I have the following problem. In one server, I have a folder /protected/ that requires authentication using a SAML token.
When I try to access resources in this folder, I get redirected to a log-in page first, and after login I can access the resource.
Now, I added a .jnlp file inside the /protected/ folder with all resources required. When I try to access the .jnlp file, I get the login page as expected. After logging in Java Web Start initializes and tries to download the resources.
However, Smart Start fails immediately, complaining that it couldn't parse the .jnlp file. When I look into the debug console, I see that Java downloaded, instead of the jnlp file, the log-in page. So it seems that the Java Web Start application does not share the credentials of the browser, so it requires a new log-in
My identity provider is ZXID, and we are using SAML. I would assume that Java Web Start must somehow use the same SAML token as the browser, right? Is this correct? is it possible?
So far in my investigations, it seems that when the browser finds a .jnlp file, it starts Java immediately and the Java Application will try to download the jnlp, creating this issue. I did find out that the JNLP file must not contain the codebase entry. Otherwise the Java VM will try to re-download the file, but because it is not authenticated it will get the login page.
However, if the JNLP can be read, the resources can not be in the protected area either, because again JWS is not authenticated.
So I guess what is needed is that the JWS VM somehow gets the session id from the browser, so it is considered Authenticated.
Any ideas?
So far, I haven't found a proper solution to this problem. I did the following, and it worked:
Created a protected area on my server, and added a servlet behind it
My servlet creates a JNLP file on the fly, with a session id.
JNLP file is used to download the JARs from a public location
The session id is used by the web start application to load resources from the protected area.
Related
I'm fairly new to using Tomcat so I'm sure I'm missing something.
I have managed to run Tomcat on Ubuntu 18.04 and opened up the manager page, added a .war file which extracted perfectly and got displayed in the manager page(running=true)
However when I try to open up the app from the browser using the exact path it returns a 403 forbidden error with this in the description The server understood the request but refuses to authorize it.
What do I do to get it working
I have tried chown tomcat8:tomcat8 <foldername> and when I tried to refresh the browser the error message changed to 404 not found.
This is likely not a filesystem issue. What is most likely happening is the application requires authentication. Couple of ways to determine this... the best is to read the documentation. You can also look at the source code. Unzip the war and look in the WEB-INF directory, and you should see a web.xml. In that you'll see a security-constraint and roles sections. You'll need a user with those roles.
Tomcat can authenticate against a local database. In the conf directory, there will be a tomcat-users.xml you can add users to (there is examples in that file). Once you've created users, restart tomcat and try logging in with one of those users.
I'm developing local-only JSP application using Apache Tomcat server. I would like to put a promotion videos on my intro page, but I don't want to move them to webapp folder or anywhere else.
The promotion videos are located:
E:\data\videos\2018...
But writing a JSP/HTML like this wont launch the video, but however it works off-server (launching html from desktop for example, so the path may not be issue?)
<video src="file:///E:/data/videos/2018/promotion1.mp4" controls></video>
Local file links from remote resources are disabled by almost all browsers by default. There are certain possibilities to overcome that, e.g.:
http://kb.mozillazine.org/Links_to_local_pages_do_not_work
https://discourse.mozilla.org/t/opening-links-to-local-files-file/16449/2
To access your static media files from remote page you need to configure your Tomcat server as described here: http://teknosrc.com/access-local-files-static-content-images-videos-media-files-outside-web-application-system-apache-tomcat-server/
solution:
a.) make sure your server is on the same system where the media files are.
b.) If so, you have to create a folder (ex. media) in your application folder inside /src/main/webapp/ and have to put all media files inside a media folder. After that, you can surely access the media files through a server.
I have deployed a war file inside a folder in the Tomcat webapps folder and the manager page is password protected. But I also want to password protect my application other than the Login system which it has of its own. I tried doing what is mentioned here.
But There has been no luck, when I do what it is mentioned there even the tomcat page i.e, localhost:8080 is also not accessible as it gives a not found error whereas I am able to access localhost:8080/manager/html page with the credentials and when I click on the Application I want to access it still doesn't ask for credentials but directly opens the web application.
I'm working on the applet that reads data files from one specific folder (lets call it 'Data folder'). Number of files and their names can change over time so I don't want to add them rigidly into the code. I would like to be able to list all the files stored in that folder (note: folder is stored on the same server as applet). I tried to do that using Files.walkFileTree method. It worked just fine when I ran it in the Eclipse but I got AccessControlException:
java.security.AccessControlException: access denied ("java.io.FilePermission" "Data folder" "read")
when I tried to run in the browser.
I can see why would jvm want to restrict applets from listing files on local computer but is it possible to list files stored on the server?
You have to distinguish between client side and server side code. Your applet is executed at client side, so it is unable to access the server's file system directly with Files.walkFileTree().
What you can do is to implement a service (like a REST service or a simple servlet) and run it on server side in a Tomcat or Jetty servlet container and then call this service from your applet. But be careful to make your service secure, so that it is not allowed for erveryone to see your server's whole file system.
i am having trouble with my web application developed in GWT. the application allows users to upload and download using an upload servlet and a download servlet, the upload servlet was created using the gwtUpload library. the download servlet is using regular HTTPServlet.
when i run the application within eclipse the download servlet works fine, when i deploy it to tomcat, when a user selects to upload a file, the file does not download, when a user selects a link to download a file, this error is returned
type Status report
message /testhibernategilead/downloadServlet
description The requested resource (/testhibernategilead/downloadServlet) is not available.
can anyone explain why this is
The requested resource (/testhibernategilead/downloadServlet) is not available.
This is the same as a 404 Page Not Found. In other words, the URL is wrong, or the requested resource is indeed actually not there where you expect it to be.
If you are certain that the URL is correct, then you need to read the server logs if the server and the servlets started without problems. If a servlet fails during startup, then it will be unavailable that way.
I think this is due to the application's root directory misconfiguration in tomcat.
You can try adding the module base to your URL like this:
String servlet_url = GWT.getModuleBaseURL()+"testhibernategilead/downloadServlet";
Remember: GWT.getModuleBaseURL() puts a "/" at the end of the returned string.