Skip to main content

Basic auth with Apache and Tomcat

This is a short "recipe" article explaining how to configure basic authentication for the following setup:
  • Apache Tomcat with some application that need be partially password-protected
  • Apache HTTP Server 2.4 as a proxy
  • CentOS 7 Linux server
Although basic authentication can be configured within Tomcat itself, my target is to use Apache for that purpose. In addition, as passing unencrypted credentials over the web is insecure, I'm going to install SSL certificates to enable HTTPS for the part of my application. This setup can be used when a part of an internal application need be secured to make it publicly accessible using a separate firewall/proxy (out of scope of this article), that part will be password-protected and SSL-encrypted.

Steps
  1. Copy certificates into /etc/ssl/certs/ivanlagunov.com
  2. Create symlink:
  3. cd /etc/httpd
    sudo ln -s /etc/ssl/certs/ivanlagunov.com
    
  4. Install Apache mod_ssl
  5. sudo yum -y install mod_ssl
  6. Create file with user credentials for basic authentication
  7. sudo htpasswd -c /usr/local/apache/password/.htpasswd_application username
  8. Modify VirtualHost
  9. sudo vi /etc/httpd/conf.d/vhosts.conf
    The following are examples of virtual hosts:
    <VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/httpd/ivanlagunov.com/Answer/ivanlagunov.com.crt
        SSLCertificateKeyFile /etc/httpd/ivanlagunov.com/Request/ivanlagunov.com.key
        SSLCertificateChainFile /etc/httpd/ivanlagunov.com/Answer/Linux/ivanlagunov.com.ca-bundle
        ServerName ivanlagunov.com
    
        # Password-protected part of the application is available under HTTPS
        <Location /application/protected_service>
            ProxyPass ajp://localhost:8009/application/protected_service
    
            AuthType Basic
            AuthName "Protected application"
            # By default, credentials are loaded from the file
            # There are smarter alternatives
            # As a default, the following directive can be omitted
            AuthBasicProvider file
            # Path to the file with user credentials
            AuthUserFile /usr/local/apache/password/.htpasswd_application
            # If Authorization header is not unset
            # Tomcat will return HTTP 401 Unauthorized
            RequestHeader unset "Authorization"
            # Require any valid user, can be limited to specific users
            Require valid-user
        </Location>
    </VirtualHost>
    
    <VirtualHost *:80>
        ServerName ivanlagunov.com
    
        # The whole application is available under HTTP
        ProxyPass /application ajp://localhost:8009/application
    </VirtualHost>
    
  10. Restart Apache
  11. sudo service httpd restart

Results
As a result, the following URLs will be accessible without password:
  • http://ivanlagunov.com/application
  • http://ivanlagunov.com/application/protected_service
The following URL won't be accessible:
  • https://ivanlagunov.com/application
The following URL will be password-protected:
  • https://ivanlagunov.com/application/protected_service
Once again, only the last HTTPS URL is supposed to be made publicly accessible in this setup. HTTP URLs are supposed to be internal-only, hidden behind the firewall. That was an idea but the firewall configuration is out of scope of this article.

Comments

Popular posts from this blog

Connection to Amazon Neptune endpoint from EKS during development

This small article will describe how to connect to Amazon Neptune database endpoint from your PC during development. Amazon Neptune is a fully managed graph database service from Amazon. Due to security reasons direct connections to Neptune are not allowed, so it's impossible to attach a public IP address or load balancer to that service. Instead access is restricted to the same VPC where Neptune is set up, so applications should be deployed in the same VPC to be able to access the database. That's a great idea for Production however it makes it very difficult to develop, debug and test applications locally. The instructions below will help you to create a tunnel towards Neptune endpoint considering you use Amazon EKS - a managed Kubernetes service from Amazon. As a side note, if you don't use EKS, the same idea of creating a tunnel can be implemented using a Bastion server . In Kubernetes we'll create a dedicated proxying pod. Prerequisites. Setting up a tunnel.

Notes on upgrade to JSF 2.1, Servlet 3.0, Spring 4.0, RichFaces 4.3

This article is devoted to an upgrade of a common JSF Spring application. Time flies and there is already Java EE 7 platform out and widely used. It's sometimes said that Spring framework has become legacy with appearance of Java EE 6. But it's out of scope of this post. Here I'm going to provide notes about the minimal changes that I found required for the upgrade of the application from JSF 1.2 to 2.1, from JSTL 1.1.2 to 1.2, from Servlet 2.4 to 3.0, from Spring 3.1.3 to 4.0.5, from RichFaces 3.3.3 to 4.3.7. It must be mentioned that the latest final RichFaces release 4.3.7 depends on JSF 2.1, JSTL 1.2 and Servlet 3.0.1 that dictated those versions. This post should not be considered as comprehensive but rather showing how I did the upgrade. See the links for more details. Jetty & Tomcat. JSTL. JSF & Facelets. Servlet. Spring framework. RichFaces. Jetty & Tomcat First, I upgraded the application to run with the latest servlet container versio

DynamicReports and Spring MVC integration

This is a tutorial on how to exploit DynamicReports reporting library in an existing  Spring MVC based web application. It's a continuation to the previous post where DynamicReports has been chosen as the most appropriate solution to implement an export feature in a web application (for my specific use case). The complete code won't be provided here but only the essential code snippets together with usage remarks. Also I've widely used this tutorial that describes a similar problem for an alternative reporting library. So let's turn to the implementation description and start with a short plan of this how-to: Adding project dependencies. Implementing the Controller part of the MVC pattern. Modifying the View part of the MVC pattern. Modifying web.xml. Adding project dependencies I used to apply Maven Project Builder throughout my Java applications, thus the dependencies will be provided in the Maven format. Maven project pom.xml file: net.sourcefo