<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
The problem was the lack of a global web.xml in the apt install of tomcat9 from Ubuntu. Copied the file over from the Centos server and everything works fine now. Thanks all!</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober via users <users@shibboleth.net><br>
<b>Sent:</b> Tuesday, June 27, 2023 8:10 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Cc:</b> Peter Schober <peter.schober@univie.ac.at><br>
<b>Subject:</b> Re: IDP 4.3.1 Ubuntu 22.04/Tomcat 9 - No Access to App Subdirectories</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">* Ullfig, Roberto Alfredo <rullfig@uic.edu> [2023-06-27 14:31]:<br>
> Yes I reloaded. I've been doing this for over a decade.<br>
<br>
You shouldn't feel offended by someone trying to help you fix your problems.<br>
And it's not like the most experienced of admins are incapable of<br>
making simple mistakes. Maybe you're the exception, of course.<br>
<br>
> Do you know where systemd logs denied write access because I can't<br>
> see that logged anywhere.<br>
<br>
I'm not aware that it does but that doesn't mean anything.<br>
The systemd docs (or code) would tell you. Sorry if you already knew<br>
that as well. (Hard to tell which suggestions are OK and which are not<br>
because you know all that.)<br>
<br>
> I only figured out to enable write access to the log from someone<br>
> else's post.<br>
<br>
That specific issue only occurs when someone is using a distribution<br>
of Tomcat that's explicitly not supported by the Shibboleth project:<br>
<br>
"We also do not officially support any "packaged" containers provided<br>
by OS vendors. We do not test on these containers so we cannot<br>
assess what changes may have been made by the packaging process [...]"<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631833/SystemRequirements">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1265631833%2FSystemRequirements&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=NasfwYdBwvKydRisvCIor2wRU6pDISslfwFU%2BLprL4U%3D&reserved=0</a><br>
<br>
I've personally reported about this issue and how to work around it<br>
several times on this list, at least 3 times in 2020 alone, back when<br>
this issue initially came up (by Debian and derivatives introducing<br>
these additional hardening mechanisms in their tomcat packaging):<br>
<a href="https://shibboleth.net/pipermail/users/2020-September/047946.html">https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.net%2Fpipermail%2Fusers%2F2020-September%2F047946.html&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qddoClJsBnybMFcLSPYfSYkJFWLQ6vbcHX4rrXnQkaI%3D&reserved=0</a><br>
<br>
> It could be that tomcat is opening the directories R/W even though<br>
> it doesn't need to write to them.<br>
<br>
I never had to add any ReadWritePaths to make the IDP's default of<br>
/idp/images/ work, which maps to the war in $IDP_HOME/war/idp.war or<br>
an extracted copy thereof, which on Debian & friends would end up in<br>
/var/lib/tomcat9/webapps/idp/ -- and /var/lib/tomcat9/webapps/ is<br>
included in the default ReadWritePaths as distributed by Debian and<br>
derivatives.<br>
<br>
So no manual config changes would be needed to make the images<br>
directory of the default IDP distribution work here, IMO.<br>
<br>
Not even when putting those images into the ROOT context (which is the<br>
alternative Keith W. suggested and what I'm using myself), outside of<br>
the IDP's war mechanism, which on Debian & friends is in<br>
/var/lib/tomcat9/webapps/ROOT/ and so still included in the default<br>
systemd service's ReadWritePaths as well.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Crullfig%40uic.edu%7C09d4f44a0a3643a7545708db770fdbeb%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638234682231538613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=xRKQL6eqjTRhrbrkeFEMntgtT2qkAZEuQ2F%2BX2caUCg%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>