Adjusting security-constraints without disturbing active users

Hi Aaron,

From what I read, it doesn't seem to be possible with Tomcat. E.g. see:

<a href="http://stackoverflow.com/questions/5401791/want-to-reload-the-web-xml-without-restarting-the-server" target="_blank" rel="nofollow" onmousedown="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fstackoverflow.com%2Fquestions%2F5401791%2Fwant-to-reload-the-web-xml-without-restarting-the-server\46sa\75D\46sntz\0751\46usg\75AFQjCNHVjw1e8xxbR4KMikOmlbtq-O5NLg&#39;;return true;" onclick="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fstackoverflow.com%2Fquestions%2F5401791%2Fwant-to-reload-the-web-xml-without-restarting-the-server\46sa\75D\46sntz\0751\46usg\75AFQjCNHVjw1e8xxbR4KMikOmlbtq-O5NLg&#39;;return true;">http://stackoverflow.com/questions/5401791/want-to-reload-the-web-xml-without-restarting-the-server

But an alternative might be to apply the security constraints in a filter instead of relying what is provided by the web.xml. I am not sure if UrlRewriteFilter can do this (<a href="http://tuckey.org/urlrewrite/" target="_blank" rel="nofollow" onmousedown="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Ftuckey.org%2Furlrewrite%2F\46sa\75D\46sntz\0751\46usg\75AFQjCNHVpetZRJFuFEfCx6kdOwUi3lry6w&#39;;return true;" onclick="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Ftuckey.org%2Furlrewrite%2F\46sa\75D\46sntz\0751\46usg\75AFQjCNHVpetZRJFuFEfCx6kdOwUi3lry6w&#39;;return true;">http://tuckey.org/urlrewrite/), and better option might be to use Spring Security (<a href="http://projects.spring.io/spring-security/" target="_blank" rel="nofollow" onmousedown="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fprojects.spring.io%2Fspring-security%2F\46sa\75D\46sntz\0751\46usg\75AFQjCNEeN6_gNrp8eqigZKDjhwULJbTlAw&#39;;return true;" onclick="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fprojects.spring.io%2Fspring-security%2F\46sa\75D\46sntz\0751\46usg\75AFQjCNEeN6_gNrp8eqigZKDjhwULJbTlAw&#39;;return true;">http://projects.spring.io/spring-security/).

If you get to try one of those options, you'll let us know how it works.

Alex

On Tue, Oct 6, 2015 at 1:41 PM Aaron Spike <<a href="javascript:" target="_blank" gdf-obfuscated-mailto="rR_z6fXOCQAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">spi...@...> wrote:

We have a number of forms for which we allow public access to the form new page to create a submission without logging in. Currently we do this by adding the form new url for appropriate forms to a security-constraint in the web.xml file as follows:

    <security-constraint>

        <web-resource-collection>

            <web-resource-name>Form Runner services and public pages and resources</web-resource-name>

            <url-pattern>/fr/service/*</url-pattern>

            <url-pattern>/fr/style/*</url-pattern>

            <url-pattern>/fr/not-found</url-pattern>

            <url-pattern>/fr/unauthorized</url-pattern>

            <url-pattern>/fr/error</url-pattern>

            <url-pattern>/fr/login</url-pattern>

            <url-pattern>/fr/login-error</url-pattern>

            <!-- Place url-patterns matching public form new pages here -->

            <url-pattern>/fr/AppName/FormName1/new</url-pattern>

...

            <url-pattern>/fr/AppName/FormNameN/new</url-pattern>

        </web-resource-collection>

    </security-constraint>

As far as I know these changes don't take effect until tomcat is restarted. If a person is currently filling out a form when tomcat restarts, I'm afraid that they will lose the data they have entered. As we add more forms and forms are submitted more often, it gets more difficult to find a good time to restart tomcat.

Is there any way that I can cause tomcat to acknowledge the changes to web.xml without causing trouble for those people currently using the application? Perhaps there is a better way for me to set up tomcat.

Aaron Spike

This electronic communication, including any attached documents, may contain confidential and/or legally privileged information that is intended only for use by the recipient(s) named above. If you have received this communication in error, please notify the sender immediately and delete the communication and any attachments. Views expressed by the author do not necessarily represent those of Martin Luther College.

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to <a href="javascript:" target="_blank" gdf-obfuscated-mailto="rR_z6fXOCQAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">orbeon+un...@googlegroups.com.
To post to this group, send email to <a href="javascript:" target="_blank" gdf-obfuscated-mailto="rR_z6fXOCQAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">orb...@....

Hi Aaron,

Reading Tomcat's documentation made me think of this post of yours from last
month. I've never used this feature myself, but Tomcat supports having
multiple version of the same app deployed, and "routing" new users to the
latest version, while keeping existing users with the version they started
with.

The way I understand it, this should allow you to do what you were looking
for, by deploying a new version of Orbeon Forms with your updated web.xml,
which will impact new users and not touch existing users.

<a href="https://tomcat.apache.org/tomcat-7.0-doc/config/context.html" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\75https%3A%2F%2Ftomcat.apache.org%2Ftomcat-7.0-doc%2Fconfig%2Fcontext.html\46sa\75D\46sntz\0751\46usg\75AFQjCNHMFU9-uqOo8mIbZbNvIN_asplWuw&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\75https%3A%2F%2Ftomcat.apache.org%2Ftomcat-7.0-doc%2Fconfig%2Fcontext.html\46sa\75D\46sntz\0751\46usg\75AFQjCNHMFU9-uqOo8mIbZbNvIN_asplWuw&#39;;return true;">https://tomcat.apache.org/tomcat-7.0-doc/config/context.html

You'll let us know how it works out if you get to play with this.

Alex

-----
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet
--
View this message in context: <a href="http://discuss.orbeon.com/Adjusting-security-constraints-without-disturbing-active-users-tp4660620p4660769.html" target="_blank" rel="nofollow" onmousedown="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fdiscuss.orbeon.com%2FAdjusting-security-constraints-without-disturbing-active-users-tp4660620p4660769.html\46sa\75D\46sntz\0751\46usg\75AFQjCNGALBU1hRX5pPhbRLPxvNa00CzRkg&#39;;return true;" onclick="this.href=&#39;http://www.google.com/url?q\75http%3A%2F%2Fdiscuss.orbeon.com%2FAdjusting-security-constraints-without-disturbing-active-users-tp4660620p4660769.html\46sa\75D\46sntz\0751\46usg\75AFQjCNGALBU1hRX5pPhbRLPxvNa00CzRkg&#39;;return true;">http://discuss.orbeon.com/Adjusting-security-constraints-without-disturbing-active-users-tp4660620p4660769.html
Sent from the Orbeon Forms community mailing list mailing list archive at Nabble.com.