SEVERE: Couldn't notify the webapp on https://.... HTTP 401 Unauthorized

[JustSong]

Tomcat: apache-tomcat-8.5.37.tar.gz
Opengrok: opengrok-1.1.2.tar.gz

Hi Sir,

There is an error message need your help.

We will face this error after we process index command.

14:21:47 SEVERE: Couldn't notify the webapp on https://opengrok.system.com/source.
javax.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized
        at org.glassfish.jersey.client.JerseyInvocation.convertToException(JerseyInvocation.java:1080)
        at org.glassfish.jersey.client.JerseyInvocation.translate(JerseyInvocation.java:883)
        at org.glassfish.jersey.client.JerseyInvocation.lambda$invoke$1(JerseyInvocation.java:767)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:316)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:298)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:229)
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:414)
        at org.glassfish.jersey.client.JerseyInvocation.invoke(JerseyInvocation.java:765)
        at org.glassfish.jersey.client.JerseyInvocation$Builder.method(JerseyInvocation.java:428)
        at org.glassfish.jersey.client.JerseyInvocation$Builder.get(JerseyInvocation.java:324)
        at org.opengrok.indexer.index.IndexerUtil.enableProjects(IndexerUtil.java:60)
        at org.opengrok.indexer.index.Indexer.main(Indexer.java:308)

Couldn't notify the webapp on https://opengrok.system.com/source: HTTP 401 Unauthorized.

I have set tomcat connect with LDAP Auth. Maybe this error was cause by this setting ?!

Thanks

[vladak]

More details are needed about the setup to tell for sure however in order to perform admin actions on the webapp via RESTful API it is necessary to send the request through trusted channel such as via localhost and plain HTTP. In OpenGrok there is no concept of special authorization to perform admin actions yet.

For example, let's say https://opengrok.system.com/source is the user facing site that requires authentication and authorization while the Tomcat also listens on say port 8080 on localhost only. Then the indexer has to be run with -U http://localhost:8080/source.

[vladak]

There is LocalhostFilter class that should enforce certain RESTful API requests to come from localhost only however I fail to see how exactly it comes into action.

[JustSong]

Tomcat: apache-tomcat-8.5.37.tar.gz
Opengrok: opengrok-1.1.2.tar.gz
Specail Work: Connect with LDAP auth

Hi @vladak ,

Thanks a lot for your help! I have changed https://opengrok.system.com/source to http://localhost:8080/source, but there is another error shown.

15:04:29 SEVERE: Couldn't notify the webapp on http://localhost:8080/source.
javax.ws.rs.ProcessingException: java.net.ConnectException: Connection refused (Connection refused)
        at org.glassfish.jersey.client.internal.HttpUrlConnector.apply(HttpUrlConnector.java:284)
        at org.glassfish.jersey.client.ClientRuntime.invoke(ClientRuntime.java:278)
        at org.glassfish.jersey.client.JerseyInvocation.lambda$invoke$1(JerseyInvocation.java:767)
.....

Is this issue cause by this server.xml setting ?

<Connector port="80" protocol="HTTP/1.1"
		   redirectPort="443"/>

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
		   maxThreads="150" scheme="https" secure="true"
		   clientAuth="false" sslProtocol="TLS"
		   sslEnabledProtocols="TLSv1.2"
		   connectionTimeout="20000"
		   keystoreFile="/var/lib/tomcat8/conf/opengrok.system.com.pfx"
		   keystoreType="PKCS12"
		   keystorePass="HU2Ue2Lq^zk^F6g*P"
		   compression="on"
		   compressableMimeType="text/html,text/xml,text/plain,text/css..."
		   />

[tulinkry]

':8080' this is expecting the oopengrok on port 8080, but if I understand it, you have it running on 80. so http://localhost/source might be the way

[JustSong]

Hi @tulinkry ,

Yes , I have already tested with the following setting but not work for me...

• -U http://localhost:80/source
  javax.ws.rs.RedirectionException: HTTP 302 Found

• -U http://localhost:443/source
  javax.ws.rs.BadRequestException: HTTP 400 Bad Request

• -U https://localhost:443/source
  javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.

[vladak]

ad 1) there seems to be redirect in place
ad 2) it seems that there is only HTTPS (TLS based HTTP) being served on port 443 so plain HTTP requests cannot go through
ad 3) the X.509 certificate presented by the server does not have localhost in the list of hostnames, therefore the client failed to verify the certificate and terminated the connection

Really, you need to setup a plain HTTP port in Tomcat configuration.

[vladak]

Obviously, we need to document this better in the wikis.

[tulinkry]

And can't we follow redirects for

-U http://localhost:80/source
javax.ws.rs.RedirectionException: HTTP 302 Found

?

I don't know if it would help.

[vladak]

It's a question where does the redirect lead to. My guess that it leads to a point which requires authorization and it would be back to square 1 :-)

[tulinkry]

I think it leads to

<Connector port="80" protocol="HTTP/1.1" redirectPort="443"/>

but that wouldn't solve anything when the certificate is incorrect.

[vladak]

Technically, the certificate is correct. No certificate should ever contain localhost or localhost addresses (https://security.stackexchange.com/questions/35033/what-are-the-risks-of-a-localhost-signed-cerificate#35035)

[vladak]

Make a dedicated port to listen for plain HTTP requests bound to localhost (https://serverfault.com/questions/218666/how-to-configure-tomcat-to-only-listen-to-127-0-0-1) and update the -U option used by the indexer accordingly (e.g. -U http://localhost:8080/source/)