Skip to main content

Basic auth with Apache and Tomcat

This is a short "recipe" article explaining how to configure basic authentication for the following setup:
  • Apache Tomcat with some application that need be partially password-protected
  • Apache HTTP Server 2.4 as a proxy
  • CentOS 7 Linux server
Although basic authentication can be configured within Tomcat itself, my target is to use Apache for that purpose. In addition, as passing unencrypted credentials over the web is insecure, I'm going to install SSL certificates to enable HTTPS for the part of my application. This setup can be used when a part of an internal application need be secured to make it publicly accessible using a separate firewall/proxy (out of scope of this article), that part will be password-protected and SSL-encrypted.

Steps
  1. Copy certificates into /etc/ssl/certs/ivanlagunov.com
  2. Create symlink:
    3. cd /etc/httpd
sudo ln -s /etc/ssl/certs/ivanlagunov.com
  3. Install Apache mod_ssl
    4. sudo yum -y install mod_ssl
  4. Create file with user credentials for basic authentication
    5. sudo htpasswd -c /usr/local/apache/password/.htpasswd_application username
  5. Modify VirtualHost
    6. sudo vi /etc/httpd/conf.d/vhosts.conf
    The following are examples of virtual hosts: 
    <VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/httpd/ivanlagunov.com/Answer/ivanlagunov.com.crt
    SSLCertificateKeyFile /etc/httpd/ivanlagunov.com/Request/ivanlagunov.com.key
    SSLCertificateChainFile /etc/httpd/ivanlagunov.com/Answer/Linux/ivanlagunov.com.ca-bundle
    ServerName ivanlagunov.com

    # Password-protected part of the application is available under HTTPS
    <Location /application/protected_service>
        ProxyPass ajp://localhost:8009/application/protected_service

        AuthType Basic
        AuthName "Protected application"
        # By default, credentials are loaded from the file
        # There are smarter alternatives
        # As a default, the following directive can be omitted
        AuthBasicProvider file
        # Path to the file with user credentials
        AuthUserFile /usr/local/apache/password/.htpasswd_application
        # If Authorization header is not unset
        # Tomcat will return HTTP 401 Unauthorized
        RequestHeader unset "Authorization"
        # Require any valid user, can be limited to specific users
        Require valid-user
    </Location>
</VirtualHost>

<VirtualHost *:80>
    ServerName ivanlagunov.com

    # The whole application is available under HTTP
    ProxyPass /application ajp://localhost:8009/application
</VirtualHost>
  6. Restart Apache
    7. sudo service httpd restart

Results
As a result, the following URLs will be accessible without password:
  • http://ivanlagunov.com/application
  • http://ivanlagunov.com/application/protected_service
The following URL won't be accessible:
  • https://ivanlagunov.com/application
The following URL will be password-protected:
  • https://ivanlagunov.com/application/protected_service
Once again, only the last HTTPS URL is supposed to be made publicly accessible in this setup. HTTP URLs are supposed to be internal-only, hidden behind the firewall. That was an idea but the firewall configuration is out of scope of this article.
Labels:

Comments

Post a Comment

Popular posts from this blog

How to import an untrusted website certificate to the Java keystore

Java uses the keystore file named cacerts. It should already contain all trusted root CA certificates that are used to sign intermediate and leaf certificates. Leaf certificates are end user certificates that are used to secure websites with HTTPS. However, sometimes a root CA certificate might be missing from the Java keystore or a website might be using a self-signed certificate which will result in the following exception when you try to access the website from Java code: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target For me it happened with a certificate issued by COMODO. In this case the easiest solution is to add the website certificate to the Java keystore. Shortly, it requires exporting the certificate from the website, importing it into the keystore and restarting your Java application. Please b...
Post a Comment
Read more

Connection to Amazon Neptune endpoint from EKS during development

This small article will describe how to connect to Amazon Neptune database endpoint from your PC during development. Amazon Neptune is a fully managed graph database service from Amazon. Due to security reasons direct connections to Neptune are not allowed, so it's impossible to attach a public IP address or load balancer to that service. Instead access is restricted to the same VPC where Neptune is set up, so applications should be deployed in the same VPC to be able to access the database. That's a great idea for Production however it makes it very difficult to develop, debug and test applications locally. The instructions below will help you to create a tunnel towards Neptune endpoint considering you use Amazon EKS - a managed Kubernetes service from Amazon. As a side note, if you don't use EKS, the same idea of creating a tunnel can be implemented using a Bastion server . In Kubernetes we'll create a dedicated proxying pod. Prerequisites. Setting up a tunnel. ...
Post a Comment
Read more

Managing Content Security Policy (CSP) in IBM MAS Manage

This article explores a new system property introduced in IBM MAS 8.11.0 and Manage 8.7.0+ that enhances security but can inadvertently break Google Maps functionality within Manage. We'll delve into the root cause, provide a step-by-step solution, and offer best practices for managing Content Security Policy (CSP) effectively. Understanding the issue IBM MAS 8.11.0 and Manage 8.7.0 introduced the mxe.sec.header.Content_Security_Policy   property, implementing CSP to safeguard against injection attacks. While beneficial, its default configuration restricts external resources, causing Google Maps and fonts to malfunction. CSP dictates which domains can serve various content types (scripts, images, fonts) to a web page. The default value in this property blocks Google-related domains by default. Original value font-src 'self' data: https://1.www.s81c.com *.walkme.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ...
Post a Comment
Read more