IDP 4.3.1 Ubuntu 22.04/Tomcat 9 - No Access to App Subdirectories

Tue Jun 27 16:10:34 UTC 2023

The problem was the lack of a global web.xml in the apt install of tomcat9 from Ubuntu. Copied the file over from the Centos server and everything works fine now. Thanks all!

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: Tuesday, June 27, 2023 8:10 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: IDP 4.3.1 Ubuntu 22.04/Tomcat 9 - No Access to App Subdirectories

* Ullfig, Roberto Alfredo <rullfig at uic.edu> [2023-06-27 14:31]:
> Yes I reloaded. I've been doing this for over a decade.

You shouldn't feel offended by someone trying to help you fix your problems.
And it's not like the most experienced of admins are incapable of
making simple mistakes. Maybe you're the exception, of course.

> Do you know where systemd logs denied write access because I can't
> see that logged anywhere.

I'm not aware that it does but that doesn't mean anything.
The systemd docs (or code) would tell you. Sorry if you already knew
that as well. (Hard to tell which suggestions are OK and which are not
because you know all that.)

> I only figured out to enable write access to the log from someone
> else's post.

That specific issue only occurs when someone is using a distribution
of Tomcat that's explicitly not supported by the Shibboleth project:

  "We also do not officially support any "packaged" containers provided
  by OS vendors. We do not test on these containers so we cannot
  assess what changes may have been made by the packaging process [...]"
  https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1265631833%2FSystemRequirements&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=NasfwYdBwvKydRisvCIor2wRU6pDISslfwFU%2BLprL4U%3D&reserved=0<https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631833/SystemRequirements>

I've personally reported about this issue and how to work around it
several times on this list, at least 3 times in 2020 alone, back when
this issue initially came up (by Debian and derivatives introducing
these additional hardening mechanisms in their tomcat packaging):
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.net%2Fpipermail%2Fusers%2F2020-September%2F047946.html&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qddoClJsBnybMFcLSPYfSYkJFWLQ6vbcHX4rrXnQkaI%3D&reserved=0<https://shibboleth.net/pipermail/users/2020-September/047946.html>

> It could be that tomcat is opening the directories R/W even though
> it doesn't need to write to them.

I never had to add any ReadWritePaths to make the IDP's default of
/idp/images/ work, which maps to the war in $IDP_HOME/war/idp.war or
an extracted copy thereof, which on Debian & friends would end up in
/var/lib/tomcat9/webapps/idp/ -- and /var/lib/tomcat9/webapps/ is
included in the default ReadWritePaths as distributed by Debian and
derivatives.

So no manual config changes would be needed to make the images
directory of the default IDP distribution work here, IMO.

Not even when putting those images into the ROOT context (which is the
alternative Keith W. suggested and what I'm using myself), outside of
the IDP's war mechanism, which on Debian & friends is in
/var/lib/tomcat9/webapps/ROOT/ and so still included in the default
systemd service's ReadWritePaths as well.

-peter
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=xRKQL6eqjTRhrbrkeFEMntgtT2qkAZEuQ2F%2BX2caUCg%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230627/6ede507e/attachment.htm>