Httpd – proxy_ajp wildcards

ajpapache-2.2httpdmod-proxy-ajp

I need to setup apache so that any site.com/ANYTHING/servlet/ANYTHING goes over ajp into tomcat, but regular files will go through apache still.

I have been messing around with this to no avail

<LocationMatch "./*/servlet/*">
Order Allow,Deny
Allow from all
ProxyPass ajp://localhost:8009/
ProxyPassReverse /
</LocationMatch>

This works at directing everything to our tomcat insance.

ProxyPass      /       ajp://localhost:8009/

Edit: I can verify the regex is correct but its still not sending it to proxy ajp. I also just reverified that ProxyPass / ajp://localhost:8009/ still works so I know ajp is good and I know the regex is good, but why is it still not working :\

RewriteRule ^(.*)/servlet/(.*)$ ajp://localhost:8009/$1 [P]

Best Answer

I tend to use mod_rewrite for things like this, which allows you to apply a regular expression to the incoming URI. For example:

RewriteRule ^/((kaptcha|barcode)/view/(.*))$ ajp://0.0.0.0:9019/media-webapp/$1 [P]

This proxies /kaptcha/view/nnnn to ajp://0.0.0.0:9019/media-webapp/kaptcha/view/nnnn. The [P] at the end is a flag to indicate that the request is to be proxied, not redirected.

Related Solutions

Tomcat cookies not working via the ProxyPass VirtualHost

I figured it out.

Add this to the VHost configuration:

ProxyPassReverseCookiePath /webapp /

Tomcat – How to restrict acess to a context on reverse proxied tomcat context

There are two different mechanisms in play here: restricting access to a context (which is done using the RemoteAddrValve) and the built-in RBAC in server.xml:

<Resource name="UserDatabase" auth="Container"
          type="org.apache.catalina.UserDatabase"
          description="User database that can be updated and saved"
          factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
          pathname="conf/tomcat-users.xml" />

The following has been tested using tomcat-8.0.23:

A stock configuration only modified to restrict access from localhost to the manager context by modifying the apache-tomcat-8.0.23/webapps/manager/META-INF/context.xml file to remove the comments on the valve:

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
      allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />

Without further modifications, an attempt to access the context fails with a 401 HTTP error:

$ curl -v -L localhost:8080/manager/
*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
> GET /manager/ HTTP/1.1
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=F3F2A25463ED1CD49E154FA5428B853A; Path=/manager/; HttpOnly
< Location: http://localhost:8080/manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 0
< Date: Sun, 14 Jun 2015 08:47:27 GMT
<
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:8080/manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550'
* Found bundle for host localhost: 0x256e460
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (::1) port 8080 (#0)
> GET /manager/html;jsessionid=F3F2A25463ED1CD49E154FA5428B853A?org.apache.catalina.filters.CSRF_NONCE=B5CB272DF379F59A8158583826850550 HTTP/1.1
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Server: Apache-Coyote/1.1
< Cache-Control: private
< Expires: Thu, 01 Jan 1970 01:00:00 GMT
< WWW-Authenticate: Basic realm="Tomcat Manager Application"
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 2474
< Date: Sun, 14 Jun 2015 08:47:27 GMT

After modifying the apache-tomcat-8.0.23/conf/tomcat-users.xml file to add the following:

<role rolename="manager-gui"/>
<user username="tomcat" password="tomcat" roles="manager-gui"/>

and attempt to access the context, this time using authentication, succeeds:

$ curl -v -L -utomcat:tomcat localhost:8080/manager/
*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/ HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=7890CA71EC221A152BDB4F04B66BE49E; Path=/manager/; HttpOnly
< Location: http://localhost:8080/manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 0
< Date: Sun, 14 Jun 2015 08:48:09 GMT
<
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:8080/manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84'
* Found bundle for host localhost: 0x69e4c0
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (::1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/html;jsessionid=7890CA71EC221A152BDB4F04B66BE49E?org.apache.catalina.filters.CSRF_NONCE=92DAD506CB8E9E24E8454BBA94567F84 HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< Cache-Control: private
< Expires: Thu, 01 Jan 1970 01:00:00 GMT
< Set-Cookie: JSESSIONID=42B0B26688726A802B665B0B33D1690B; Path=/manager/; HttpOnly
< Content-Type: text/html;charset=utf-8
< Transfer-Encoding: chunked
< Date: Sun, 14 Jun 2015 08:48:09 GMT

Now, if you try to use a different interface to perform the request (i.e. not localhost), you will hit a 403 HTTP error, regardless you use authentication or not:

$ curl --interface wlp6s0 -v -L -utomcat:tomcat localhost:8080/manager/
*   Trying ::1...
*   Trying 127.0.0.1...
* Local Interface wlp6s0 is ip 192.168.1.187 using address family 2
* SO_BINDTODEVICE wlp6s0 failed with errno 1: Operation not permitted; will do regular bind
* Local port: 0
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'tomcat'
> GET /manager/ HTTP/1.1
> Authorization: Basic dG9tY2F0OnRvbWNhdA==
> User-Agent: curl/7.40.0
> Host: localhost:8080
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=2F3ADE627300D4D264478927D1F0BBFC; Path=/manager/; HttpOnly
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 3196
< Date: Sun, 14 Jun 2015 09:06:52 GMT
<

This is as expected, as we are restricting access from localhost only.

In short, if you get a 403 error response, check the interface tomcat is listening to:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

$ ss -tulpan | grep LISTEN.*8080

and the interface you are using for the request.

  tcp    LISTEN     0      100                   :::8080                 :::*      users:(("java",pid=32490,fd=48))

Best Answer

Related Solutions

Tomcat cookies not working via the ProxyPass VirtualHost

Tomcat – How to restrict acess to a context on reverse proxied tomcat context

Related Topic