net.jini.io.UnsupportedConstraintException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException : unable to
> find valid certification path to requested target
>
>       at net.jini.jeri.ssl.SslConnection.establishCallContext(
> SslConnection.java:195)
>
>       at net.jini.jeri.ssl.SslEndpointImpl.connect(SslEndpointImpl.java
> :847)
>
>       at net.jini.jeri.connection.ConnectionManager.connect(
> ConnectionManager.java:228)
>
>       at net.jini.jeri.connection.ConnectionManager$ReqIterator.next(
> ConnectionManager.java:629)
>
>       at net.jini.jeri.BasicObjectEndpoint$1.next(BasicObjectEndpoint.java
> :371)
>
>       at net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(
> BasicInvocationHandler.java:708)
>
>       ... 8 more
>
> Caused by: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException : unable to
> find valid certification path to requested target
>
>       at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java
> :150)
>
>       at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(
> SSLSocketImpl.java:1518)
>
>       at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java
> :174)
>
>       at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java
> :168)
>
>       at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(
> ClientHandshaker.java:848)
>
>       at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(
> ClientHandshaker.java:106)
>
>       at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(
> Handshaker.java:495)
>
>       at com.sun.net.ssl.internal.ssl.Handshaker.process_record(
> Handshaker.java:433)
>
>       at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(
> SSLSocketImpl.java:818)
>
>       at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(
> SSLSocketImpl.java:1030)
>
>       at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(
> SSLSocketImpl.java:1057)
>
>       at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(
> SSLSocketImpl.java:1041)
>
>       at net.jini.jeri.ssl.SslConnection.establishSuites(
> SslConnection.java:251)
>
>       at net.jini.jeri.ssl.SslConnection.establishNewSocket(
> SslConnection.java:240)
>
>       at net.jini.jeri.ssl.SslConnection.establishCallContext(
> SslConnection.java:155)
>
>       ... 13 more
>
> Caused by: sun.security.validator.ValidatorException: PKIX path building
> failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find valid certification path to requested target
>
>       at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java
> :221)
>
>       at sun.security.validator.PKIXValidator.engineValidate(
> PKIXValidator.java:145)
>
>       at sun.security.validator.Validator.validate(Validator.java:203)
>
>       at
> com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(
> X509TrustManagerImpl.java:172)
>
>       at net.jini.jeri.ssl.FilterX509TrustManager.checkServerTrusted(
> FilterX509TrustManager.java:99)
>
>       at net.jini.jeri.ssl.ClientAuthManager.checkServerTrusted(
> ClientAuthManager.java:265)
>
>       at
> com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(
> SSLContextImpl.java:320)
>
>       at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(
> ClientHandshaker.java:841)
>
>       ... 23 more
>
> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
> unable to find valid certification path to requested target
>
>       at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(
> SunCertPathBuilder.java:236)
>
>       at java.security.cert.CertPathBuilder.build(CertPathBuilder.java
> :194)
>
>       at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java
> :216)
>
>       ... 30 more
>
>
>
> The server with tomcat on has the required certificates and the tomcat has
> had its server.xml file edited to point to the certificates and when
> tomcat is run with the –Djavax.net.debug=ssl option it shows that the
> certificates are picked up. Also I know the certificates are correct as
> running same method called in the web call as a stand alone program (on the
> same machine as tomcat is running) works fine.
>
> Just wondered if anyone had any ideas why trying to run something from a
> web call results in a security exception but running it independently on the
> same machine works?
>
>
>
> Any idea would be appreciated.
>
> Thanks.
>
>
>
> --
>
> Jeff Hyatt-Steel
> CDO2
>
> Albert Buildings
>
> 49 Queen Victoria Street
>
> London
>
> EC4N 4SA
> Tel: +44 (0)845 456 4460
> Fax: +44 (0)845 456 4461
> www.cdo2.com
>
>
>
>
>
>
>
> --
>
> Jeff Hyatt-Steel
> CDO2
>
> Albert Buildings
>
> 49 Queen Victoria Street
>
> London
>
> EC4N 4SA
> Tel: +44 (0)845 456 4460
> Fax: +44 (0)845 456 4461
> www.cdo2.com
>
>
> ===========================================================================
> To unsubscribe, send email to [email protected] and include in the
> body of the message "signoff JAVASPACES-USERS". For general help, send email
> to [email protected] and include in the body of the message "help".
>
> To view past JAVASPACES-USERS postings, please see: http://archives.java.sun.com/archives/javaspaces-users.html
>
>