[java-idp-tomcat-base] branch 10.1 updated: Initial commit for Tomcat 11.0 branch
Codeberg
noreply at shibboleth.net
Fri May 1 22:25:58 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch 10.1
in repository java-idp-tomcat-base.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-tomcat-base/commit/c623e3413811c2ecbb7dea182b3da3e04782b49d
The following commit(s) were added to refs/heads/10.1 by this push:
new c623e34 Initial commit for Tomcat 11.0 branch
c623e34 is described below
commit c623e3413811c2ecbb7dea182b3da3e04782b49d
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Fri May 1 17:25:30 2026 -0500
Initial commit for Tomcat 11.0 branch
Updates for Tomcat 11.0.21 and IdP 5.2.1 with latest plugins
---
pom.xml | 2 +-
tomcat-base/conf/catalina.policy | 263 -----------------------------------
tomcat-base/conf/catalina.properties | 76 +++++-----
tomcat-base/conf/logging.properties | 6 +-
tomcat-base/conf/server.xml | 28 +---
tomcat-base/conf/web.xml | 101 ++++++++------
6 files changed, 103 insertions(+), 373 deletions(-)
diff --git a/pom.xml b/pom.xml
index 64c7103..563366f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,7 @@
<groupId>net.shibboleth.idp</groupId>
<artifactId>idp-tomcat-base</artifactId>
<packaging>pom</packaging>
- <version>10.1.0-SNAPSHOT</version>
+ <version>11.0.0-SNAPSHOT</version>
<build>
<plugins>
diff --git a/tomcat-base/conf/catalina.policy b/tomcat-base/conf/catalina.policy
deleted file mode 100644
index 6a82bcb..0000000
--- a/tomcat-base/conf/catalina.policy
+++ /dev/null
@@ -1,263 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one or more
-// contributor license agreements. See the NOTICE file distributed with
-// this work for additional information regarding copyright ownership.
-// The ASF licenses this file to You under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance with
-// the License. You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// ============================================================================
-// catalina.policy - Security Policy Permissions for Tomcat
-//
-// This file contains a default set of security policies to be enforced (by the
-// JVM) when Catalina is executed with the "-security" option. In addition
-// to the permissions granted here, the following additional permissions are
-// granted to each web application:
-//
-// * Read access to the web application's document root directory
-// * Read, write and delete access to the web application's working directory
-// ============================================================================
-
-
-// ========== SYSTEM CODE PERMISSIONS =========================================
-
-
-// These permissions apply to javac
-grant codeBase "file:${java.home}/lib/-" {
- permission java.security.AllPermission;
-};
-
-// These permissions apply to all shared system extensions
-grant codeBase "file:${java.home}/jre/lib/ext/-" {
- permission java.security.AllPermission;
-};
-
-// These permissions apply to javac when ${java.home} points at $JAVA_HOME/jre
-grant codeBase "file:${java.home}/../lib/-" {
- permission java.security.AllPermission;
-};
-
-// These permissions apply to all shared system extensions when
-// ${java.home} points at $JAVA_HOME/jre
-grant codeBase "file:${java.home}/lib/ext/-" {
- permission java.security.AllPermission;
-};
-
-// This permission is required when using javac to compile JSPs
-grant codeBase "jrt:/jdk.compiler" {
- permission java.security.AllPermission;
-};
-
-
-// ========== CATALINA CODE PERMISSIONS =======================================
-
-// These permissions apply to the daemon code
-grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
- permission java.security.AllPermission;
-};
-
-// These permissions apply to the logging API
-// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
-// update this section accordingly.
-// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
-grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
- permission java.io.FilePermission
- "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
-
- permission java.io.FilePermission
- "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
- permission java.io.FilePermission
- "${catalina.base}${file.separator}logs", "read, write";
- permission java.io.FilePermission
- "${catalina.base}${file.separator}logs${file.separator}*", "read, write, delete";
-
- permission java.lang.RuntimePermission "shutdownHooks";
- permission java.lang.RuntimePermission "getClassLoader";
- permission java.lang.RuntimePermission "setContextClassLoader";
-
- permission java.lang.management.ManagementPermission "monitor";
-
- permission java.util.logging.LoggingPermission "control";
-
- permission java.util.PropertyPermission "java.util.logging.config.class", "read";
- permission java.util.PropertyPermission "java.util.logging.config.file", "read";
- permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
- permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
- permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
- permission java.util.PropertyPermission "catalina.base", "read";
-
- // Note: To enable per context logging configuration, permit read access to
- // the appropriate file. Be sure that the logging configuration is
- // secure before enabling such access.
- // E.g. for the examples web application (uncomment and unwrap
- // the following to be on a single line):
- // permission java.io.FilePermission "${catalina.base}${file.separator}
- // webapps${file.separator}examples${file.separator}WEB-INF
- // ${file.separator}classes${file.separator}logging.properties", "read";
-};
-
-// These permissions apply to the server startup code
-grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
- permission java.security.AllPermission;
-};
-
-// These permissions apply to the servlet API classes
-// and those that are shared across all class loaders
-// located in the "lib" directory
-grant codeBase "file:${catalina.home}/lib/-" {
- permission java.security.AllPermission;
-};
-
-
-// If using a per instance lib directory, i.e. ${catalina.base}/lib,
-// then the following permission will need to be uncommented
-// grant codeBase "file:${catalina.base}/lib/-" {
-// permission java.security.AllPermission;
-// };
-
-
-// ========== WEB APPLICATION PERMISSIONS =====================================
-
-
-// These permissions are granted by default to all web applications
-// In addition, a web application will be given a read FilePermission
-// for all files and directories in its document root.
-grant {
- // Required for JNDI lookup of named JDBC DataSource's and
- // javamail named MimePart DataSource used to send mail
- permission java.util.PropertyPermission "java.home", "read";
- permission java.util.PropertyPermission "java.naming.*", "read";
- permission java.util.PropertyPermission "javax.sql.*", "read";
-
- // OS Specific properties to allow read access
- permission java.util.PropertyPermission "os.name", "read";
- permission java.util.PropertyPermission "os.version", "read";
- permission java.util.PropertyPermission "os.arch", "read";
- permission java.util.PropertyPermission "file.separator", "read";
- permission java.util.PropertyPermission "path.separator", "read";
- permission java.util.PropertyPermission "line.separator", "read";
-
- // JVM properties to allow read access
- permission java.util.PropertyPermission "java.version", "read";
- permission java.util.PropertyPermission "java.vendor", "read";
- permission java.util.PropertyPermission "java.vendor.url", "read";
- permission java.util.PropertyPermission "java.class.version", "read";
- permission java.util.PropertyPermission "java.specification.version", "read";
- permission java.util.PropertyPermission "java.specification.vendor", "read";
- permission java.util.PropertyPermission "java.specification.name", "read";
-
- permission java.util.PropertyPermission "java.vm.specification.version", "read";
- permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
- permission java.util.PropertyPermission "java.vm.specification.name", "read";
- permission java.util.PropertyPermission "java.vm.version", "read";
- permission java.util.PropertyPermission "java.vm.vendor", "read";
- permission java.util.PropertyPermission "java.vm.name", "read";
-
- // Required for OpenJMX
- permission java.lang.RuntimePermission "getAttribute";
-
- // Allow read of JAXP compliant XML parser debug
- permission java.util.PropertyPermission "jaxp.debug", "read";
-
- // All JSPs need to be able to read this package
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
-
- // Precompiled JSPs need access to these packages.
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
- permission java.lang.RuntimePermission
- "accessClassInPackage.org.apache.jasper.runtime.*";
-
- // Applications using WebSocket need to be able to access these packages
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
-};
-
-
-// The Manager application needs access to the following packages to support the
-// session display functionality. It also requires the custom Tomcat
-// DeployXmlPermission to enable the use of META-INF/context.xml
-// These settings support the following configurations:
-// - default CATALINA_HOME == CATALINA_BASE
-// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
-// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
-grant codeBase "file:${catalina.base}/webapps/manager/-" {
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
- permission org.apache.catalina.security.DeployXmlPermission "manager";
-};
-grant codeBase "file:${catalina.home}/webapps/manager/-" {
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
- permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
- permission org.apache.catalina.security.DeployXmlPermission "manager";
-};
-
-// The Host Manager application needs the custom Tomcat DeployXmlPermission to
-// enable the use of META-INF/context.xml
-// These settings support the following configurations:
-// - default CATALINA_HOME == CATALINA_BASE
-// - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
-// - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
-grant codeBase "file:${catalina.base}/webapps/host-manager/-" {
- permission org.apache.catalina.security.DeployXmlPermission "host-manager";
-};
-grant codeBase "file:${catalina.home}/webapps/host-manager/-" {
- permission org.apache.catalina.security.DeployXmlPermission "host-manager";
-};
-
-
-// You can assign additional permissions to particular web applications by
-// adding additional "grant" entries here, based on the code base for that
-// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
-//
-// Different permissions can be granted to JSP pages, classes loaded from
-// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
-// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
-//
-// For instance, assume that the standard "examples" application
-// included a JDBC driver that needed to establish a network connection to the
-// corresponding database and used the scrape taglib to get the weather from
-// the NOAA web server. You might create a "grant" entries like this:
-//
-// The permissions granted to the context root directory apply to JSP pages.
-// grant codeBase "file:${catalina.base}/webapps/examples/-" {
-// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
-// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
-// };
-//
-// The permissions granted to the context WEB-INF/classes directory
-// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
-// };
-//
-// The permission granted to your JDBC driver
-// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
-// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
-// };
-// The permission granted to the scrape taglib
-// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
-// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
-// };
-
-// To grant permissions for web applications using packed WAR files, use the
-// Tomcat specific WAR url scheme.
-//
-// The permissions granted to the entire web application
-// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
-// };
-//
-// The permissions granted to a specific JAR
-// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
-// };
\ No newline at end of file
diff --git a/tomcat-base/conf/catalina.properties b/tomcat-base/conf/catalina.properties
index 17be0fa..6785f4d 100644
--- a/tomcat-base/conf/catalina.properties
+++ b/tomcat-base/conf/catalina.properties
@@ -16,50 +16,20 @@
#
# Shibboleth IdP properties
#
-
# HTTP connector
# Allows use of default IdP command line tools.
tomcat.http.host=127.0.0.1
tomcat.http.port=80
-
# The HTTPS connector
# The interface to listen on. To listen on all interfaces, set tomcat.host = 0.0.0.0
tomcat.https.host=0.0.0.0
tomcat.https.port=443
tomcat.https.certificateKeystoreFile=credentials/idp-userfacing.p12
tomcat.https.certificateKeystorePassword=changeit
-
-# The SOAP endpoint connector
-# tomcat.backchannel.port=8443
-# tomcat.backchannel.keystoreFile=credentials/idp-backchannel.p12
-# tomcat.backchannel.keystorePass=changeit
-# tomcat.backchannel.keystoreType=PKCS12
-
# Shutdown port and password
tomcat.shutdown.port=8005
tomcat.shutdown.password=SHUTDOWN
-#
-# List of comma-separated packages that start with or equal this string
-# will cause a security exception to be thrown when
-# passed to checkPackageAccess unless the
-# corresponding RuntimePermission ("accessClassInPackage."+package) has
-# been granted.
-package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,org.apache.tomcat.
-#
-# List of comma-separated packages that start with or equal this string
-# will cause a security exception to be thrown when
-# passed to checkPackageDefinition unless the
-# corresponding RuntimePermission ("defineClassInPackage."+package) has
-# been granted.
-#
-# by default, no packages are restricted for definition, and none of
-# the class loaders supplied with the JDK call checkPackageDefinition.
-#
-package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,\
-org.apache.jasper.,org.apache.naming.,org.apache.tomcat.
-
-#
#
# List of comma-separated paths defining the contents of the "common"
# classloader. Prefixes should be used to define what is the repository type.
@@ -205,6 +175,7 @@ taglibs-standard-spec-*.jar,\
tagsoup-*.jar,\
tomcat-api.jar,\
tomcat-coyote.jar,\
+tomcat-coyote-ffm.jar,\
tomcat-dbcp.jar,\
tomcat-i18n-*.jar,\
tomcat-jdbc.jar,\
@@ -229,19 +200,18 @@ annotations-*.jar,\
bcpkix-jdk18on-*.jar,\
bcprov-jdk18on-*.jar,\
bcutil-jdk18on-*.jar,\
+byte-buddy-*.jar,\
checker-qual-*.jar,\
-commons-codec-*.jar,\
commons-compiler-*.jar,\
-commons-dbcp2-*.jar,\
-commons-lang3-*.jar,\
-commons-pool2-*.jar,\
content-type-*.jar,\
+converter-jackson-*.jar,\
cryptacular-*.jar,\
+duo-universal-sdk-*.jar,\
error_prone_annotations-*.jar,\
failureaccess-*.jar,\
+googleauth-*.jar,\
guava-*.jar,\
-httpclient5-*.jar,\
-httpclient5-cache-*.jar,\
+hsqldb-*.jar,\
httpcore5-*.jar,\
httpcore5-h2-*.jar,\
idp-admin-api-*.jar,\
@@ -254,11 +224,16 @@ idp-conf-impl-*.jar,\
idp-consent-api-*.jar,\
idp-consent-impl-*.jar,\
idp-core-*.jar,\
+idp-plugin-duo-api-*.jar,\
+idp-plugin-duo-impl-*.jar,\
+idp-plugin-duo-sdk-client-impl-*.jar,\
+idp-plugin-metadatagen-impl-*.jar,\
idp-plugin-nashorn-jdk-impl-*.jar,\
idp-plugin-oidc-config-impl-*.jar,\
idp-plugin-oidc-op-api-*.jar,\
idp-plugin-oidc-op-impl-*.jar,\
idp-plugin-scripting-api-*.jar,\
+idp-plugin-totp-impl-*.jar,\
idp-profile-api-*.jar,\
idp-profile-impl-*.jar,\
idp-saml-api-*.jar,\
@@ -275,18 +250,28 @@ jackson-core-*.jar,\
jackson-databind-*.jar,\
jackson-datatype-jsr310-*.jar,\
jakarta.activation-*.jar,\
+jakarta.annotation-api-*.jar,\
+jakarta.el-api-*.jar,\
+jakarta.enterprise.cdi-api-*.jar,\
+jakarta.enterprise.lang-model-*.jar,\
+jakarta.inject-api-*.jar,\
+jakarta.interceptor-api-*.jar,\
jakarta.json-*.jar,\
jakarta.mail-*.jar,\
jakarta.servlet.jsp.jstl-api-*.jar,\
+jakarta.transaction-api-*.jar,\
janino-*.jar,\
+java-jwt-*.jar,\
+jcommander-*.jar,\
+jdbc-storage-impl-*.jar,\
json-smart-*.jar,\
jsonapi-converter-*.jar,\
+jspecify-*.jar,\
jsr305-*.jar,\
jul-to-slf4j-*.jar,\
lang-tag-*.jar,\
ldaptive-*.jar,\
listenablefuture-*.jar,\
-log4j-over-slf4j-*.jar,\
logback-classic-*.jar,\
logback-core-*.jar,\
metrics-core-*.jar,\
@@ -294,6 +279,8 @@ metrics-json-*.jar,\
metrics-jvm-*.jar,\
micrometer-commons-*.jar,\
micrometer-observation-*.jar,\
+mortbay-apache-el-*.jar,\
+mortbay-apache-jsp-*.jar,\
nashorn-core-*.jar,\
netty-buffer-*.jar,\
netty-codec-*.jar,\
@@ -304,7 +291,6 @@ netty-transport-*.jar,\
netty-transport-classes-epoll-*.jar,\
netty-transport-classes-kqueue-*.jar,\
netty-transport-native-epoll-*.jar,\
-netty-transport-native-epoll-*.jar,\
netty-transport-native-kqueue-*.jar,\
netty-transport-native-unix-common-*.jar,\
nimbus-jose-jwt-*.jar,\
@@ -320,6 +306,8 @@ oidc-common-profile-api-*.jar,\
oidc-common-profile-impl-*.jar,\
oidc-common-saml-api-*.jar,\
oidc-common-saml-impl-*.jar,\
+okhttp-*.jar,\
+okio-*.jar,\
opensaml-core-api-*.jar,\
opensaml-core-impl-*.jar,\
opensaml-messaging-api-*.jar,\
@@ -337,6 +325,7 @@ opensaml-storage-api-*.jar,\
opensaml-storage-impl-*.jar,\
opensaml-xmlsec-api-*.jar,\
opensaml-xmlsec-impl-*.jar,\
+retrofit-*.jar,\
shib-attribute-api-*.jar,\
shib-attribute-filter-api-*.jar,\
shib-attribute-filter-impl-*.jar,\
@@ -345,6 +334,7 @@ shib-attribute-impl-*.jar,\
shib-attribute-resolver-api-*.jar,\
shib-attribute-resolver-impl-*.jar,\
shib-attribute-resolver-spring-*.jar,\
+shib-cli-*.jar,\
shib-metadata-api-*.jar,\
shib-metadata-impl-*.jar,\
shib-metadata-spring-*.jar,\
@@ -360,20 +350,20 @@ shib-security-spring-*.jar,\
shib-service-*.jar,\
shib-spring-*.jar,\
shib-support-*.jar,\
+shib-testing-*.jar,\
shib-velocity-*.jar,\
shib-velocity-spring-*.jar,\
-slf4j-api-*.jar,\
spring-aop-*.jar,\
spring-beans-*.jar,\
spring-binding-*.jar,\
spring-context-*.jar,\
spring-core-*.jar,\
spring-expression-*.jar,\
-spring-jcl-*.jar,\
+spring-jdbc-*.jar,\
+spring-tx-*.jar,\
spring-web-*.jar,\
spring-webflow-*.jar,\
spymemcached-*.jar,\
-trustany-ssl-*.jar,\
velocity-engine-core-*.jar,\
xmlsec-*.jar
@@ -393,7 +383,3 @@ tomcat.util.buf.StringCache.byte.enabled=true
#tomcat.util.buf.StringCache.char.enabled=true
#tomcat.util.buf.StringCache.trainThreshold=500000
#tomcat.util.buf.StringCache.cacheSize=5000
-
-# Disable use of some privilege blocks Tomcat doesn't need since calls to the
-# code in question are always already inside a privilege block
-org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED=false
diff --git a/tomcat-base/conf/logging.properties b/tomcat-base/conf/logging.properties
index e8b7b16..0f2b99b 100644
--- a/tomcat-base/conf/logging.properties
+++ b/tomcat-base/conf/logging.properties
@@ -69,11 +69,11 @@ org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].ha
# each component that extends LifecycleBase changing state:
#org.apache.catalina.util.LifecycleBase.level = FINE
-# To see debug messages in TldLocationsCache, uncomment the following line:
-#org.apache.jasper.compiler.TldLocationsCache.level = FINE
-
# To see debug messages for HTTP/2 handling, uncomment the following line:
#org.apache.coyote.http2.level = FINE
# To see debug messages for WebSocket handling, uncomment the following line:
#org.apache.tomcat.websocket.level = FINE
+
+# To see debug messages for TLD scanning, uncomment the following line:
+# org.apache.jasper.servlet.TldScanner.level = FINEST
diff --git a/tomcat-base/conf/server.xml b/tomcat-base/conf/server.xml
index fc5b3f4..4cb742d 100644
--- a/tomcat-base/conf/server.xml
+++ b/tomcat-base/conf/server.xml
@@ -24,8 +24,10 @@
<!-- Security listener. Documentation at /docs/config/listeners.html
<Listener className="org.apache.catalina.security.SecurityListener" />
-->
- <!-- APR library loader. Documentation at /docs/apr.html -->
- <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+ <!-- OpenSSL support using Tomcat Native -->
+ <Listener className="org.apache.catalina.core.AprLifecycleListener" />
+ <!-- OpenSSL support using FFM API from Java 22 -->
+ <!-- <Listener className="org.apache.catalina.core.OpenSSLLifecycleListener" /> -->
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
@@ -91,13 +93,11 @@
-->
<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
- maxThreads="150" SSLEnabled="true"
- maxParameterCount="1000"
- >
+ maxThreads="150" SSLEnabled="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
<SSLHostConfig>
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
- type="RSA" />
+ certificateKeystorePassword="changeit" type="RSA" />
</SSLHostConfig>
</Connector>
-->
@@ -117,22 +117,6 @@
</SSLHostConfig>
</Connector>
- <!-- TODO Define dedicated SOAP connector for back-channel requests
- <Connector
- address="${tomcat.https.host}"
- port="${tomcat.backchannel.port}"
- protocol="org.apache.coyote.http11.Http11NioProtocol"
- maxPostSize="100000"
- SSLEnabled="true"
- scheme="https"
- secure="true"
- clientAuth="want"
- keystoreFile="${tomcat.backchannel.keystoreFile}"
- keystorePass="${tomcat.backchannel.keystorePass}"
- keystoreType="${tomcat.backchannel.keystoreType}"
- trustManagerClassName="net.shibboleth.utilities.ssl.TrustAnyCertificate" />
- -->
-
<!-- Define an AJP 1.3 Connector on port 8009 -->
<!--
<Connector protocol="AJP/1.3"
diff --git a/tomcat-base/conf/web.xml b/tomcat-base/conf/web.xml
index d01ab9b..595e02c 100644
--- a/tomcat-base/conf/web.xml
+++ b/tomcat-base/conf/web.xml
@@ -18,8 +18,8 @@
<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
- https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
- version="6.0">
+ https://jakarta.ee/xml/ns/jakartaee/web-app_6_1.xsd"
+ version="6.1">
<!-- ======================== Introduction ============================== -->
<!-- This document defines default values for *all* web applications -->
@@ -78,12 +78,15 @@
<!-- contents. [null] -->
<!-- -->
<!-- sendfileSize If the connector used supports sendfile, this -->
- <!-- represents the minimal file size in KiB for -->
+ <!-- represents the minimal file size in KiB for -->
<!-- which sendfile will be used. Use a negative -->
<!-- value to always disable sendfile. [48] -->
<!-- -->
<!-- useAcceptRanges Should the Accept-Ranges header be included -->
<!-- in responses where appropriate? [true] -->
+ <!-- Deprecated. This option will be removed -->
+ <!-- without replacement in Tomcat 12 onwards where -->
+ <!-- it will effectively be hard coded to true. -->
<!-- -->
<!-- For directory listing customization. Checks localXsltFile, then -->
<!-- globalXsltFile, then defaults to original behavior. -->
@@ -111,11 +114,16 @@
<!-- listings is enabled? [true] -->
<!-- -->
<!-- allowPartialPut Should the server treat an HTTP PUT request -->
- <!-- with a Range header as a partial PUT? Note -->
- <!-- that while RFC 7233 clarified that Range -->
- <!-- headers only valid for GET requests, RFC 9110 -->
- <!-- (which obsoletes RFC 7233) now allows partial -->
- <!-- puts. [true] -->
+ <!-- with a Content-Range header as a partial PUT? -->
+ <!-- Note that while RFC 7231 clarified that such a -->
+ <!-- PUT with a Content-Range header field is a bad -->
+ <!-- request, RFC 9110 (which obsoletes RFC 7231) -->
+ <!-- now allows partial PUT. [true] -->
+ <!-- -->
+ <!-- directoryRedirectStatusCode -->
+ <!-- Status code to use for directory redirects. -->
+ <!-- Possible values: 301, 302, 307, 308 -->
+ <!-- [302] -->
<servlet>
<servlet-name>default</servlet-name>
@@ -155,9 +163,9 @@
<!-- pages. See the jasper documentation for more -->
<!-- information. -->
<!-- -->
- <!-- compilerSourceVM Compiler source VM. [11] -->
+ <!-- compilerSourceVM Compiler source VM. [17] -->
<!-- -->
- <!-- compilerTargetVM Compiler target VM. [11] -->
+ <!-- compilerTargetVM Compiler target VM. [17] -->
<!-- -->
<!-- development Is Jasper used in development mode? If true, -->
<!-- the frequency at which JSPs are checked for -->
@@ -180,8 +188,6 @@
<!-- engineOptionsClass Allows specifying the Options class used to -->
<!-- configure Jasper. If not present, the default -->
<!-- EmbeddedServletOptions will be used. -->
- <!-- This option is ignored when running under a -->
- <!-- SecurityManager. -->
<!-- -->
<!-- errorOnUseBeanInvalidClassAttribute -->
<!-- Should Jasper issue an error when the value of -->
@@ -239,8 +245,6 @@
<!-- scratchdir What scratch directory should we use when -->
<!-- compiling JSP pages? [default work directory -->
<!-- for the current web application] -->
- <!-- This option is ignored when running under a -->
- <!-- SecurityManager. -->
<!-- -->
<!-- suppressSmap Should the generation of SMAP info for JSR45 -->
<!-- debugging be suppressed? [false] -->
@@ -363,7 +367,7 @@
<!-- the arguments to the OS. See the CGI How-To -->
<!-- for more details. The default varies by -->
<!-- platform. -->
- <!-- Windows: [[\w\Q-.\\/:\E]+] -->
+ <!-- Windows: [[\w\Q-.\\/:\E]+] -->
<!-- Others: [.*] -->
<!-- Note that internally the CGI Servlet treats -->
<!-- [.*] as a special case to improve performance -->
@@ -374,7 +378,7 @@
<!-- command line arguments must match else the -->
<!-- request will be rejected. The default matches -->
<!-- the allowed values defined by RFC3875. -->
- <!-- [[\w\Q%;/?:@&,$-.!~*'()\E]+] -->
+ <!-- [[\w\Q%;/?:@&,$-.!~*'()\E]+] -->
<!-- -->
<!-- enableCmdLineArguments -->
<!-- Are command line parameters generated from -->
@@ -521,19 +525,6 @@
</filter>
-->
- <!-- A filter that triggers request parameters parsing and rejects the -->
- <!-- request if some parameters were skipped because of parsing errors or -->
- <!-- request size limitations. -->
-<!--
- <filter>
- <filter-name>failedRequestFilter</filter-name>
- <filter-class>
- org.apache.catalina.filters.FailedRequestFilter
- </filter-class>
- <async-supported>true</async-supported>
- </filter>
--->
-
<!-- NOTE: An SSI Servlet is also available as an alternative SSI -->
<!-- implementation. Use either the Servlet or the Filter but NOT both. -->
@@ -612,14 +603,6 @@
</filter-mapping>
-->
- <!-- The mapping for the Failed Request Filter -->
-<!--
- <filter-mapping>
- <filter-name>failedRequestFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
--->
-
<!-- The mapping for the SSI Filter -->
<!--
<filter-mapping>
@@ -842,6 +825,10 @@
<extension>avi</extension>
<mime-type>video/x-msvideo</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>avif</extension>
+ <mime-type>image/avif</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>avx</extension>
<mime-type>video/x-rad-screenplay</mime-type>
@@ -1770,6 +1757,10 @@
<extension>ggb</extension>
<mime-type>application/vnd.geogebra.file</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>ggs</extension>
+ <mime-type>application/vnd.geogebra.slides</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>ggt</extension>
<mime-type>application/vnd.geogebra.tool</mime-type>
@@ -2142,6 +2133,10 @@
<extension>jspf</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>jxl</extension>
+ <mime-type>image/jxl</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>kar</extension>
<mime-type>audio/midi</mime-type>
@@ -2310,6 +2305,14 @@
<extension>m2a</extension>
<mime-type>audio/mpeg</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>m2t</extension>
+ <mime-type>video/mp2t</mime-type>
+ </mime-mapping>
+ <mime-mapping>
+ <extension>m2ts</extension>
+ <mime-type>video/mp2t</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>m2v</extension>
<mime-type>video/mpeg</mime-type>
@@ -2474,6 +2477,10 @@
<extension>mjp2</extension>
<mime-type>video/mj2</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>mjs</extension>
+ <mime-type>text/javascript</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>mk3d</extension>
<mime-type>video/x-matroska</mime-type>
@@ -2676,7 +2683,7 @@
</mime-mapping>
<mime-mapping>
<extension>mts</extension>
- <mime-type>model/vnd.mts</mime-type>
+ <mime-type>video/mp2t</mime-type>
</mime-mapping>
<mime-mapping>
<extension>mus</extension>
@@ -2912,6 +2919,10 @@
<extension>oprc</extension>
<mime-type>application/vnd.palm</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>opus</extension>
+ <mime-type>audio/ogg</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>org</extension>
<mime-type>application/vnd.lotus-organizer</mime-type>
@@ -3711,6 +3722,14 @@
<extension>sql</extension>
<mime-type>application/x-sql</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>sqlite</extension>
+ <mime-type>application/vnd.sqlite3</mime-type>
+ </mime-mapping>
+ <mime-mapping>
+ <extension>sqlite3</extension>
+ <mime-type>application/vnd.sqlite3</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>src</extension>
<mime-type>application/x-wais-source</mime-type>
@@ -3959,6 +3978,10 @@
<extension>trm</extension>
<mime-type>application/x-msterminal</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>ts</extension>
+ <mime-type>video/mp2t</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>tsd</extension>
<mime-type>application/timestamped-data</mime-type>
@@ -4729,7 +4752,7 @@
<!-- If you define welcome files in your own application's web.xml -->
<!-- deployment descriptor, that list *replaces* the list configured -->
<!-- here, so be sure to include any of the default values that you wish -->
- <!-- to use within your application. -->
+ <!-- to use within your application. -->
<welcome-file-list>
<welcome-file>index.html</welcome-file>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list