SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized #2635

JustSong · 2019-01-22T06:51:15Z

Tomcat: apache-tomcat-8.5.37.tar.gz
Opengrok: opengrok-1.1.2.tar.gz

Hi Sir,

There is an error message need your help.

We will face this error after we process index command.

14:21:47 SEVERE: Couldn't notify the webapp on https://opengrok.system.com/source.
javax.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized
        at org.glassfish.jersey.client.JerseyInvocation.convertToException(JerseyInvocation.java:1080)
        at org.glassfish.jersey.client.JerseyInvocation.translate(JerseyInvocation.java:883)
        at org.glassfish.jersey.client.JerseyInvocation.lambda$invoke$1(JerseyInvocation.java:767)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:316)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:298)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:229)
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:414)
        at org.glassfish.jersey.client.JerseyInvocation.invoke(JerseyInvocation.java:765)
        at org.glassfish.jersey.client.JerseyInvocation$Builder.method(JerseyInvocation.java:428)
        at org.glassfish.jersey.client.JerseyInvocation$Builder.get(JerseyInvocation.java:324)
        at org.opengrok.indexer.index.IndexerUtil.enableProjects(IndexerUtil.java:60)
        at org.opengrok.indexer.index.Indexer.main(Indexer.java:308)

Couldn't notify the webapp on https://opengrok.system.com/source: HTTP 401 Unauthorized.

I have set tomcat connect with LDAP Auth. Maybe this error was cause by this setting ?!

Thanks

The text was updated successfully, but these errors were encountered:

vladak · 2019-01-22T09:00:52Z

More details are needed about the setup to tell for sure however in order to perform admin actions on the webapp via RESTful API it is necessary to send the request through trusted channel such as via localhost and plain HTTP. In OpenGrok there is no concept of special authorization to perform admin actions yet.

For example, let's say https://opengrok.system.com/source is the user facing site that requires authentication and authorization while the Tomcat also listens on say port 8080 on localhost only. Then the indexer has to be run with -U http://localhost:8080/source.

vladak · 2019-01-22T09:04:20Z

There is LocalhostFilter class that should enforce certain RESTful API requests to come from localhost only however I fail to see how exactly it comes into action.

JustSong · 2019-01-23T07:16:32Z

Tomcat: apache-tomcat-8.5.37.tar.gz
Opengrok: opengrok-1.1.2.tar.gz
Specail Work: Connect with LDAP auth

Hi @vladak ,

Thanks a lot for your help! I have changed https://opengrok.system.com/source to http://localhost:8080/source, but there is another error shown.

15:04:29 SEVERE: Couldn't notify the webapp on http://localhost:8080/source.
javax.ws.rs.ProcessingException: java.net.ConnectException: Connection refused (Connection refused)
        at org.glassfish.jersey.client.internal.HttpUrlConnector.apply(HttpUrlConnector.java:284)
        at org.glassfish.jersey.client.ClientRuntime.invoke(ClientRuntime.java:278)
        at org.glassfish.jersey.client.JerseyInvocation.lambda$invoke$1(JerseyInvocation.java:767)
.....

Is this issue cause by this server.xml setting ?

<Connector port="80" protocol="HTTP/1.1"
		   redirectPort="443"/>

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
		   maxThreads="150" scheme="https" secure="true"
		   clientAuth="false" sslProtocol="TLS"
		   sslEnabledProtocols="TLSv1.2"
		   connectionTimeout="20000"
		   keystoreFile="/var/lib/tomcat8/conf/opengrok.system.com.pfx"
		   keystoreType="PKCS12"
		   keystorePass="HU2Ue2Lq^zk^F6g*P"
		   compression="on"
		   compressableMimeType="text/html,text/xml,text/plain,text/css..."
		   />

tulinkry · 2019-01-23T07:28:51Z

':8080' this is expecting the oopengrok on port 8080, but if I understand it, you have it running on 80. so http://localhost/source might be the way

JustSong · 2019-01-23T07:38:40Z

Hi @tulinkry ,

Yes , I have already tested with the following setting but not work for me...

-U http://localhost:80/source
javax.ws.rs.RedirectionException: HTTP 302 Found
-U http://localhost:443/source
javax.ws.rs.BadRequestException: HTTP 400 Bad Request
-U https://localhost:443/source
javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.

vladak · 2019-01-23T09:31:57Z

ad 1) there seems to be redirect in place
ad 2) it seems that there is only HTTPS (TLS based HTTP) being served on port 443 so plain HTTP requests cannot go through
ad 3) the X.509 certificate presented by the server does not have localhost in the list of hostnames, therefore the client failed to verify the certificate and terminated the connection

Really, you need to setup a plain HTTP port in Tomcat configuration.

vladak · 2019-01-23T09:37:11Z

Obviously, we need to document this better in the wikis.

tulinkry · 2019-01-23T09:52:17Z

And can't we follow redirects for

-U http://localhost:80/source
javax.ws.rs.RedirectionException: HTTP 302 Found

?

I don't know if it would help.

vladak · 2019-01-23T09:56:13Z

It's a question where does the redirect lead to. My guess that it leads to a point which requires authorization and it would be back to square 1 :-)

tulinkry · 2019-01-23T09:59:07Z

I think it leads to

<Connector port="80" protocol="HTTP/1.1" redirectPort="443"/>

but that wouldn't solve anything when the certificate is incorrect.

vladak · 2019-01-23T10:06:27Z

Technically, the certificate is correct. No certificate should ever contain localhost or localhost addresses (https://security.stackexchange.com/questions/35033/what-are-the-risks-of-a-localhost-signed-cerificate#35035)

vladak · 2019-01-23T12:06:59Z

Make a dedicated port to listen for plain HTTP requests bound to localhost (https://serverfault.com/questions/218666/how-to-configure-tomcat-to-only-listen-to-127-0-0-1) and update the -U option used by the indexer accordingly (e.g. -U http://localhost:8080/source/)

JustSong · 2019-01-25T08:28:55Z

Hi @vladak ,

Thanks a lot for your detail explanations and please correct me if I misunderstand your solution.

I have added this port argument in server.xml :
<Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/>

But also show the same error message as port 80:
javax.ws.rs.RedirectionException: HTTP 302 Found

vladak · 2019-01-25T08:47:44Z

You have to use the new port (8080) for Indexer communication with the web app.

vladak · 2019-01-25T08:48:43Z

How do you run the indexer exactly ?

JustSong · 2019-01-28T08:00:11Z

Hi @vladak ,

Yes I have tried to use -U http://localhost:8080/source/ but also get the same error:
Couldn't notify the webapp on http://localhost:8080/source: HTTP 302 Found.

My server.xml:

<Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/>

<Connector port="80" protocol="HTTP/1.1"  redirectPort="443"/>

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
		   maxThreads="150" scheme="https" secure="true"
		   clientAuth="false" sslProtocol="TLS"
		   sslEnabledProtocols="TLSv1.2"
		   connectionTimeout="20000"
		   keystoreFile="/var/lib/tomcat8/conf/opengrok.system.com.pfx"
		   keystoreType="PKCS12"
		   keystorePass="HU2Ue2Lq^zk^F6g*P"
		   compression="on"
		   compressableMimeType="text/html,text/xml,text/plain,text/css..."
		   />

Indexer -U command:
-U http://localhost:8080/source/

vladak · 2019-01-28T10:38:30Z

Http 302 is redirection. Where does it redirect to ? po 28. 1. 2019 9:00 odesílatel Dan Wang <[email protected]> napsal:

…

Hi @vladak <https://github.com/vladak> , Yes I have tried to use -U http://localhost:8080/source/ but also get the same error: Couldn't notify the webapp on http://localhost:8080/source: HTTP 302 Found. My server.xml: <Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/> <Connector port="80" protocol="HTTP/1.1" redirectPort="443"/> <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1.2" connectionTimeout="20000" keystoreFile="/var/lib/tomcat8/conf/opengrok.system.com.pfx" keystoreType="PKCS12" keystorePass="HU2Ue2Lq^zk^F6g*P" compression="on" compressableMimeType="text/html,text/xml,text/plain,text/css..." /> Indexer -U command: -U http://localhost:8080/source/ — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2635 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACzGDOGssL9dD9SucB35Pvn93a_KHJWRks5vHq4NgaJpZM4aMCQm> .

JustSong · 2019-03-14T02:51:01Z

I have no idea about this port redirection because of my server.xml not set redirection on 8080 port.
The settting on 8080 port is very simple :
<Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/>

vladak · 2019-03-14T07:45:37Z

Well, the redirection has to be configured somewhere and OpenGrok itself does not perform any redirections AFAIK. Again, if you query the address and display the HTTP headers, where does it tell it redirects to ? This might give a hint as to where this is configured.

JustSong · 2019-03-18T08:04:06Z

Hi @vladak ,

I tried to see what redirection on this 8080 port, but I found there is no redirection when I key in http://opengrok.system.com:8080/source in web browser. The web browser will show ERR_CONNECTION_REFUSED error.

I also tested other port setting like 8280, 8480 in <tomcat8>/conf/server.xml, .... and get the same error when I process index command so I don't think this error was cause by port redirection.

-U http://localhost:8280/source/
Couldn't notify the webapp on http://localhost:8280/source: HTTP 302 Found.

-U http://localhost:8480/source/
Couldn't notify the webapp on http://localhost:8480/source: HTTP 302 Found.

I have checked the help doc again and found -U introduction:

Send the current configuration to the specified webappURI

What is this -U command actual doing?

JustSong · 2019-03-18T08:25:33Z

I tried to remove the LDAP auth feature in tomcat and all work smoothly.
Only add setting <Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/> in <tomcat8>/conf/server.xml and process index command with -U http://localhost:8080/source/.

Removed part in <tomcat8>/conf/server.xml:

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
	 referrals="follow"
	 connectionURL="ldap://ldaptw.ad.system.com"
	 connectionName="CN=systemsupport,OU=ConsoleLogon,OU=System Account,OU=Users,OU=Taiwan,OU=Asia,DC=ad,DC=system,DC=com"
	 connectionPassword="system@123"
	 userSearch="(sAMAccountName={0})"
	 userBase="ou=Asia,dc=ad,dc=system,dc=com"
	 userSubtree="true"
	 allRolesMode="strictAuthOnly"
/>

Removed part in <tomcat8>/conf/web.xml:

<security-constraint>
	<web-resource-collection>
		<web-resource-name>Site</web-resource-name>
		<url-pattern>/*</url-pattern>
		<http-method>GET</http-method>
		<http-method>POST</http-method>
	</web-resource-collection>

	<user-data-constraint>
		<transport-guarantee>CONFIDENTIAL</transport-guarantee>
	</user-data-constraint>

	<auth-constraint>
		<role-name>*</role-name>
	</auth-constraint>
</security-constraint>

<login-config>
	<auth-method>BASIC</auth-method>
</login-config>

<security-role>
	<role-name>*</role-name>>
</security-role>

JustSong · 2019-03-19T07:18:30Z

Environment:

Tomcat: apache-tomcat-8.5.37.tar.gz

Opengrok: opengrok-1.1.2.tar.gz

LDAP Auth

SSL connection setting

Hi @vladak & @tulinkry ,

I think I finally found out the correct solution. Due to I have connected with the LDAP auth in my tomcat8, I should separate api/* in tomcat web.xml setting like this issue #2352.

If we connect with LDAP auth, we should add a specific port for -U command:

server.xml:
<Connector address="127.0.0.1" port="8080" protocol="HTTP/1.1"/>

And we should set api/* without authorization form, so we need to add another security-constraint to separate api/* URL pattern:

web.xml:

<security-constraint>
	<web-resource-collection>
		<web-resource-name>API endpoints are checked separately by the web app</web-resource-name>
		<url-pattern>/api/*</url-pattern>
	</web-resource-collection>
</security-constraint>

Try the -U command:
-U http://localhost:8080/source/

Thanks again for your kindly help!
Maybe we can notify the user who connects the OpenGrok with LDAP auth on wikis.

tulinkry · 2019-03-19T07:26:10Z

The problem then is that api/v1/search and api/v1/suggest is a public API (not only for localhost) and it would bypass your LDAP login.

JustSong · 2019-03-19T08:29:28Z

Hi @tulinkry

Yes, that's right!! Thanks!!

AKMFCJ · 2024-07-31T08:15:24Z

-U http://localhost:8080/source

vladak added question authorization labels Jan 22, 2019

vladak mentioned this issue Jan 23, 2019

LocalhostFilter usage #2636

Closed

vladak closed this as completed Jan 23, 2019

unhipzippo mentioned this issue Jul 23, 2019

Tomcat security and API #2872

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized #2635

SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized #2635

JustSong commented Jan 22, 2019 •

edited

Loading

vladak commented Jan 22, 2019

vladak commented Jan 22, 2019

JustSong commented Jan 23, 2019 •

edited

Loading

tulinkry commented Jan 23, 2019

JustSong commented Jan 23, 2019 •

edited

Loading

vladak commented Jan 23, 2019

vladak commented Jan 23, 2019

tulinkry commented Jan 23, 2019 •

edited

Loading

vladak commented Jan 23, 2019

tulinkry commented Jan 23, 2019

vladak commented Jan 23, 2019

vladak commented Jan 23, 2019 •

edited

Loading

JustSong commented Jan 25, 2019

vladak commented Jan 25, 2019 •

edited

Loading

vladak commented Jan 25, 2019

JustSong commented Jan 28, 2019 •

edited

Loading

vladak commented Jan 28, 2019 via email

JustSong commented Mar 14, 2019 •

edited

Loading

vladak commented Mar 14, 2019

JustSong commented Mar 18, 2019

JustSong commented Mar 18, 2019

JustSong commented Mar 19, 2019 •

edited

Loading

tulinkry commented Mar 19, 2019 •

edited

Loading

JustSong commented Mar 19, 2019

AKMFCJ commented Jul 31, 2024

SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized #2635

SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized #2635

Comments

JustSong commented Jan 22, 2019 • edited Loading

vladak commented Jan 22, 2019

vladak commented Jan 22, 2019

JustSong commented Jan 23, 2019 • edited Loading

tulinkry commented Jan 23, 2019

JustSong commented Jan 23, 2019 • edited Loading

vladak commented Jan 23, 2019

vladak commented Jan 23, 2019

tulinkry commented Jan 23, 2019 • edited Loading

vladak commented Jan 23, 2019

tulinkry commented Jan 23, 2019

vladak commented Jan 23, 2019

vladak commented Jan 23, 2019 • edited Loading

JustSong commented Jan 25, 2019

vladak commented Jan 25, 2019 • edited Loading

vladak commented Jan 25, 2019

JustSong commented Jan 28, 2019 • edited Loading

vladak commented Jan 28, 2019 via email

JustSong commented Mar 14, 2019 • edited Loading

vladak commented Mar 14, 2019

JustSong commented Mar 18, 2019

JustSong commented Mar 18, 2019

JustSong commented Mar 19, 2019 • edited Loading

tulinkry commented Mar 19, 2019 • edited Loading

JustSong commented Mar 19, 2019

AKMFCJ commented Jul 31, 2024

JustSong commented Jan 22, 2019 •

edited

Loading

JustSong commented Jan 23, 2019 •

edited

Loading

JustSong commented Jan 23, 2019 •

edited

Loading

tulinkry commented Jan 23, 2019 •

edited

Loading

vladak commented Jan 23, 2019 •

edited

Loading

vladak commented Jan 25, 2019 •

edited

Loading

JustSong commented Jan 28, 2019 •

edited

Loading

JustSong commented Mar 14, 2019 •

edited

Loading

JustSong commented Mar 19, 2019 •

edited

Loading

tulinkry commented Mar 19, 2019 •

edited

Loading