Tomcat - Apache connector problem

[Adrian Cordoba]

Hi!
I have Tomcat (7.0.12) running behind Apache (2.2.17) server with Tomcat Connector JK 1.2.32.
I'm newbie with Apache-Tomcat connector: So, I made a very simple web application and deployed it in Tomcat webapps, with the following structure:

AppPrefix/WebContent/index.jsp (entry page)
AppPrefix/WebContent/admin/login.jsp
AppPrefix/WebContent/admin/login-error.jsp
AppPrefix/WebContent/internal/internal.jsp
AppPrefix/WebContent/articles/index.html

The "WebContent/index.jsp" page has two links: a link to "WebContent/internal/internal.jsp", and the other one to "WebContent/articles/index.html".

The "WebContent/internal/" directory is protected by the following security constraint in the web.xml file:

	<security-constraint>
		<web-resource-collection>
			<web-resource-name>Internal</web-resource-name>
			<url-pattern>/internal/*</url-pattern>
		</web-resource-collection>
		<auth-constraint>
			<role-name>internal-access</role-name>
		</auth-constraint>
	</security-constraint>

Also, I declared in the web.xml file:

	<!-- Security roles -->
	<security-role>
		<role-name>internal-access</role-name>
	</security-role>

	<!-- Form-based authentication -->
	<login-config>
		<auth-method>FORM</auth-method>
		<form-login-config>
			<form-login-page>/admin/login.jsp</form-login-page>
			<form-error-page>/admin/login-error.jsp</form-error-page>
		</form-login-config>
	</login-config>

And in the tomcat-users.xml file, I set:

	<role rolename="internal-access" />
	<user username="xx" password="yy" roles="internal-access" />

I can get the entry page with the "http://localhost/AppPrefix/index.jsp" URL through Apache server.
When I make click in the internal.jsp link, I get the login.jsp page. That's wright.
But when I submit the credentials (username: xx / password. yy), I get a blank page (with http://localhost/Andromeda/internal/j_security_check in the URL bar), instead of the internal.jsp page.

If I access to entry page with "http://localhost:8080/AppPrefix/index.jsp" URL, (skipping Apache server,) I can get the internal.jsp page when I submit the credentials.
Also, if I delete the security constraint, the web application works fine.

The relevant Apache configuration is:

httpd.conf file:

LoadModule    jk_module  modules/mod_jk.so
JkWorkersFile /opt/httpd-2.2.17/conf/workers.properties
JkShmFile     /var/log/httpd2.2.17/mod_jk.shm
JkLogFile     /var/log/httpd2.2.17/mod_jk.log
JkLogLevel    info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

<VirtualHost *:80>
  ServerAdmin [e-mail]
  ServerName ASIA
  DocumentRoot /opt/apache-tomcat-7.0.12/webapps/
  ErrorLog /var/log/httpd2.2.17/andromeda-error_log
  CustomLog /var/log/httpd2.2.17/andromeda-access_log combined
  HostnameLookups Off
  UseCanonicalName Off
  ServerSignature On
  JkMount  /Andromeda/* worker1
  <Directory "/opt/apache-tomcat-7.0.12/webapps/Andromeda">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
  </Directory>
</VirtualHost>

and workers.properties file:

workers.java_home=/usr/java/latest
ps=/

worker.list=worker1
worker.worker1.port=8009
worker.worker1.host=localhost
worker.worker1.type=ajp13

May be, I have a configuration mistake.

Thank you, in advance.

[Tim Holloway]

I'm too lazy to read the details, but did you remember to route https (port 443) to the connector as well?

[Adrian Cordoba]

Tim Holloway wrote:I'm too lazy to read the details, but did you remember to route https (port 443) to the connector as well?

Tim:
Thank you for replay. (Sorry for too much details. I don't know how to explain this problem in other way.)

I'm not using SSL protocol: There is not

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

declaration in "user-data-constraint" subelement of "security-constraint".

Thank you, again.