Develop Reference

issues of mod_cluster & apache & tomcat7 integration

I downloaded mod_cluster native bundles with httpd from http://mod-cluster.jboss.org/mod_cluster/downloads/1-2-6-Final-bin like below. So I did not need to do any configuration for httpd since this tar file contain httpd and related mod_cluster modules.
mod_cluster-1.2.6.Final-linux2-x64.tar.gz
Then I downloaded tomcat7 and do the following two things.
1 . add <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" proxyList="192.168.91.128:80" advertise="true"/> to tomcat7/conf/server.xml
2.download mod_cluster-parent-1.2.6.Final-bin.tar.gz from jboss site and extract the jars to tomcat7/lib directory.
I referred all above steps from http://docs.jboss.org/mod_cluster/1.2.0/html/Quick_Start_Guide.html#d0e250.
But after I started up httpd, tomcat7, I found there are error messages in catalina.out generated again and again like below.
ERROR: MODCLUSTER000042: Error null sending INFO command to 192.168.91.128/192.168.91.128:80, configuration will be reset: nul
I pasted the critical configuration from httpd.conf.
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
<IfModule manager_module>
Listen 192.168.91.128:6666
ManagerBalancerName mycluster
<VirtualHost 192.168.91.128:6666>
<Location />
Order deny,allow
Deny from all
Allow from 192.168.91
</Location>
KeepAliveTimeout 300
MaxKeepAliveRequests 0
AdvertiseFrequency 5
#AdvertiseSecurityKey secret
#AdvertiseGroup #ADVIP#:23364
EnableMCPMReceive
<Location /mod_cluster_manager>
SetHandler mod_cluster-manager
Order deny,allow
Deny from all
Allow from 192.168.91
</Location>
</VirtualHost>
</IfModule>
ServerName localhost

Error
Communication between Apache HTTP Server and Tomcat is bidirectional, i.e. Tomcat's mod_cluster library needs to talk to a VirtualHost configured in your Apache HTTP Server -- the exactly one VirtualHost where you have EnableMCPMReceive set. In this case, please, follow Federico's advice and change the proxyList to match your EnableMCPMReceiveVirtualHost IP and port.
Advertising
Furthermore, is it intentional that you use both advertising (Apache HTTP Server using UDP multicast to advertise its presence to Tomcats) and you have proxyList set at the same time? You can get about without one or the other, depending on your desired setup and environment.
Do not use mod_cluster 1.2.6, please
mod_clister 1.2.6 is desperately obsolete; it contains not only severe performance issue but also CVE and several noteworthy bugs. Please, upgrade to mod_cluster 1.3.1.
See http://modcluster.io for 1.3.1.Final release bits or alternatively http://mod-cluster.jboss.org.
Regarding Apache HTTP Server 2.2.x vs 2.4.x
The aforementioned mod_cluster 1.3.1.Final is offered with httpd 2.4.x. Do you have any special desire for older httpd 2.2.x? It is possible to compile mod_cluster 1.3.1 with httpd 2.2.x, it's just not what we do regularly as noted in my comment on the subject.
Happy mod_clustering!
K.

Kerberos how to get principal or client name?

I have a user configured in AD with delegated kerberos ticket:
klist
Ticket cache: FILE:/tmp/krb5cc_527
Default principal: user1#EXAMPLE
Valid starting Expires Service principal 11/27/15 16:28:27 11/28/15 02:28:27 krbtgt/EXAMPLE.com#EXAMPLE.COM
How can I get this 'user1'? On this client domain account (client side jsp? Or server side?) I want to extract this value after button click and pass it back (with backurl) to another java app.
EDIT:
My Apache configuration:
<Location /kerb >
AuthType Kerberos
AuthName "auth-realm"
KrbMethodNegotiate off
KrbMethodK5Passwd off
KrbServiceName HTTP
Krb5Keytab /etc/krb5.keytab
require valid-user
</Location>
ProxyPreserveHost On
ProxyPass /kerb ajp://120.201.131.169:8019/myApp
ProxyPassReverse /kerb ajp://120.201.131.169:8019/myApp
But I received
[Sun Dec 13 18:17:32 2015] [debug] src/mod_auth_kerb.c(1944): [client
126.185.3.202] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos

It depends. In my case I have an Apache server configured with mod_kerb and forwarding http requests to Tomcat by means of AJP.
In such scenario, Tomcat AJP conector is configured with tomcatAuthentication=false and I can get user authenticated from JSP and Servlet using request.getRemoteUser().
Obviously, the user string comes with domain info after # so you have to consider it.
If you are interested in my solution, I can elaborate my answer.
Edit
I edit my answer to give more info about configuring Tomcat to use Kerberos.
Configure NTP
First, it is quite common to have NTP clients configured in every system AD server, Apache server and Tomcat server. If there is no date and time synchronization, it is quite common to get clock skew too great or postdating problems.
Create an AD principal for the server
You need to create a principal into AD to use for server principal authentication. It is necessary to get a keytab file for this principal. I am sorry, I can't tell you how to do this.
Install and configure Kerberos on Apache server
Once you have your server principal and keytab file, it is time to configure Apache server. Install kerberos into that system and configure /etc/krb5.conf. A sample of this file is:
HERE.YOUR.KERB.DOMAIN = {
kdc = your.dns.kerb.domain
admin_server = your.dns.kerb.domain
}
Check with:
kinit -k -t keytab.file HTTP/principal.dns.name#HERE.YOUR.KERB.DOMAIN
klist
that your server is right configured.
Install and configure mod_auth_kerb
Install mod_auth_kerb apache module and configure its use in every location, directory, virtual host or whatever you need, see below. This configuration is very dependent on your kerberos server, you will have to play with some parameters as KDC verification, negotiation, be or not authoritative, ...
The most important parameter is Krb5Keytab, but you can check this page to understand all parameters. Here you are with a sample location:
<Location /sample/>
AuthType Kerberos
AuthName "auth-realm"
KrbMethodNegotiate on
KrbMethodK5Passwd off
Krb5Keytab /your/path/to/keytab.file
require valid-user
</Location>
When you try to access this location http://your.apache.server/sample Apache will try to check user credentials by means of kerberos.
AJP Configuration
For AJP configuration (I already answer this before, but I cut and paste here and adapt for this question) the procedure is the following:
Install Apache module for AJP, usually it is called something like libapache2-mod-jk. (In debian/ubuntu you can run sudo apt-get install libapache2-mod-jk).
Then you will have a new module calledjk or similar. You have to enable it (In debian/ubuntu you can run sudo a2enmod jk).
Default configuration will serve mostly, open it a see where does JkWorkersFile point. This file is needed to configure the workers that manage communication with tomcat apps.
Create workers file (if it does not exists). A workers file is more or less as following.
Sample workers file:
ps=/
worker.list=worker1,worker2,...
# worker1 definition
worker.worker1.port=8009
worker.worker1.host=host or ip
worker.worker1.type=ajp13
# worker2 definition
....
Every worker can point to different tomcat server. Port must be the same that configured into $CATALINA_HOME/conf/server.xml. In this file there is a connector for AJP protocol:
<Connector port="8009" protocol="AJP/1.3"
redirectPort="8443" tomcatAuthentication="false"/>
Every worker has to point to this port.
Finally, you can configure your location (or whatever) using JkMount workerName to indicate Apache that this url has to be forwarded to the proper worker:
<Location /sample/>
JkMount worker1
AuthType Kerberos
AuthName "auth-realm"
KrbMethodNegotiate on
KrbMethodK5Passwd off
Krb5Keytab /your/path/to/keytab.file
require valid-user
</Location>
There are plenty of samples an documentation. Here you are with Tomcat official docs: https://tomcat.apache.org/connectors-doc/webserver_howto/apache.html
Web app authentication
You don't need to configure anything about security constraint in web.xml, with this configuration, Apache will authenticate users instead Tomcat, and Tomcat will receive user's principal name into HTTP request.
Tomcat (and any other servlet container) will encapsulate the user's principal into request.getRemoteUser().
Hope it helps.

I got it! I don't know what exactly was wrong but now It works.
I can simple get principal from HTTP Header with the following configuration (I moved this configuration from /conf.d to main /conf/httpd.conf file). What is imported. On RHEL httpd server apache user should have rights to read /etc/krb5.keytab. In my case:
ps -ef | grep httpd
apache 27537 27535 0 16:18 ? 00:00:00 /usr/sbin/httpd
<VirtualHost myhost.domain.com:80>
ServerName myhost.domain.com
<Location /myApp >
# SSLRequireSSL
AuthType Kerberos
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbServiceName HTTP/nmyhost.domain.com#EXAMPLE.COM
KrbAuthRealms EXAMPLE.COM
Krb5KeyTab /etc/krb5.keytab
require valid-user
RewriteEngine On
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule . - [E=RU:%1]
Header add X-Remote-User "%{RU}e" env=RU
</Location>
ProxyRequests Off
ProxyPreserveHost On
ProxyPass /myApp ajp://126.101.100.169:8029/myApp
ProxyPassReverse /myApp ajp://126.101.100.169:8029/myApp
</VirtualHost>

Try checking your keytab file. I had similar issue and when i ran
cat httpd.keytab
it showed plain text, which isnt normal, keytab file should contain ASCII chars, its a binary file. Had to regenerate it with Domain Admin account "$user.name" and then it worked.

How to get VHost Server Name with Java?

Hello Stackoverflow Community,
i'm getting a bit confused with getting the Servername of a Vhost. Im working with my apache and a Tomcat. The Apache is redirecting the Requests to my Tomcat to start a Function.
The Point is that i have to identify the Servername. The purpose is to get the Servername and decide like if the servername is like office23.de then the server has to load the configuration for office23 if other office then load other configurations. I hope i could explain it a bit.
What i did so far:
i added into Tomcat's server.xml :
also added in Apache's httpd.conf:
ProxyRequests on
ProxyPass /getTest/ http://localhost:8080/Test/
ProxyPassReverse /getTest/ http://localhost:8080/test/
and the lines to load the mod_proxy stuff.
additional i configured the httpd-vhosts.conf like this:
ServerName js.local.test.de
DocumentRoot "D:/downloads/xampp/tomcat/webapps"
<Directory />
Require all granted
Options Indexes FollowSymLinks Includes ExecCGI
AllowOverride All
Order allow,deny
Allow from all
</Directory>
ErrorLog "D:/downloads/xampp/apache/logs/virtualHost.log"
CustomLog "D:/downloads/xampp/apache/logs/customLog.log" common
i can reach my application through the vhost adress but when i try to get the Host Header it says that its localhost:8080.
I also changed the windows hostfile.
Does any opurtunity excist that allows me to get the vhost name?

If you enable ProxyPreserveHost on the reverse proxy, the Host: header is kept in the request to the proxy, instead of being replaced with the hostname specified in the ProxyPass (localhost, in your case). That should help you get the right name on the back-end.
Mangling the hosts file won't do you any good, and if you forget you did that, it'll probably come back to haunt you, later on.

Sub-domains for Jetty apps with Apache mod_proxy without context name

This question has been asked before, and, in resume I want configure this scenario:
1 - I have one Jetty 7 server with many applications, e.g: app1, app2, app3, etc.
2 - I have one main domain, and, one sub-domain per Jetty application, e.g:
app1.example.com, app2.example.com, app3.example.com, etc..
3 - I'm try using Apache 2.2.22 mod_proxy to mask these Jetty applications across domains managed by Apache. This is my functional configuration for one application:
<VirtualHost *:80>
ServerName example.com
ServerAlias app1.example.com
ProxyRequests Off
ProxyPreserveHost On
<Proxy *:80>
Order deny,allow
Allow from all
</Proxy>
ProxyPass /app1 http://localhost:8080/app1
</VirtualHost>
This configuration works, but, it doesn't remove the context name, the URI is:
http://app1.example.com/app1/?args=or/pages/etc...
Have an way to remove this context name, leaving a full transparent URIs ? e.g:
http://app1.example.com/?args=or/pages/etc..
All examples on the web uses this context name on URIS :/
Additional information:
VM with Ubuntu 12.04;
Jetty 7 without modifications;
Apache 2.2.22 with mod_proxy and mod_rewrite enabled (and some basics mods enabled by default);
Correct and valid CNAME and domain name within VM manager at Digital Ocean;
Thanks in advance.

I've found a solution:
1 - Install this specific lib for apache2 mod-proxy-html:
sudo apt-get install libapache2-lib-proxy-html
2 - Enable this new module:
sudo a2enmod proxy_html
3 - Config your application descriptor at:
sudo vim /etc/apache2/sites-enabled/app1
with this content:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
ServerName app1.example.com
ProxyRequests Off
ProxyPreserveHost On
<Proxy *:80>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/app1
ProxyPassReverse / http://localhost:8080/app1
ProxyHTMLURLMap / /app1/
<Location />
Order allow,deny
Allow from all
</Location>
</VirtualHost>
4 - Restart apache2 service:
sudo service apache2 restart
Be happy, transparent requests across:
http://app1.example.com/some/beautiful/page

Sending redirect in Tomcat web application behind a Apache 2 proxy (mod_proxy)

I have a web application on tomcat http://localhost:8080/WebApp/
The I have configrued Apache 2 (mod_proy) so that the web application is directly accessible by localhost with out port and name: e.g http://localhost
<VirtualHost localhost:80>
ProxyPreserveHost On
ProxyPass / http://localhost:8080/WebApp/
ProxyPassReverse / http://localhost:8080/WebApp/
</VirtualHost>
The index.html is shown correctly on http://localhost.
But if a servlet redirects:
#WebServlet(description = "...", urlPatterns = { "/login" })
public class LoginServlet extends HttpServlet
{
#Override
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws IOException
{
response.sendRedirect("a.html");
}
}
and I use the URL http://localhost/login - I am redirected to http://localhost/WebApp/a.html
How do I get the correct redirect to http://localhost/a.html?

Thanks to Stuart and his link to this blog I found a solution:
Reverse Proxying Tomcat Web Applications Behind Apache
Solution: ProxyPreserveHost must be turned off!
Reason: If it is switched on, the response headers returned by the proxy backend will contain “localhost” or the real domain without the port number (or 80). So the ProxyPassReverse pattern does not match (because of the different port and if another domain name is used, also the domain name will not match).
Config:
<VirtualHost localhost:80>
ProxyPreserveHost Off
ProxyPass / http://localhost:8080/WebApp/
ProxyPassReverse / http://localhost:8080/WebApp/
</VirtualHost>
But this works only via http, not via ajp (I don’t know why).
If you still want to use ajp you could use the following workaround - Let Apache do another redirect after the wrong redirect:
<VirtualHost localhost:80>
ProxyPass /WebApp !
ProxyPass / ajp://localhost:8009/WebApp/
ProxyPassReverse / ajp://localhost:8009/WebApp/
RedirectMatch 301 ^/WebApp/(.*)$ /$1
RedirectMatch 301 ^/WebApp$ /
</VirtualHost>
The ProxyPass /WebApp ! directive is needed to exclude the path from further processing in mod_proxy (because proxy directives are evaluated before redirect directives)
Then the RedirectMatch directives redirect everything stating with /WebApp/... respectively /WebApp to the URL without /WebApp at the beginning.
The only drawback is that you must not have any sub folder named WebApp in your web application

I also had this problem and spent some time on it. I believe that if you change your apache httpd configuration to the following your redirect will work:
<VirtualHost localhost:80>
ProxyPreserveHost On
ProxyPass / http://localhost:8080/WebApp/
ProxyPassReverse / http://localhost/WebApp/
ProxyPassReverseCookiePath /WebApp /
</VirtualHost>
This is because the tomcat response headers will contain the proxy headers (i.e. the Location header is http://localhost/WebApp rather than http://localhost:8080/WebApp) because ProxyPreserveHost is switched On.
As a footnote: This also works with you want to change your webapps context. Say you wanted to change the publicly visible context to context you can use the following:
<VirtualHost localhost:80>
ProxyPreserveHost On
ProxyPass /context/ http://localhost:8080/WebApp/
ProxyPassReverse /context/ http://localhost/WebApp/
ProxyPassReverseCookiePath /WebApp /context
</VirtualHost>
For reference, I found this blog post extremely helpful: Reverse Proxying Tomcat Web Applications Behind Apache

you have use to AJP Connector to connect apache2 & tomcat , it will be the perfect solutions for this.
if you need how to configure this, tell me i will explain this detail

Use forwarding instead of redirection
I think your problem is the use of sendRedirect. Calling sendRedirect is actually suppose to show the browser that the URL has been redirected. If you want to hide that you need to use forwarding.In your servlet try this instead of sendRedirect.
String servletPath = request.getServletPath();
if(servletPath.equals("/app1")){
ServletContext ctx = request.getServletContext().getContext("/app1");
RequestDispatcher dispatcher=ctx.getServletContext().getRequestDispatcher( "/app1/app1.html" ); // or wherever you actually keep app1.html
dispatcher.forward( request, response );
}
Inside your context.xml set crossContext = "true" so you can forward requests to other web applications.
<Context crossContext="true" ....../>

I had the same problem while tried to redirect the apache2(running on port 80) request to tomcat(application server running on port 8080).
This is the configuration which is working perfectly.
Go to /etc/apache2/sites-available/000-default.conf and add the following config:
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
# for redirecting the websocket requests
ProxyPass /ws ws://localhost:7681/
#ProxyPass /ws ws://localhost:7681/
ProxyPassReverse /ws ws://localhost:7681/
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
# for redirecting the http request
ProxyPass /applicationContextUrl ' http://localhost:8080/applicationContextUrl
ProxyPassReverse /applicationContextUrl http://localhost:8080/applicationContextUrl
ProxyPassReverseCookiePath /applicationContextUrl /
ProxyPassReverseCookieDomain localhost applicationContextUrl
ProxyRequests off
ProxyTimeout 15
ErrorLog ${APACHE_LOG_DIR}/nirad_error.log
LogLevel debug
CustomLog ${APACHE_LOG_DIR}/nirad_access.log combined
<Proxy *>
AddDefaultCharset off
Order deny,allow
Allow from all
#Require all denied
Require all granted
Require local
</Proxy>
</VirtualHost>
Done.
Now goto terminal and hit the following command.
sudo a2enmod proxy_http (for http redirection).
sudo a2enmod proxy_wstunnel (for websocket redirection)
and sudo service apache2 restart
run your application server on port 8080