Develop Reference

Share a cookie across subdomains in springboot

I have a web application which is hosted at https://example.com. I would like to share a session cookie between the main domain https://example.com and sub-domain https://www.example.com. Thus, there should be no need for a user to re-login if they switch from one domain to another. How do I achieve this in springboot 2.2.6?
This is what I have tried:
I went to application.properties and set server.servlet.session.cookie.domain=.example.com
Now, this does not help. I get an error:
java.lang.IllegalArgumentException: An invalid domain [.example.com] was specified for this cookie
at org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateDomain(Rfc6265CookieProcessor.java:210) ~[tomcat-embed-core-9.0.33.jar:9.0.33]
at org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:145) ~[tomcat-embed-core-9.0.33.jar:9.0.33]
at org.apache.catalina.connector.Response.generateCookieString(Response.java:973) ~[tomcat-embed-core-9.0.33.jar:9.0.33]
If I set server.servlet.session.cookie.domain=example.com, then the cookie is not visible for http://www.example.com and if I set server.servlet.session.cookie.domain=www.example.com, then the cookie is not visible for http://example.com
I have read discussions about Rfc6265CookieProcessor and LegacyCookieProcessor, but I don't know the right way to fix this issue.
Springboot 2.2.6 uses tomcat version 9.0.*
So, how do I fix this issue?
EDIT:
I was trying the above changes on localhost only and not on production. Instead of accessing http://www.example.com, I was doing https://www.localhost and instead of accessing http://example.com, I was doing http://localhost

The right value is:
server.servlet.session.cookie.domain=example.com
What I was trying was that I was making changes on localhost and they were not working for me. I was modifying the values in chrome console manually and expecting to see cookies set on https://localhost with domain localhost to be visible in another tab for domain https://www.localhost and that was not happening.
I read the answer here: Share cookie between subdomain and domain and #Cesc 's comment on that answer which was :
I am not sure where to put this so I am choosing the comments of the
accepted answer. It took long time and failed experiments to prove the
above on my localhost, until it occurred to me that I should call the
localhost with a dot in the name. Like "localhost.com" or something
like that. Then all the "set cookies" behaviours started following the
explanations written here in this answer. Hoping this might help
somebody.
So, I tried my changes on production directly and they worked fine. I am still not able to get it to work on localhost. The way I access my website on localhost is:
https://localhost and https://www.localhost. Based on #Cesc 's comment, I probably need to access the website on localhost as https://www.localhost.com or https://localhost.com and then it will work. But, I have not tried that.

Rather than testing with 'localhost' on your dev machine, try using your machine's fully-qualified host name. I've had a similar challenge with testing authentication against our single-signon platform.

Connect Metabase to Sql Server

I installed Java on my Windows 10 machine and downloaded Metabase.jar, and ran it.
Now I could access metabase at localhost:3000
But I'm unable to setup my SQL Server Database as Data reference.
I'm either getting:
Couldn't connect to the database. Please check the connection details.
or
Timed out after 5000 milliseconds.
Anyone who has done Metabase - SQL Server connection successfully?

Currently, as of Metabase version 0.30.x the answer depends on if you can use a user configured directly on SQL Server or not:
The easier option to setup is with a user configured directly on SQL Server. Then config is just Name: (anything), Host: (full name), Database Name, Username, Password as you would expect. (I believe you should NOT fill in the Windows domain).
On Windows only you can also use native integrated authentication with sqljdbc_auth.dll, just specify integratedSecurity=true connection property (and optionally authenticationScheme=NativeAuthentication). I found if I dropped the x64 sqljdbc_auth.dll in my <java path>\jre\bin folder it was picked up. Metabase config as in the screenshot below, apart from dropping authenticationScheme=JavaKerberos
The cross platform authenticationScheme=JavaKerberos option to use Windows Authentication with a domain user is still doable, but harder. It's these steps:
Create a krb.conf and verify login works with <Java path>\bin\kinit.exe [user]. Here's a template edited to match the Metabase database setup in the screenshot below.
Start the Metabase.jar file with parameters to load the krb.conf. It works for me with java -Djava.security.krb5.conf=c:/<path>/kerberos/krb.conf -jar metabase.jar.
Now configure the database settings in Metabase according to the screenshot below
Moment of truth! ...
Optional: Still not working? Maybe your SQL Server isn't configured for Kerberos? Maybe you need SPN setup? Maybe you need to specify a java.security.auth.login.config (I have not experienced any of that myself, only thing I can offer is you scroll to the bottom of this post and dive in then edit your question with where you got to and what config you have)
Metabase SQL Server setup using Kerberos:
For background, current (August 2018) very long :| sum up with lots of links of how to connect to SQL Server is here in a Metabase discussion topic Note: In v0.30.0 an issue with dynamic port handling (particularly for people using named instances) was fixed.
Related: A neat StackOverflow answer on Kerberos on a Mac

If you are connecting to a "Named Instance" ({SERVER_NAME}/{INSTANCE_NAME}) instead of "Default Instance" ({SERVER_NAME}), your server may be configured to use Dynamic Port.
A quick dirty fix is you can find the current port with below scripts and then use it on Metabase connection parameters. But this port most probably will change when service restart occurs.
SELECT DISTINCT
local_tcp_port
FROM sys.dm_exec_connections
WHERE local_tcp_port IS NOT NULL
or
USE master
GO
Xp_readerrorlog
(look for "Server is listening on ..." line)
A Cleaner way is setting port for your instance by "SQL Server Configuration Manager" - "SQL Server Network Configuration" - "TCP/IP" - Right Click properties - "TCP Dynamic Ports" (There should be 0 and it should be deleted) and "TCP Port" (New default port should be set here). And also "SQL Server Browser" service should run. A more detailed explanation is here

Derby authentication error from Glassfish console but same credentials work from ij

I am trying, for the first time, to run a java EE 7 web app without an IDE and struggling through the learning curve. To keep things simple I have started with Glassfish 4.1 and Derby 10.11.1.2 which is what I used for development.
My current problem is an error configuring the connection pool on the Glassfish web interface. The error is 'Connection authentication failure occurred. Reason: Userid or password invalid'. However I have ij runing in a dos prompt and the Glashfish web console in Chrome.
from ij I can type 'connect 'jdbc:derby:localhost:1527/databasename;user=username;password=password'; and I connect fine and can look at tables, etc. In the Glassfish web console I have name/value pairs with the same 'user' and 'password' values and it fails (exact same letters & case). I've tried changing the 'databaseName' property to make sure the error wasn't misleading and confirmed it has found the database correctly.
At face value, the error message seems wrong as I have proven from the DOS window. I am sure I am doing something wrong but am lost at how to diagnose it. Any suggestions?
More details of the steps taken: (Although I am sure some of these steps superceed others my lack of success has me in the mindset that redundancy is better than omission - all-in-all it seems much more complicated than it needs to be for a basic setup). My target is Wildfly but Glassfish documentation is better so I figured I would start there.
relevant Windows environment variables:
JAVA_HOME=C:\Program Files\Java\jdk1.8.0_40
DERBY_HOME=%JAVA_HOME%\db
DERBY_INSTALL=%DERBY_HOME%
JAVADB_HOME=%DERBY_HOME%
GLASSFISH=C:\Program Files\Java\GlassFish-4.1
Path=%JAVA_HOME%\bin;%DERBY_HOME%\bin;%GLASSFISH%\bin;%GLASSFISH%\glassfish
CLASSPATH=%DERBY_HOME%\lib\derbynet.jar;%DERBY_HOME%\lib\derbytools.jar;%DERBY_HOME%\derbyclient.jar;%DERBY_HOME%\lib\derbyrun.jar
WILDFLY_HOME=C:\program files\java\wildfly\8.2.0.Final
sysinfo shows all the right paths and versions
Copied many of the derby jars from %derby_home%\lib to %glassfish%\glassfish\domains\domain1\lib\ext per a post by BalusC. I think classpath duplicates this it but can't hurt
Started Domain 'asadmin start-domain' defaulting to domain 1
Started DB by changing directories and using java. Wanted to use 'asadmin start-database --dbhome DB path' but this always started the wrong version. Glassfish and JDK both package derby/javadb and I couldn't figure out how to upgrade Glassfish or start the correct version any other way
cd \users\john\.netbeans-derby (root of the DB created by Netbeans)
Java –jar “%derby_home%\lib\derbyrun.jar" server start
connect browser to 'localhost:4848' to create JDBC connection pool and resource
connection pool: pool name=connectionPool, resource type=javax.sql.DataSource, DB driver Vendor=Derby, introspect was not enabled (found very little documentation to explain what it is) - step 2 was left as defaults
editing connectionPool - enabled Ping on General tab to identify errors, Additional Properties tab: changed User to DB username, left other attributes as default, added... password=db password, databaseName=ClubScoring
errors were presented along the way which prompted setting each attribute. No error was presented for lack of URL but tested steps below with and without URL=jdbc:derby://localhost:1527/ClubScoring
jdbc resources. Added jdbc/ClubScoring, pool=connectionPool => selected and enabled
starting db from correct directory using 'asadmin start-database' does let the application find the correct DB but it crashes since the DB was created with version 10.11.1.2 and this command starts the Glassfish version of 10.10.2.0
Sorry for making this so long but I haven't found anywhere that lays out all of the steps in a simple fashion and figured the details would save time in the long run.

I was dealing with this issue today and found a solution:
https://db.apache.org/derby/docs/10.14/ref/rrefattribsecmech.html
Basically the only security options allowable (as far as 10.14 is concerned) is 3, 4 and 9.
4 is the default and means "Just UserID". You would think this means that as long as a UserID is given, you could connect. But having both set appears to be an issue.
In order to use a (clear text) password and userID, you have to specify 3. It works also if the attribute is deleted or 0 as well but I don't think you get any security that way.

Selenium RC failing to retrieve or timing out on page load.

I exported a working Selenium test case to Java, running it via selenium-rc's selenium-server.jar in Junit4 on Eclipse.
The test case breaks the next step after opening the page, trying to write to an element. When stepping through the runtime I noticed the error,
The requested URL could not be retrieved
The following error was encountered:
Unable to determine IP address from host name for unknown server name
This means that: The cache was not able to resolve the hostname presented in the URL. Check if the address is correct.
So, I changed the url to the corresponding IP address of the web page, but now I am timing out.
Opening the page using both the url and IP formats manually is working, (except IP doesn't for IE8). I'm originally targeting Firefox, but will expand to other browsers once I have solved this issue.
Is there a security issue involved with Selenium opening a page in a browser via RC programatically that browsers don't like? What sort of issues should I be investigating to solve this?

I think you are trying to open a secure page.In selenium pages which has ssl certificates should be handled.

The problem actually came down to the proxy set up on my machine. After removing it things worked fine.

How can I make "jconsole" work with Websphere 6.1?

I've deployed some Managed Beans on WebSphere 6.1 and I've managed to invoke them through a standalone client, but when I try to use the application "jconsole" distributed with the standard JDK can can't make it works.
Has anyone achieved to connect the jconsole with WAS 6.1?
IBM WebSphere 6.1 it's supossed to support JSR 160 JavaTM Management Extensions (JMX) Remote API. Furthermore, it uses the MX4J implementation (http://mx4j.sourceforge.net). But I can't make it works with neither "jconsole" nor "MC4J".
I have the Classpath and the JAVA_HOME correctly setted, so the issue it's not there.

WebSphere's support for JMX is crap. Particularly, if you need to connect to any secured JMX beans. Here's an interesting tidbit, their own implementation of jConsole will not connect to their own JVM. I have had a PMR open with IBM for over a year to fix this issue, and have gotten nothing but the runaround. They clearly don't want to fix this issue.
The only way I have been able to invoke remote secured JMX beans hosted on WebSphere has been to implement a client using the "WebSphere application client". This is basically a stripped down app server used for stuff like this.
Open a PMR with IBM. Perhaps if more people report this issue, they will actually fix it.
Update: You can run your application as a WebSphere Application Client in RAD. Open the run menu, then choose "Run...". In the dialog that opens, towards the bottom on the left hand side, you will see "WebSphere v6.1 Application Client". I'm not sure how to start and Application Client outside of RAD.

IT WORKS !
http://issues.apache.org/jira/browse/GERONIMO-4534;jsessionid=FB20DD5973F01DD2D470FB9A1B45D209?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel
1) Change the config.xml and start the server.
-see here how to change config.xml: http://publib.boulder.ibm.com/wasce/V2.1.0/en/working-with-jconsole.html
2) start the jconsole with : jconsole -J-Djavax.net.ssl.keyStore=%GERONIMO_HOME%\var\security\keystores\geronimo-default -J-Djavax.net.ssl.keyStorePassword=secret -J-Djavax.net.ssl.trustStore=%GERONIMO_HOME%\var\security\keystores\geronimo-default -J-Djavax.net.ssl.trustStorePassword=secret -J-Djava.class.path=%JAVA_HOME%\lib\jconsole.jar;%JAVA_HOME%\lib\tools.jar;%GERONIMO_HOME%\repository\org\apache\geronimo\framework\geronimo-kernel\2.1.4\geronimo-kernel-2.1.4.jar
[or your version of geronimo-kernel jar]
3) in the jconsole interface->advanced, input:
JMX URL: service:jmx:rmi:///jndi/rmi://localhost:1099/JMXSecureConnector
user name: system
password: manager
4) click the connect button.

If you want the WebSphere MBeans this one works for me:
The key is to configure the classpath and the security properly.
in one line:
jconsole -J-Dwas.install.root=C:/was61 -J-Djava.ext.dirs=C:/was61/plugins;C:/was61/plugins/com.ibm.ws.security.crypto_6.1.0;C:/was61/lib;C:/was61/java/jre/lib/ext -J-Dcom.ibm.SSL.ConfigURL="file:../../properties/ssl.client.props" -J-Dcom.ibm.CORBA.ConfigURL="file:../../properties/sas.client.props" service:jmx:iiop://host:port/jndi/JMXConnector
where port = bootstrap port ex: (2809)
Be careful when setting the sas and the ssl props.
Robert

I have successfully connected to ActiveMQ and ServiceMix using the JConsole. Does WAS 6.1 use Java Management Extension (JMX) technology? JMX is required for JConsole.
If your path is set correctly it should work fine. On windows you go to System Properties -> Advanced Tab -> Environment Variables. Have your JAVA_HOME System variable set to the path of your JDK or JRE and your Path variable with %JAVA_HOME%/bin added somewhere in there. Then all you need to do is go to Start->Run->JConsole. Select the correct Process Name and your done.
Where are you having problems at? I hope this helps.
Edit:
Here is the Java Doc's on JConsole.

Hmm... I know that WebSphere is kind of hard to configure. Thats part of the reason we used ServiceMix for our ESB. Maybe its not enabled by default in WebSphere and you would have to turn it on in the config somewhere.

Websphere 6.1 does not support the JConsole for some reason even though it fully implements the JMS specs. Seems to be a week area at the moment. Your best bet is to look at the Admin client to implement you own console.

You all seem to be incorrect. I am running Websphere 6.1.041 , using JDK 1.5 , and I just started up Jconsole and used the "simple connect" tab to connect to localhost with port=0 and without a username and password and it works fine.