Enable http header logging on glassfish 3.1

Hi,
On GF 3.1, to enable http header logging to server.log, I've tried setting the following JVM options:
-Dcom.sun.grizzly.enableSnoop=true
-Dcom.sun.enterprise.web.connector.grizzly.enableSnoop=true
I have also tried modifying the domain.xml by adding snoop-enable=true attribute to the element:
<network-config><transports><transport name="tcp" enable-snoop="true"
But neither worked. Any help would be appreciated

oops, wrong version, try this instead:
asadmin set configs.config.server-config.network-config.transports.transport.tcp.enable-snoop=true
asadmin set configs.config.server-config.http-service.access-logging-enabled=true

Similar Messages

Custom Inserted HTTP Header not showing up in Iplanet Logs

ALL:
I have some iPlanet Enterprise/6.0 web servers sitting behind a LoadBalancer. The LoadBalancer is setup in an 'one-armed mode', and takes a client HTTP request passes it onto the server, but during this process, changes the client source IP to that of local static IP that the LoadBalancer has. Due to our setup we cannot change this.
By changing the client source IP to a local address, we have lost any useful user session tracking that was done by source IP.
To get around this, I have the LoadBalancer inserting an HTTP header with the client real source IP. Reading the NSAPI Programmer's Guide (Table 7-1 "http://docs.sun.com/source/816-5686-10/07_magnu.htm"), there is an option "%Req->headers.headername%" that can be used with 'flex-int' to log any header value.
My output from snoop looks as follows:
HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: GET /plugin.do HTTP/1.1
HTTP: OrigClientAddr:10.5.4.28
HTTP: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
HTTP: Accept-Language: en-us
HTTP: Accept-Encoding: gzip, deflate
HTTP: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP:
I have set the value to "%Req->headers.OrigClientAddr%" and it still does not show up in the log file. Any clues?
Works fine in Apache with:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{OrigClientAddr}i\" \"%{User-Agent}i\"" headerinsert
CustomLog logs/access_log headerinsert

Always nice to find resolution to one's own question.
Fix was to change the header value to all lower case.
From:
"%Req->headers.OrigClientAddr%"
To:
"%Req->headers.origclientaddr%"

Log specific http header

Hi,
We have a "RedLine Networks T | X 2600 Real Time Accelerator", between the Clients and our frontends.
As expected the IP that gets logged in the frontends is the "T|X 2600" IP, and not the client ip.
In the request from the "T|X 2600" we have an http header in which we have the Client IP.
Is it possible to "log" the contents of this header?
we're using Sun Java(tm) System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005)
thx,
Goncalo Garcia

As it may help others, I answer what I figured out.
Every details of the http request is put into the m_binder.
So a specific field can be accessed with m_binder.getEnvironmentValue("My_data")
You can also list all the available data as it is a standard properties set.

OSB Http Transport Custom Authenticatiion (X509 in Http header)

Hello!
I'm trying to solve this case. We have F5 Load balancer that terminates SSL Connections From client to the OSB. When terminating the SSL, the LB adds the clients certificate into headers of the Http request going to OSB.
OSb proxy service is configured to use custom authentication with token type X509 (only choice in the OSB console).
What happens when I send the request to OSB, is that I get http code 401 (unauthorized) this error on server log:
####<Sep 27, 2011 3:08:05 PM EEST> <Error> <WliSbTransports> <appserver02> <MANSERV02> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <> <1317125285598> <BEA-381327> <Transport-level custom token identity assertion failed
java.lang.ClassCastException: java.lang.String cannot be cast to [Ljava.security.cert.X509Certificate;
The HTTP header sent to OSB is in the messages below.
It has also been wihotu the BEGIN CERTIFICATE and END CERTIFICATE lines with same results.
Can somebody help me in:
a) Should the certificate be sent in what form from LB to OSB.
b) How should the OSB/WLS be configured for this to work?
OSB version is 10.3.1.
Request to the server is:
POST /prjTemplateService/ProxyServices/psvcHelloWolrdWSSSLInterface HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "urn:#HelloWorldOperation"
User-Agent: Jakarta Commons-HttpClient/3.1
Host: <ip_here>
Content-Length: 459
SSLClientCertStatus: ok
SSLClientCertb64: -----BEGIN CERTIFICATE-----
MIICHDCCAYUCBE2sABcwDQYJKoZIhvcNAQEEBQAwVTELMAkGA1UEBhMCRkkxCzAJ
BgNVBAgTAkZJMQ4wDAYDVQQHEwVFc3BvbzEMMAoGA1UEChMDRVpaMQswCQYDVQQL
EwJUQzEOMAwGA1UEAxMFSnVzc2kwHhcNMTEwNDE4MDkxMDQ3WhcNMTEwNzI3MDkx
MDQ3WjBVMQswCQYDVQQGEwJGSTELMAkGA1UECBMCRkkxDjAMBgNVBAcTBUVzcG9v
MQwwCgYDVQQKEwNFWloxCzAJBgNVBAsTAlRDMQ4wDAYDVQQDEwVKdXNzaTCBnzAN
BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvEPjEn3tvG3YuXlsLZnE7ZOKUJIF0Foy
c1hp+k7dyGUoHu3Phva7eVOO1cmHaGkFHkg+EnnK3+/Y58EMQAEwPOfQTj0/vSSk
cEx2X/2p2W7ACldJlYMxx2ZdFa1qaKTXtoieLy23/kJI+ZTfIoB+nmZiPRE9Hq8p
LTPlcMWVFnkCAwEAATANBgkqhkiG9w0BAQQFAAOBgQC3EZMQieOy4PFh+95R6W7/
3xaaRm/BzmEU/Wf9JweEwrnttdSmRKsxx9vSkADnD0J7jGO+koym5CWvJHbox4Sk
QMRPFaTOBRD4hzZeJMidds1LSzUm/QE9PXzjS/HLSjBBs5DmZfdR+uXPSFqTROkd
87R5veuPX5KeKQHs8iesTw==
-----END CERTIFICATE-----
SSLClientCertSN: 4d:ac:00:17
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:Hello:client">
<soapenv:Body>
<urn:HelloWorldRequest>
<urn:FirstName>Jolly</urn:FirstName>
<urn:Surname>Roger</urn:Surname>
</urn:HelloWorldRequest>
</soapenv:Body>
</soapenv:Envelope>
Response from OSB:
HTTP/1.1 401 Unauthorized
Connection: close
Date: Fri, 30 Sep 2011 08:32:33 GMT
Content-Length: 1518
Content-Type: text/html
X-Powered-By: Servlet/2.5 JSP/2.1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Draft//EN">
<HTML>
<HEAD>
<TITLE>Error 401--Unauthorized</TITLE>
<META NAME="GENERATOR" CONTENT="WebLogic Server">
</HEAD>
<BODY bgcolor="white">
<FONT FACE=Helvetica><BR CLEAR=all>
<TABLE border=0 cellspacing=5><TR><TD><BR CLEAR=all>
<FONT FACE="Helvetica" COLOR="black" SIZE="3"><H2>Error 401--Unauthorized</H2>
</FONT></TD></TR>
</TABLE>
<TABLE border=0 width=100% cellpadding=10><TR><TD VALIGN=top WIDTH=100% BGCOLOR=white><FONT FACE="Courier New"><FONT FACE="Helvetica" SIZE="3"><H3>From RFC 2068 <i>Hypertext Transfer Protocol -- HTTP/1.1</i>:</H3>
</FONT><FONT FACE="Helvetica" SIZE="3"><H4>10.4.2 401 Unauthorized</H4>
</FONT><P><FONT FACE="Courier New">The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.46) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity MAY include relevant diagnostic information. HTTP access authentication is explained in section 11.</FONT></P>
</FONT></TD></TR>
</TABLE>
</BODY>
</HTML>

>
by using Client Cert authentication I have to set HTTPS required to true.
>
Yes.
>
When I try to invoke this service with http request, it redirects to https service.
This actually just trashes the entire idea of terminating SSL in the load balancer.
>
Not necessarily. Although direct HTTP request to WebLogic is redirected to HTTPS enabled port, you can still use this settings with WebLogic plugin. I'm not aware of your deployment, but I use Apache plugin for WebLogic, terminate SSL on Apache and I'm still able to send requests authenticated by certificate from client through HTTPS.
I don't know about F5, but I guess there should be similar feature as well.
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/cluster/load_balancing.html

Errors with Resource Adapter with data source as "http header"

hi Team,
The objective was to create a ResourceAdapter that will get accountid from http-header and automatically log me in. More like Siteminder, Tivoli Access Mgr.
In the adapter's "prototype.xml", I added this line.
"<AuthnProperty name='sauid' displayName='UserID in From Browser' formFieldType='text' isId='true' dataSource='http header'/>
I enable pass-through authn for "user-interface" app.
My test passes, when I login to "/idm/user". I am not prompted for uid/pwd instead I am
transparently logged and presented with self-service page, aka single-sign-on. so far so good.
But, I have an issue when when I login to /idm (not /idm/user) as configurator and then try to create a new user.....I donot see the set password fields in modify.jsp. This issue is only apparent if I set enable pass-through for user-interface. If I reset the user interface to default, which is userid/pwd, then I do see set-password-fields in modify.jsp.
Any leads on why this could be happening?

Hi Asam,
If we want to create a parameter depend on another dataset, we can additional create or add the dataset, embedded or shared, that has a query that contains query variables. Then use the option that “Get values from a
query” to get available values. For more details, please see:http://msdn.microsoft.com/en-us/library/dd283107.aspx
http://msdn.microsoft.com/en-us/library/dd220464.aspx
As to the Report Builder features, we can refer to the following articles:http://technet.microsoft.com/en-us/library/hh213578.aspx
http://technet.microsoft.com/en-us/library/hh965699.aspx
Hope this helps.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

SSO to other apps via HTTP header variable

We are on NW EP6.0 SP16. We need to add the "user id" as http header variable so that other apps which are non SAP can access our header variable and log on with that user id. Is this available by default? Or we want to achieve this how best we can achieve this.
We can use the code to get the user id and add it to header variable. If we use this route which is the jsp page we need to add the code?
Thanks

Hi,
we can you login modules provided by SAP to accomplish this.. you can use header variable authentication login module to acheive your requirement.
please refer: http://help.sap.com/saphelp_nw04/helpdata/en/8f/ae29411ab3db2be10000000a1550b0/frameset.htm
Hope that helps.
Regards,
S.Divakar

Single-Sign-On (SSO) configuration on JAVA Stack through HTTP Header method

Hello SDN community,
in the context of a Proof of Concept, we are testing the integration of Microsoft Sharepoint Portal with SAP Backend (addin) systems.
As the architecture impose use an external scenario (access from the internet), we couldn't use the Kerberos (SPNego) solution and thus we chosed the http header solution which in short uses an intermediary web server (in this case the IIS of the MOSS solution) which will act as authority.
I miss information on how the workflow works for this http header authentication method. Through the visual administrator of the addin JAVA stack, it is possible to configure each application with a customized authentication (a choice of security modules). But this all that I know.
My task is to configure SSO. From a sharepoint portal, the user should be able to access Web Dynpros and BSPs. I imagine that the very first call to a webdynpro or bsp (or maybe when we log on the sharepoint portal), the request to the WDP or BSP will first be forwareded by the intermediary server to the JAVA stack (or is it the SAP dispatcher that has to be configured).
Is there an application to be built on the java stack to deal with the authentication, modify http header?
What will the Java stack return? a sap long ticket? a token?
How will the redirect work (to by example a BSP which is in the ABAP stack)?
SAP preconise to secure with SSL the link between the intermediary web server and the JAVA stack, is IP restriction also a solution?
A lot of questions about how this SSO http header should work,
I would be very greatful for any help, or info,
Kind regards,
Tanguy Mezzano

Hi Tanguy,
to tell you the truth I'm really unsure about what you are trying to achieve. When I started posting to your thread I thought all you wanted was trying to access your J2EE engine via Browser and authenticate against the engine using HTTP Header Variables. Nevermind:
Here are some answers to your question:
in fact I did succeed, the problem was that even after domain-relaxation done by the J2EE, I had to change the domain of th SAP cookie to the bbbb.domain.com to be understood (I would have thought that all hosts in/under domain .domain would have accepted such a cookie but it seems that no...).
The server does not care about the domain because Cookies in an HTTP Request do not contain any domain information. The domain is just important when the Cookie is set by the server so your Client (Browser) will know in which cases the Cookie may be sent or not. So if your domain is xxx.yyy.domain.com and your cookie is issued to .domain.com then your Browser will definitely sent it to all hosts under .domain.com (This includes xxx.yyy.domain.com etc.)
My current scenario is: in a first request get a SAP Logon Ticket from the Java Stack, then change its domain and then directly call the backend with it.
You can do that but there is no Client involved in this scenario. So this is useful if you just want to test the functionality (e.g. authentication to J2EE using Header Variables (This works finally!!!) and then use the fetched Logon Ticket to test SSO against any trusted Backend!!)
So everything's is in a Java Client application without using any redirection.
If I understand you, you're solution is from the Browser call a servlet (which is deployed on the Java Stack and has no authentication schema) by passing to it our http header.
No, you should initially authenticate somewhere! I thought that maybe you had some resource you access before accessing the Java Stack. This could be any application (e.g. deployed on a Tomcat or JBOSS or other server or if you like even SAP J2EE). After authenticating there you are aware of the username and could use it to procceed (e.g. Authenticate against the J2EE using the same user and HTTP Header authentication for that particular user!)
That servlet will transfer the http header (with the HttpClient app) in order to get from the Java Stack a SAP Logon ticket, and then to redirect to the resource and by sending back the cookie in client browser. Am I correct?
This was just a suggestion because I realized that there was no Client ever involved in any of your testing (looked strange to me!). I was just thinking that it would be easier for you to just get the Cookie into your Browser so your Browser would do the rest for you (in your case finally send the Logon Ticket Cookie to your Backend to test SSO using Logon Tickets!).
The AuthenticatorServlet somehow serves as a Proxy to your client because your client is not able to set the Header Variable. That's why I initially suggested to use a Proxy (e.g. Apache) for that purpose. The problem is just that if you use a Proxy you will have to tell it somehow which username it should set in the Header Variable (e.g. using a URL Parameter or using a personalized client certificate and fetch the username (e.g. cn=<username> from the certificate!)
This way of doing would simplify the calls for sso for each new application needing authentication, instead of having all code each time in it...
I'm stuck again! Do you want to authenticate an End User or do you want to authenticate an application that needs to call any resources in your Backend that requires authentication?
So my problem now, is how to call the servlet from the client browser:
I'm trying to call my servlet from the browser but I don't succeed. I am able to understand how to reach a jsp from the Java Stack, but not to reach a servlet. I don't find the path to my servlet:
<FORM method="POST" action="SSORedirect2" >
A JSP is a servlet too. There is just no JAVA Class involved!
You do not need any POST Request to invoke a Servlet.
I see that my servlet is deployed, but I don't how what path to give to my form to invoke the servlet, here follows my web.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE web-app (View Source for full doctype...)>
- <web-app>
<display-name>WEB APP</display-name>
<description>WEB APP description</description>
- <servlet>
<servlet-name>SSOredirect2</servlet-name>
<servlet-class>com.atosorigin.examples.AuthenticatorServlet</servlet-class>
</servlet>
- <servlet>
<servlet-name>SSORedirect2.jsp</servlet-name>
<jsp-file>/SSORedirect2.jsp</jsp-file>
</servlet>
- <security-constraint>
<display-name>SecurityConstraint</display-name>
- <web-resource-collection>
<web-resource-name>WebResource</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
- <auth-constraint>
<role-name>DefaultSecurityRole</role-name>
</auth-constraint>
</security-constraint>
- <security-role>
<role-name>DefaultSecurityRole</role-name>
</security-role>
</web-app>
If you have an AuthenticatorServlet Class all you need is to add the Servlet Mapping in your web.xml file
e.g.
<servlet>
<description>
</description>
<display-name>AuthenticatorServlet</display-name>
<servlet-name>AuthenticatorServlet</servlet-name>
<servlet-class>com.atosorigin.examples.AuthenticatorServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>AuthenticatorServlet</servlet-name>
<url-pattern>/AuthenticatorServlet</url-pattern>
</servlet-mapping>
You can directly call the Servlet in your Browser by calling the URL provided in the url-pattern of your Servlet mapping ( in this case /AuthenticatorServlet). The engine will invoke the Class "com.atosorigin.examples.AuthenticatorServlet" in the background and do whatever you defined there!
I have also to pass my http header and the redirectUrl in the GET request.
If you like! I just suggested this for testing purposes. As I stated before you need a way to tell your proxy (or in your case AuthenticatorServlet) which user should be set when calling the Engine in order to authenticate using HTTP Header. You could use the URL Paramater to define the user you actually want to use when you set the Header Variable.
I just introduced the redirectURL because you were talking about redirects all the time. So if you finally want to call the Backend you could define the Backend URL in the redirectURL Parameter and the Servlet will make sure that you are redirected to this location after the whole process!
Thx for your input very helpful,
But again 0 points
Cheers

Error in setting up HTTP Header Variable Authentication

Hi,
I am trying to set-up SSO for SAP Biller Direct aplication (deployed on SAP J2EE 7.0) using HTTP Header variable authentication.
As per SAP documentation I have created a new login module "HeaderVariableLoginModule" pointing to class "com.sap.security.core.server.jaas.HeaderVariableLoginModule".
Then I have added this new login module to Statck "Ticket" and the new config looks as below. HTTP header when UID is passed is USI_LOP.
Name                                                                                Flag                                            Options
com.sap.security.core.server.jaas.HeaderVariableLoginModule    Sufficient                                    ume.configuration.active= tue,
                                                                                Header=USI_LOP
BasicPasswordLoginModule                                                           Optional
CreateTicketLoginModule                                                                 Optional                                         ume.configuration.active= tue
EvaluateTicketLoginModule                                                              Sufficient                                      ume.configuration.active= tue
The problem I am now having is that the authentication through HTTP_HEADEr does not work. Even though I ahve increased the trace level for JAAS module to debug, there is not any type of information generated in the log.
Each time I call the Biller Direct URL from the extrenal web server which also passes the HEADER variable for Authntication, the authrisation just fails and I am being shown a Logon Screen to pust UID/PASSWORD.
Can someone please guide me, how I can debug this? There is very no information whether anyone tried to login with HEADER varibale and that has failed...
Also, I am not pretty sure whether I am using the right Authentication Stack, which is is Ticket in my case..
But when I enter the application without any URL redirects and enter UID and password directly for Biller Direct, I get the following in log file, which makes me believe that I am using the right stack.
LOGIN.OK
User: CONDLG
Authentication Stack: ticket
Login Module                                                               Flag        Initialize Login      Commit     Abort      Details
1. com.sap.security.core.server.jaas.HeaderVariableLoginModule             SUFFICIENT ok          false      false
2. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   OPTIONAL    ok          true       true
3. com.sap.security.core.server.jaas.CreateTicketLoginModule               OPTIONAL    ok          true       true
4. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT ok          false      false
Central Checks                                                                                true
Any help will be very much apprecated..
Thanks,
Vikrant Sud

Vikrant,
The reason why it is not working is because your login modules in ticket stack are in wrong order and with wrong flags. The first one should be EvaluateTicketLoginModule with flag=SUFFICIENT, then the Header Variable login module, with flag=OPTIONAL, then CreateTicketLoginModule with flag=SUFFICIENT, then BasicPasswordLoginModule with flag=REQUISITE, and lastly CreateTicektLoginModule with flag=OPTIONAL
Thanks,
Tim

OIF11g - Help on sending user attributes in HTTP header

Hello, I have a OIF11g setup configured for both IdP and SP. Upon successfull authentication against LDAP, I need to end some user attributes on the HTTP header to the SP application. I do no have OAM in my setup, so there is no option of Webgate or Policy Manager to do that. As far as I read the config doc, I'm in the impression that we need to write a custom authentication engine to accept user credentials and code to authenticate against LDAP and also add attributes to the response header.
Before I go down that path, just wanted to confirm if anybody has done this with OIF?
Thanks,
Sunil.

Bernhard:
Actually the headers are not set to null. I have an intermediate index.jsp page which is the first page that is redirected to by the AM - it is this page which calls my LoginServlet.
The value appears consistently on this index.jsp page but after it is forwarded to the LoginServlet it starts behaving inconsistently. I check the system.out log in my websphere /logs folder and that tells me that LoginServlet does not consistenly get these values from the header.
The wierd part is that if I use cookies or attributes, it works perfectly - each time every time. However, only in the case of headers (which is the method i am required to do) it behaves inconsistently.
ANY feedback/help on this would be really appreciated bern.. thanks..
~saahil

External Web Service - User and password in HTTP header

Hi!
How is it possible to add user and password in the HTTP header in a external web service call?
I have created a "Portal Service from WSDL file - Client side" with the wizard in SAP Developer Studio. I following the Java Development Guide - Web Service Security, and use the <i>secured service connection</i>. I have also created a new <i>System Landscape</i>, but should the new system be based on HTTP, my own PAR or what?
How can I check that the user and password is added to the HTTP header or the SOAP envelope? Do I have to scan http traffic with a proxy as Paros or can I find the request sent from SAP EP in the logs?
Cheers
Asle

Hello All,
I have been struggling a bit while putting a reasonable security framework on a jax-rpc style web service. I'm using JWSDP1.2 to set up the webservice. I've tried to outline my problem below. Please correct me where I'm wrong.
I've been through the Sun's WS tutorials, but they are not really clear on security. However, from them I surmised that there are two decent authentication techniques. HTTP Basic and mutual authentication (MA) . Both have their drawbacks though. HTTP Basic suffers from poor encryption while MA is a bit difficult to set up on both client and server sides. Another problem with MA is that there is no central repository for users/passwords.
OK, what I would really like to do is use my own user database to verify users/passwords i.e. use a HTTP Basic like authentication (but at application level) but run it over SSL for encryption. It seems simple, but is it possible?
Also, I have noted that when I use HTTP Basic on the service side, and use a java client, then setting username/password has no effect. In other words, I can always access the web-service, even with wrong username/password.
Sorry for the long post. Hope someone can help. Thanks.

No "Remote-User" in HTTP header when HTTP request gets to WLS

Hello Exprers,
I have a customer, using 10.3.3 on Linux machine. Web server as Apache.
He wants Remote-User in HTTP header, he used to get it when he used Tomcat. But when he transffered to Apache and 10.3.3, he is not getting the Remote-User in header, instead he is getting proxy-remote-user.
He wants the Remote-user in HTTP header.
Any clue, on why he is not getting it.

Hi,
We are facing error while doing openConnection
When I tried with simple java file it worked as shown below
import java.io.*;
import javax.net.ssl.HttpsURLConnection;
public class test
public static void main(String[] args) throws Exception
String httpsURL = "https://rcfe.aspac.citicorp.com:40054/servlet/Verify";
URL myurl = new URL(httpsURL);
HttpsURLConnection con = (HttpsURLConnection)myurl.openConnection();
InputStream ins = con.getInputStream();
InputStreamReader isr = new InputStreamReader(ins);
BufferedReader in = new BufferedReader(isr);
if (con!=null)
System.out.println("con="+con);
System.out.println(ins);
Output*
[rcrrgbg2@kauh0079:/rcrmap2/weblogic/bea/ORA_PFRD/forms/j2ee] java test
con=com.ibm.net.ssl.www2.protocol.https.e:https://rcfe.aspac.citicorp.com:40054/servlet/Verify
sun.net.www.protocol.http.HttpURLConnection$HttpInputStream@5f6c5f6c
However when I tried with below program I am able to write upto Web CL URL but after that no log is written when it tries to do openConnection() for this line csConn=(HttpsURLConnection)new URL(webclURL).openConnection(); in the below code
Some part of the code:_
=======================================================================
import java.io.*;
import javax.servlet.http.*;
import javax.servlet.*;
import java.util.Hashtable;
import java.io.File;
import java.io.FileInputStream;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.net.ssl.HttpsURLConnection;
import java.net.URL;
public class CRMSLogin extends HttpServlet
private static final long serialVersionUID=-6294676216324813290L;
public void doPost(HttpServletRequest request,HttpServletResponse response) throws ServletException,IOException
String iniFile=request.getParameter("CRMS_INI_FILE_PATH");
String sessionId=request.getParameter("SessionId");
String applId=request.getParameter("apl_id");
String userId=request.getParameter("userId");
String clientIp=request.getRemoteAddr();
Properties iniProp=this.getProperties(iniFile);
String crmsAppServerContext=iniProp.getProperty("CRMS_APP_SERVER_CONTEXT");
String appModule=iniProp.getProperty("CRMS_MODULE");
String webclURL=iniProp.getProperty("WEBCL_URL");
// HttpsURLConnection csConn=null;
String crmsFormsTerm=null;
crmsFormsTerm=getEntitlements(iniFile.trim(),sessionId,applId.trim(),clientIp.trim(),webclURL.trim());
String baseContent=this.getBaseContent(iniProp);
ServletOutputStream out=response.getOutputStream();
baseContent=baseContent.replaceAll("<!APP_TITLE!>","Credit Risk Management System");
baseContent=baseContent.replaceAll("<!APP_CONTEXT!>",crmsAppServerContext);
baseContent=baseContent.replaceAll("<!APP_MODULE!>",appModule);
baseContent=baseContent.replaceAll("<!APP_TRACE!>",crmsFormsTerm.replaceAll(" ", ""));
baseContent=baseContent.replaceAll("<!USER_ID!>",userId);
baseContent=baseContent.replaceAll("<!SESSION_ID!>",sessionId);
baseContent=baseContent.replaceAll("<!APPL_ID!>",applId.trim());
baseContent=baseContent.replaceAll("<!CLIENT_IP!>",clientIp.trim());
baseContent=baseContent.replaceAll("<!INI_FILE!>",iniFile.trim());
out.println(baseContent);
out.flush();
out.close();
private synchronized Properties getProperties(String inifile)
Properties iniProp=new Properties();
FileInputStream iniFileStream=null;
try
iniFileStream=new FileInputStream(inifile);
iniProp.load(iniFileStream);
iniFileStream.close();
catch(Exception e)
finally
try
if(iniFileStream!=null)
iniFileStream.close();
catch(Exception e)
return iniProp;
public static synchronized String getEntitlements(String inifile,String sessionId,String applId,String clientIp,String webclURL)
     HttpsURLConnection csConn=null;
     OutputStreamWriter requestStream=null;
     BufferedReader responseStream=null;
     StringBuffer responseData=new StringBuffer();
     String csReturnString=null;
     //String webclURL=null;
     BufferedWriter traceLog=null;
     int csCount=6;
     Properties iniProp=new Properties();
     String traceFile=null;
     String entitlementData=null;
     try
     readIniProperties(inifile,iniProp);
     traceFile=getTraceFile(iniProp);
     traceLog=new BufferedWriter(new FileWriter(traceFile,true));
     if(traceFile!=null)
     traceLog.write("###########################");
     traceLog.write("P A R A M E T E R S");
     traceLog.write("###########################");
     traceLog.newLine();
     traceLog.write("INI_FILE:"+inifile);
     traceLog.newLine();
     traceLog.write("SESSION_ID:"+sessionId);
     traceLog.newLine();
     traceLog.write("APPL_ID:"+applId);
     traceLog.newLine();
     traceLog.write("CLIENT_IP:"+clientIp);
     traceLog.newLine();
     traceLog.write("count:"+csCount);
     traceLog.newLine();
     traceLog.write("###########################");
     traceLog.newLine();
     //webclURL=getWebclURL(traceLog,iniProp);
     if(webclURL!=null)
     traceLog.write("Web CL URL:"+webclURL);
          traceLog.newLine();
     csConn=(HttpsURLConnection)new URL(webclURL).openConnection();
traceLog.write("Open Connection - Completed!");
     traceLog.newLine();
     csConn.setRequestMethod("POST");
     csConn.setDoInput(true);
     csConn.setDoOutput(true);
     requestStream=new OutputStreamWriter(csConn.getOutputStream());
     traceLog.write("Open Request Stream - Completed!");
     traceLog.newLine();
     requestStream.write("SessionId="+sessionId+"&ClientIP="+clientIp+"&apl_id="+applId+"&count="+csCount);
     requestStream.flush();
     requestStream.close();
     traceLog.write("Write Params to Request Stream - Completed!");
     traceLog.newLine();
     responseStream=new BufferedReader(new InputStreamReader(csConn.getInputStream()));
     traceLog.write("Open Response Stream - Completed!");
     traceLog.newLine();
     while((csReturnString=responseStream.readLine())!=null)
     responseData.append(csReturnString);
     traceLog.write("Response Stream Reading - Completed!");
     traceLog.newLine();
     responseStream.close();
     csConn.disconnect();
     entitlementData=getEntitlementData(traceLog,responseData.toString(),iniProp);
     traceLog.write("responseData::"+responseData);
     traceLog.newLine();
     traceLog.newLine();
     traceLog.write("entitlementData::"+entitlementData);
     traceLog.newLine();
     traceLog.flush();
     traceLog.close();
     catch(Exception e)
     e.printStackTrace();
     finally
     try
     if(requestStream!=null)
     requestStream.close();
=======================================================================
output_
###########################P A R A M E T E R S###########################
INI_FILE:/rcrmap1/rcrrgbg2/crms.ini
SESSION_ID:%2526%253ASIGNED_TICKET%253D%2526PROVIDER_TICKET%253D002c6e4cH0tZy2Gj4JBCOiSL7uSlKisfsqgwP9KoRRn7e%252BY%253D%253AKRSERVER0006%252BA9A52AAE%252B4D1DC7AA%252B14400
APPL_ID:RCRMKR
CLIENT_IP:169.165.42.174
count:6
Web CL URL:https://rcfe.aspac.citicorp.com:40054/servlet/Verify
Please help to guide us.
Regards,
Harish

Accept language in Http Header of Aqualogic portlet.

Hi, we have developed one web page using ASP.Net and hosted in the Aqualogic portlet server, when ever we access that page from different location/browser, we are getting "en-us" as accept language in the Http header variable of Request object, but it should change based on the location and browser.
Please let us know,do we have to modify any settings in the aqualogic portal?
Note: We are getting different accept language from the same code when hosted on the web server/local(Without Aqualogic).
Thanks in Advance.
Edited by: 993251 on Mar 12, 2013 11:08 PM

>
by using Client Cert authentication I have to set HTTPS required to true.
>
Yes.
>
When I try to invoke this service with http request, it redirects to https service.
This actually just trashes the entire idea of terminating SSL in the load balancer.
>
Not necessarily. Although direct HTTP request to WebLogic is redirected to HTTPS enabled port, you can still use this settings with WebLogic plugin. I'm not aware of your deployment, but I use Apache plugin for WebLogic, terminate SSL on Apache and I'm still able to send requests authenticated by certificate from client through HTTPS.
I don't know about F5, but I guess there should be similar feature as well.
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/cluster/load_balancing.html

Authorization tag in http header

While making an end point call using the webservice control the authorization tag is getting added to the http header. This is causing 401 errors when going over SSL . We are adding the credentials as part of the SOAP header.
Why / How is the Authorization Basic tag getting created? Also how can we eliminate it?
****************** tcpmon output shown below
POST /DMIntegration/ContentService HTTP/1.1
User-Agent: BEA WebLogic Server 10.3.0.0
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Authorization: Basic U334567dGFsVXNlcjpQb3J0YW1234==
Host: 10.157.44.155:7080
Accept: text/html, image/gif, image/jpeg, */*; q=.2
Connection: Keep-Alive
Content-Length: 1834
Thanks,
- Shankar

Hi,
The Authorization group can be created as follows
Transaction SE54 >Select 'Authorization Groups'>Create/Change-->New Entries.
Now the authorization group created can be assigned to your table.
Goto transaction 'SE56' and select authorization group radio button and create your authorization group.
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
USE
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented.check Su22 and SU24u will get list of objects
Hope clear to you.
Regards,
R.Brahmankar

How to deal with the "Set-Cookie" field in HTTP header??

I follow the RFC-2616 specification to write a socket program to fetch web pages.
I have to deal with all the fields included in the HTTP header.
But the RFC-2616 doesn't talk anything about the "Set-Cookie" field.
Does anyone know how to handle this field or provide me any useful documentation.
Any help is appreciated.

A cookie is set with the "Set-Cookie: "-field in the http header, like this:
Set-Cookie: mycookie=someValue
This cookie should only be returned to the same host as it came from, like this in the http header of a request:
Cookie: mycookie=someValue
If the parameter looks like this:
Set-Cookie: mycookie=someValue; path=/cgi-bin
, the cookie should only be returned to the host if the request path starts with /cgi-bin
If the parameter looks liek this:
Set-Cookie: mycookie=someValue; domain=.mydomain.com
, the cooke should be returned to all hosts in the .mydomain.com-domain
There is also a "expires="-field, which works as expected and a "secure"-field, which I'm not sure how to handle. Maybe the cookie should only be sent to an SSL-enabled host?
Hope this helps you. Bye,
Dag W.

BC Ecommerce SOAP Error: Server did not recognize the value of HTTP Header SOAPAction

I am trying to add a product to an ecommerce site with this soap action: Product_UpdateInsert
I have followed this very brief instruction: https://jollyrogers.worldsecuresystems.com/catalystwebservice/catalystecommercewebservice. asmx?op=Product_UpdateInsert
I have a html page in a secure area with a jQuery ajax soap script.
I get the this error when I run the script:
<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Client</faultcode><faultstring>Server did not recognize the value of HTTP Header SOAPAction: https://jollyrogers.worldsecuresystems.com/CatalystDeveloperService/CatalystEcommerceWebse rvice/Product_UpdateInsert.</faultstring><detail /></soap:Fault></soap:Body></soap:Envelope>
I have also tried to add a header with the Soap action with the beforeSend in the ajax call.
This must have been solved before I suppose?
Here is my script:
<!DOCTYPE html>
<html lang="en">
<head>
<title>Test SOAP Request</title>
    <script type="text/javascript" src="//code.jquery.com/jquery-1.10.2.min.js"></script>
    <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.3.1/jquery.cookie.min.js"></script>
    <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/underscore.js/1.5.1/underscore-min.js"></script>
    <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/backbone.js/1.0.0/backbone-min.js"></script>
    <script type="text/javascript" src="//cdn.worldsecuresystems.com/bcapi/bcapi-0.0.1.min.js"></script>
</head>
<body>
<script>
var wsUrl = "https://jollyrogers.worldsecuresystems.com/catalystwebservice/catalystecommercewebservice. asmx";
var soapRequest =
'<?xml version="1.0" encoding="utf-8"?> \
<soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope"> \
<soap12:Body> \
    <Product_UpdateInsert xmlns="https://jollyrogers.worldsecuresystems.com/CatalystDeveloperService/CatalystEcommerceWebse rvice"> \
      <username>myEmailAdress</username> \
      <password>mySecretPassw</password> \
      <siteId>1894001</siteId> \
      <productList> \
        <Products> \
          <productCode>ZJAWEyuuyN</productCode> \
          <productName>My test product</productName> \
          <description>Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</description> \
          <smallImage>/images/product1/small.jpg</smallImage> \
          <largeImage>/images/product1/large.jpg</largeImage> \
         <cataloguesArray> \
             <string>/Store/</string> \
          </cataloguesArray> \
          <pricesSaleArray> \
            <string>US/19.95,3/17.96,7/16.96</string> \
          </pricesSaleArray> \
          <pricesRetailArray> \
            <string>US/20,5/19,8/20</string> \
          </pricesRetailArray> \
          <pricesWholesaleArray> \
            <string>US/20,5/19,8/20</string> \
          </pricesWholesaleArray> \
          <wholesaleTaxCodeArray> \
            <string>US/0.00</string> \
          </wholesaleTaxCodeArray> \
          <taxCodeArray> \
            <string>GB/VAT</string> \
          </taxCodeArray> \
          <groupProducts> \
            <string>580H0036BL</string> \
            <string>ACAI60</string> \
            <string>ABC-123</string> \
          </groupProducts> \
          <groupProductsDescriptions> \
            <string>Lorem ipsum dolor sit amet</string> \
            <string>consectetur adipisicing elit</string> \
          </groupProductsDescriptions> \
          <supplierEntityId>1234</supplierEntityId> \
          <supplierCommission>0</supplierCommission> \
          <weight>30</weight> \
          <tags>NEW!</tags> \
          <unitType>string</unitType> \
          <minUnits>0</minUnits> \
          <maxUnits>2</maxUnits> \
          <inStock>43</inStock> \
          <onOrder>3</onOrder> \
          <reOrder>2</reOrder> \
          <inventoryControl>true</inventoryControl> \
          <canPreOrder>true</canPreOrder> \
          <custom1>Text in custom field 1</custom1> \
          <custom2>Text in custom field 2</custom2> \
          <custom3>Text in custom field 3</custom3> \
          <custom4>Text in custom field 4</custom4> \
          <popletImages>/images/image1.jpg;/images/image2.jpg;</popletImages> \
          <enabled>true</enabled> \
          <deleted>false</deleted> \
          <captureDetails>true</captureDetails> \
          <downloadLimitCount>20</downloadLimitCount> \
          <limitDownloadsToIP>0</limitDownloadsToIP> \
          <isOnSale>true</isOnSale> \
          <hideIfNoStock>true</hideIfNoStock> \
          <productAttributes>Size*|5|Y:L||UK/2|US/20,S||UK/1|US/10</productAttributes> \
          <isGiftVoucher>false</isGiftVoucher> \
          <enableDropShipping>true</enableDropShipping> \
          <productWeight>0</productWeight> \
          <productWidth>0</productWidth> \
          <productHeight>0</productHeight> \
          <productDepth>0</productDepth> \
          <excludeFromSearch>false</excludeFromSearch> \
          <productTitle>My product title</productTitle> \
          <cycletypeId>3</cycletypeId> \
          <cycletypeCount>-1</cycletypeCount> \
          <slug>my-product</slug> \
          <hasVariations>true</hasVariations> \
          <variations> \
            <ProductVariation xsi:nil="true" /> \
            <ProductVariation xsi:nil="true" /> \
          </variations> \
        </Products> \
      </productList> \
    </Product_UpdateInsert> \
</soap12:Body> \
</soap12:Envelope>';
$.ajax({
     type: "POST",
     beforeSend: function(xhr){xhr.setRequestHeader('SOAPAction', 'https://jollyrogers.worldsecuresystems.com/CatalystDeveloperService/CatalystEcommerceWebse rvice/Product_UpdateInsert');},
     url: wsUrl,
     contentType: "text/xml",
     dataType: "xml",
     data: soapRequest,
     success: processSuccess,
     error: processError
function processSuccess(data, status, req)
   if (status == "success")
   alert("Success!");
function processError(data, status, req)
   alert("Failed!");
   alert(req.responseText + " " + status);
</script>
</body>
</html>

This line is a target namespace so it should not be changed: <Product_Retrieve xmlns="http://tempuri.org/CatalystDeveloperService/CatalystEcommerceWebservice"> It is very easy to think that it's a placeholder and that it should be replaced with your own url, which it should not and which will fail.
This works now:
<!DOCTYPE html>
<html lang="en">
    <head>
        <title>Test 7 SOAP Request</title>
        <script type="text/javascript" src="//code.jquery.com/jquery-1.10.2.min.js"></script>
    </head>
    <body>
        <script>
            var SoapMessage = '<?xml version="1.0" encoding="utf-8"?> \
<soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope"> \
<soap12:Body> \
<Product_Retrieve xmlns="http://tempuri.org/CatalystDeveloperService/CatalystEcommerceWebservice"> \
<username>Your Email</username> \
<password>Your password</password> \
<siteId>1894001</siteId> \
<productCode>HHKDKXS5MB</productCode> \
            </Product_Retrieve> \
            </soap12:Body> \
            </soap12:Envelope>';
            var url = "https://jollyrogers.worldsecuresystems.com/catalystwebservice/catalystecommercewebservice. asmx";
            $.support.cors = true;
            $.ajax({
                type: "POST",
                url: url,
                data: SoapMessage,
                dataType: "xml",
                processData: true,
                contentType: "text/xml; charset=\"utf-8\"",
                success: function (msg) {
                    alert("suc: " + msg);
                error: function (msg) {
                    alert("Failed: " + msg);
        </script>
    </body>
</html>

Enable http header logging on glassfish 3.1

Similar Messages

Maybe you are looking for