| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1 | <html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 Configuration Reference (7.0.77) - The Valve Component</title><meta name="author" content="Craig R. McClanahan"><style type="text/css" media="print">
|
| 2 | .noPrint {display: none;}
|
| 3 | td#mainBody {width: 100%;}
|
| 4 | </style><style type="text/css">
|
| 5 | code {background-color:rgb(224,255,255);padding:0 0.1em;}
|
| 6 | code.attributeName, code.propertyName {background-color:transparent;}
|
| 7 |
|
| 8 |
|
| 9 | table {
|
| 10 | border-collapse: collapse;
|
| 11 | text-align: left;
|
| 12 | }
|
| 13 | table *:not(table) {
|
| 14 | /* Prevent border-collapsing for table child elements like <div> */
|
| 15 | border-collapse: separate;
|
| 16 | }
|
| 17 |
|
| 18 | th {
|
| 19 | text-align: left;
|
| 20 | }
|
| 21 |
|
| 22 |
|
| 23 | div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code {
|
| 24 | background-color: transparent;
|
| 25 | }
|
| 26 | div.codeBox {
|
| 27 | overflow: auto;
|
| 28 | margin: 1em 0;
|
| 29 | }
|
| 30 | div.codeBox pre {
|
| 31 | margin: 0;
|
| 32 | padding: 4px;
|
| 33 | border: 1px solid #999;
|
| 34 | border-radius: 5px;
|
| 35 | background-color: #eff8ff;
|
| 36 | display: table; /* To prevent <pre>s from taking the complete available width. */
|
| 37 | /*
|
| 38 | When it is officially supported, use the following CSS instead of display: table
|
| 39 | to prevent big <pre>s from exceeding the browser window:
|
| 40 | max-width: available;
|
| 41 | width: min-content;
|
| 42 | */
|
| 43 | }
|
| 44 |
|
| 45 | div.codeBox pre.wrap {
|
| 46 | white-space: pre-wrap;
|
| 47 | }
|
| 48 |
|
| 49 |
|
| 50 | table.defaultTable tr, table.detail-table tr {
|
| 51 | border: 1px solid #CCC;
|
| 52 | }
|
| 53 |
|
| 54 | table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
|
| 55 | background-color: #FAFBFF;
|
| 56 | }
|
| 57 |
|
| 58 | table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
|
| 59 | background-color: #EEEFFF;
|
| 60 | }
|
| 61 |
|
| 62 | table.defaultTable th, table.detail-table th {
|
| 63 | background-color: #88b;
|
| 64 | color: #fff;
|
| 65 | }
|
| 66 |
|
| 67 | table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
|
| 68 | padding: 5px 8px;
|
| 69 | }
|
| 70 |
|
| 71 |
|
| 72 | p.notice {
|
| 73 | border: 1px solid rgb(255, 0, 0);
|
| 74 | background-color: rgb(238, 238, 238);
|
| 75 | color: rgb(0, 51, 102);
|
| 76 | padding: 0.5em;
|
| 77 | margin: 1em 2em 1em 1em;
|
| 78 | }
|
| 79 | </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="../images/tomcat.gif" align="right" alt="
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 80 | The Apache Tomcat Servlet/JSP Container
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 81 | " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.77, Mar 28 2017</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="../images/asf-logo.svg" align="right" alt="Apache Logo" border="0" style="width: 266px;height: 83px;"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="../index.html">Docs Home</a></li><li><a href="index.html">Config Ref. Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>Top Level Elements</strong></p><ul><li><a href="server.html">Server</a></li><li><a href="service.html">Service</a></li></ul><p><strong>Executors</strong></p><ul><li><a href="executor.html">Executor</a></li></ul><p><strong>Connectors</strong></p><ul><li><a href="http.html">HTTP</a></li><li><a href="ajp.html">AJP</a></li></ul><p><strong>Containers</strong></p><ul><li><a href="context.html">Context</a></li><li><a href="engine.html">Engine</a></li><li><a href="host.html">Host</a></li><li><a href="cluster.html">Cluster</a></li></ul><p><strong>Nested Components</strong></p><ul><li><a href="globalresources.html">Global Resources</a></li><li><a href="jar-scanner.html">JarScanner</a></li><li><a href="listeners.html">Listeners</a></li><li><a href="loader.html">Loader</a></li><li><a href="manager.html">Manager</a></li><li><a href="realm.html">Realm</a></li><li><a href="resources.html">Resources</a></li><li><a href="sessionidgenerator.html">SessionIdGenerator</a></li><li><a href="valve.html">Valve</a></li></ul><p><strong>Cluster Elements</strong></p><ul><li><a href="cluster.html">Cluster</a></li><li><a href="cluster-manager.html">Manager</a></li><li><a href="cluster-channel.html">Channel</a></li><li><a href="cluster-membership.html">Channel/Membership</a></li><li><a href="cluster-sender.html">Channel/Sender</a></li><li><a href="cluster-receiver.html">Channel/Receiver</a></li><li><a href="cluster-interceptor.html">Channel/Interceptor</a></li><li><a href="cluster-valve.html">Valve</a></li><li><a href="cluster-deployer.html">Deployer</a></li><li><a href="cluster-listener.html">ClusterListener</a></li></ul><p><strong>web.xml</strong></p><ul><li><a href="filter.html">Filter</a></li></ul><p><strong>Other</strong></p><ul><li><a href="systemprops.html">System properties</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>The Valve Component</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
|
| 82 | <ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Access_Logging">Access Logging</a><ol><li><a href="#Access_Log_Valve">Access Log Valve</a><ol><li><a href="#Access_Log_Valve/Introduction">Introduction</a></li><li><a href="#Access_Log_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Extended_Access_Log_Valve">Extended Access Log Valve</a><ol><li><a href="#Extended_Access_Log_Valve/Introduction">Introduction</a></li><li><a href="#Extended_Access_Log_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Access_Control">Access Control</a><ol><li><a href="#Remote_Address_Filter">Remote Address Filter</a><ol><li><a href="#Remote_Address_Filter/Introduction">Introduction</a></li><li><a href="#Remote_Address_Filter/Attributes">Attributes</a></li><li><a href="#Remote_Address_Valve/Example_localhost">Example 1</a></li><li><a href="#Remote_Address_Valve/Example_localhost_port">Example 2</a></li><li><a href="#Remote_Address_Valve/Example_port_auth">Example 3</a></li></ol></li><li><a href="#Remote_Host_Filter">Remote Host Filter</a><ol><li><a href="#Remote_Host_Filter/Introduction">Introduction</a></li><li><a href="#Remote_Host_Filter/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Proxies_Support">Proxies Support</a><ol><li><a href="#Remote_IP_Valve">Remote IP Valve</a><ol><li><a href="#Remote_IP_Valve/Introduction">Introduction</a></li><li><a href="#Remote_IP_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SSL_Valve">SSL Valve</a><ol><li><a href="#SSL_Valve/Introduction">Introduction</a></li><li><a href="#SSL_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Single_Sign_On_Valve">Single Sign On Valve</a><ol><li><a href="#Single_Sign_On_Valve/Introduction">Introduction</a></li><li><a href="#Single_Sign_On_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Authentication">Authentication</a><ol><li><a href="#Basic_Authenticator_Valve">Basic Authenticator Valve</a><ol><li><a href="#Basic_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Basic_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Digest_Authenticator_Valve">Digest Authenticator Valve</a><ol><li><a href="#Digest_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Digest_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Form_Authenticator_Valve">Form Authenticator Valve</a><ol><li><a href="#Form_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Form_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SSL_Authenticator_Valve">SSL Authenticator Valve</a><ol><li><a href="#SSL_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#SSL_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SPNEGO_Valve">SPNEGO Valve</a><ol><li><a href="#SPNEGO_Valve/Introduction">Introduction</a></li><li><a href="#SPNEGO_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Error_Report_Valve">Error Report Valve</a><ol><li><a href="#Error_Report_Valve/Introduction">Introduction</a></li><li><a href="#Error_Report_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Crawler_Session_Manager_Valve">Crawler Session Manager Valve</a><ol><li><a href="#Crawler_Session_Manager_Valve/Introduction">Introduction</a></li><li><a href="#Crawler_Session_Manager_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Stuck_Thread_Detection_Valve">Stuck Thread Detection Valve</a><ol><li><a href="#Stuck_Thread_Detection_Valve/Introduction">Introduction</a></li><li><a href="#Stuck_Thread_Detection_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Semaphore_Valve">Semaphore Valve</a><ol><li><a href="#Semaphore_Valve/Introduction">Introduction</a></li><li><a href="#Semaphore_Valve/Attributes">Attributes</a></li></ol></li></ul>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 83 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 84 |
|
| 85 | <p>A <strong>Valve</strong> element represents a component that will be
|
| 86 | inserted into the request processing pipeline for the associated
|
| 87 | Catalina container (<a href="engine.html">Engine</a>,
|
| 88 | <a href="host.html">Host</a>, or <a href="context.html">Context</a>).
|
| 89 | Individual Valves have distinct processing capabilities, and are
|
| 90 | described individually below.</p>
|
| 91 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 92 | <p><em>The description below uses the variable name $CATALINA_BASE to refer the
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 93 | base directory against which most relative paths are resolved. If you have
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 94 | not configured Tomcat for multiple instances by setting a CATALINA_BASE
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 95 | directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME,
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 96 | the directory into which you have installed Tomcat.</em></p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 97 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 98 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Access Logging"><!--()--></a><a name="Access_Logging"><strong>Access Logging</strong></a></font></td></tr><tr><td><blockquote>
|
| 99 |
|
| 100 | <p>Access logging is performed by valves that implement
|
| 101 | <strong>org.apache.catalina.AccessLog</strong> interface.</p>
|
| 102 |
|
| 103 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Access Log Valve"><!--()--></a><a name="Access_Log_Valve"><strong>Access Log Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 104 |
|
| 105 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Access Log Valve/Introduction"><!--()--></a><a name="Access_Log_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 106 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 107 | <p>The <strong>Access Log Valve</strong> creates log files in the
|
| 108 | same format as those created by standard web servers. These logs
|
| 109 | can later be analyzed by standard log analysis tools to track page
|
| 110 | hit counts, user session activity, and so on. This <code>Valve</code>
|
| 111 | uses self-contained logic to write its log files, which can be
|
| 112 | automatically rolled over at midnight each day. (The essential
|
| 113 | requirement for access logging is to handle a large continuous
|
| 114 | stream of data with low overhead. This <code>Valve</code> does not
|
| 115 | use Apache Commons Logging, thus avoiding additional overhead and
|
| 116 | potentially complex configuration).</p>
|
| 117 |
|
| 118 | <p>This <code>Valve</code> may be associated with any Catalina container
|
| 119 | (<code>Context</code>, <code>Host</code>, or <code>Engine</code>), and
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 120 | will record ALL requests processed by that container.</p>
|
| 121 |
|
| 122 | <p>Some requests may be handled by Tomcat before they are passed to a
|
| 123 | container. These include redirects from /foo to /foo/ and the rejection of
|
| 124 | invalid requests. Where Tomcat can identify the <code>Context</code> that
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 125 | would have handled the request, the request/response will be logged in the
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 126 | <code>AccessLog</code>(s) associated <code>Context</code>, <code>Host</code>
|
| 127 | and <code>Engine</code>. Where Tomcat cannot identify the
|
| 128 | <code>Context</code> that would have handled the request, e.g. in cases
|
| 129 | where the URL is invalid, Tomcat will look first in the <code>Engine</code>,
|
| 130 | then the default <code>Host</code> for the <code>Engine</code> and finally
|
| 131 | the ROOT (or default) <code>Context</code> for the default <code>Host</code>
|
| 132 | for an <code>AccessLog</code> implementation. Tomcat will use the first
|
| 133 | <code>AccessLog</code> implementation found to log those requests that are
|
| 134 | rejected before they are passed to a container.</p>
|
| 135 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 136 | <p>The output file will be placed in the directory given by the
|
| 137 | <code>directory</code> attribute. The name of the file is composed
|
| 138 | by concatenation of the configured <code>prefix</code>, timestamp and
|
| 139 | <code>suffix</code>. The format of the timestamp in the file name can be
|
| 140 | set using the <code>fileDateFormat</code> attribute. This timestamp will
|
| 141 | be omitted if the file rotation is switched off by setting
|
| 142 | <code>rotatable</code> to <code>false</code>.</p>
|
| 143 |
|
| 144 | <p><strong>Warning:</strong> If multiple AccessLogValve instances
|
| 145 | are used, they should be configured to use different output files.</p>
|
| 146 |
|
| 147 | <p>If sendfile is used, the response bytes will be written asynchronously
|
| 148 | in a separate thread and the access log valve will not know how many bytes
|
| 149 | were actually written. In this case, the number of bytes that was passed to
|
| 150 | the sendfile thread for writing will be recorded in the access log valve.
|
| 151 | </p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 152 | </blockquote></td></tr></table>
|
| 153 |
|
| 154 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Access Log Valve/Attributes"><!--()--></a><a name="Access_Log_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 155 |
|
| 156 | <p>The <strong>Access Log Valve</strong> supports the following
|
| 157 | configuration attributes:</p>
|
| 158 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 159 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 160 | <p>Java class name of the implementation to use. This MUST be set to
|
| 161 | <strong>org.apache.catalina.valves.AccessLogValve</strong> to use the
|
| 162 | default access log valve.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 163 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">directory</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 164 | <p>Absolute or relative pathname of a directory in which log files
|
| 165 | created by this valve will be placed. If a relative path is
|
| 166 | specified, it is interpreted as relative to $CATALINA_BASE. If
|
| 167 | no directory attribute is specified, the default value is "logs"
|
| 168 | (relative to $CATALINA_BASE).</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 169 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">prefix</code></td><td align="left" valign="center">
|
| 170 | <p>The prefix added to the start of each log file's name. If not
|
| 171 | specified, the default value is "access_log.".</p>
|
| 172 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">suffix</code></td><td align="left" valign="center">
|
| 173 | <p>The suffix added to the end of each log file's name. If not
|
| 174 | specified, the default value is "" (a zero-length string),
|
| 175 | meaning that no suffix will be added.</p>
|
| 176 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">fileDateFormat</code></td><td align="left" valign="center">
|
| 177 | <p>Allows a customized timestamp in the access log file name.
|
| 178 | The file is rotated whenever the formatted timestamp changes.
|
| 179 | The default value is <code>yyyy-MM-dd</code>.
|
| 180 | If you wish to rotate every hour, then set this value
|
| 181 | to <code>yyyy-MM-dd.HH</code>.
|
| 182 | The date format will always be localized
|
| 183 | using the locale <code>en_US</code>.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 184 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 185 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">rotatable</code></td><td align="left" valign="center">
|
| 186 | <p>Flag to determine if log rotation should occur.
|
| 187 | If set to <code>false</code>, then this file is never rotated and
|
| 188 | <code>fileDateFormat</code> is ignored.
|
| 189 | Default value: <code>true</code>
|
| 190 | </p>
|
| 191 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">renameOnRotate</code></td><td align="left" valign="center">
|
| 192 | <p>By default for a rotatable log the active access log file name
|
| 193 | will contain the current timestamp in <code>fileDateFormat</code>.
|
| 194 | During rotation the file is closed and a new file with the next
|
| 195 | timestamp in the name is created and used. When setting
|
| 196 | <code>renameOnRotate</code> to <code>true</code>, the timestamp
|
| 197 | is no longer part of the active log file name. Only during rotation
|
| 198 | the file is closed and then renamed to include the timestamp.
|
| 199 | This is similar to the behavior of most log frameworks when
|
| 200 | doing time based rotation.
|
| 201 | Default value: <code>false</code>
|
| 202 | </p>
|
| 203 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">pattern</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 204 | <p>A formatting layout identifying the various information fields
|
| 205 | from the request and response to be logged, or the word
|
| 206 | <code>common</code> or <code>combined</code> to select a
|
| 207 | standard format. See below for more information on configuring
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 208 | this attribute.</p>
|
| 209 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">encoding</code></td><td align="left" valign="center">
|
| 210 | <p>Character set used to write the log file. An empty string means
|
| 211 | to use the system default character set. Default value: use the
|
| 212 | system default character set.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 213 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 214 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">locale</code></td><td align="left" valign="center">
|
| 215 | <p>The locale used to format timestamps in the access log
|
| 216 | lines. Any timestamps configured using an
|
| 217 | explicit SimpleDateFormat pattern (<code>%{xxx}t</code>)
|
| 218 | are formatted in this locale. By default the
|
| 219 | default locale of the Java process is used. Switching the
|
| 220 | locale after the AccessLogValve is initialized is not supported.
|
| 221 | Any timestamps using the common log format
|
| 222 | (<code>CLF</code>) are always formatted in the locale
|
| 223 | <code>en_US</code>.
|
| 224 | </p>
|
| 225 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">requestAttributesEnabled</code></td><td align="left" valign="center">
|
| 226 | <p>Set to <code>true</code> to check for the existence of request
|
| 227 | attributes (typically set by the RemoteIpValve and similar) that should
|
| 228 | be used to override the values returned by the request for remote
|
| 229 | address, remote host, server port and protocol. If the attributes are
|
| 230 | not set, or this attribute is set to <code>false</code> then the values
|
| 231 | from the request will be used. If not set, the default value of
|
| 232 | <code>false</code> will be used.</p>
|
| 233 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">conditionIf</code></td><td align="left" valign="center">
|
| 234 | <p>Turns on conditional logging. If set, requests will be
|
| 235 | logged only if <code>ServletRequest.getAttribute()</code> is
|
| 236 | not null. For example, if this value is set to
|
| 237 | <code>important</code>, then a particular request will only be logged
|
| 238 | if <code>ServletRequest.getAttribute("important") != null</code>.
|
| 239 | The use of Filters is an easy way to set/unset the attribute
|
| 240 | in the ServletRequest on many different requests.
|
| 241 | </p>
|
| 242 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">conditionUnless</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 243 | <p>Turns on conditional logging. If set, requests will be
|
| 244 | logged only if <code>ServletRequest.getAttribute()</code> is
|
| 245 | null. For example, if this value is set to
|
| 246 | <code>junk</code>, then a particular request will only be logged
|
| 247 | if <code>ServletRequest.getAttribute("junk") == null</code>.
|
| 248 | The use of Filters is an easy way to set/unset the attribute
|
| 249 | in the ServletRequest on many different requests.
|
| 250 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 251 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">condition</code></td><td align="left" valign="center">
|
| 252 | <p>The same as <code>conditionUnless</code>. This attribute is
|
| 253 | provided for backwards compatibility.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 254 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 255 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">buffered</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 256 | <p>Flag to determine if logging will be buffered.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 257 | If set to <code>false</code>, then access logging will be written after each
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 258 | request. Default value: <code>true</code>
|
| 259 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 260 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">resolveHosts</code></td><td align="left" valign="center">
|
| 261 | <p>This attribute is no longer supported. Use the connector
|
| 262 | attribute <code>enableLookups</code> instead.</p>
|
| 263 | <p>If you have <code>enableLookups</code> on the connector set to
|
| 264 | <code>true</code> and want to ignore it, use <b>%a</b> instead of
|
| 265 | <b>%h</b> in the value of <code>pattern</code>.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 266 | </td></tr></table>
|
| 267 |
|
| 268 | <p>Values for the <code>pattern</code> attribute are made up of literal
|
| 269 | text strings, combined with pattern identifiers prefixed by the "%"
|
| 270 | character to cause replacement by the corresponding variable value from
|
| 271 | the current request and response. The following pattern codes are
|
| 272 | supported:</p>
|
| 273 | <ul>
|
| 274 | <li><b>%a</b> - Remote IP address</li>
|
| 275 | <li><b>%A</b> - Local IP address</li>
|
| 276 | <li><b>%b</b> - Bytes sent, excluding HTTP headers, or '-' if zero</li>
|
| 277 | <li><b>%B</b> - Bytes sent, excluding HTTP headers</li>
|
| 278 | <li><b>%h</b> - Remote host name (or IP address if
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 279 | <code>enableLookups</code> for the connector is false)</li>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 280 | <li><b>%H</b> - Request protocol</li>
|
| 281 | <li><b>%l</b> - Remote logical username from identd (always returns
|
| 282 | '-')</li>
|
| 283 | <li><b>%m</b> - Request method (GET, POST, etc.)</li>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 284 | <li><b>%p</b> - Local port on which this request was received.
|
| 285 | See also <code>%{xxx}p</code> below.</li>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 286 | <li><b>%q</b> - Query string (prepended with a '?' if it exists)</li>
|
| 287 | <li><b>%r</b> - First line of the request (method and request URI)</li>
|
| 288 | <li><b>%s</b> - HTTP status code of the response</li>
|
| 289 | <li><b>%S</b> - User session ID</li>
|
| 290 | <li><b>%t</b> - Date and time, in Common Log Format</li>
|
| 291 | <li><b>%u</b> - Remote user that was authenticated (if any), else '-'</li>
|
| 292 | <li><b>%U</b> - Requested URL path</li>
|
| 293 | <li><b>%v</b> - Local server name</li>
|
| 294 | <li><b>%D</b> - Time taken to process the request, in millis</li>
|
| 295 | <li><b>%T</b> - Time taken to process the request, in seconds</li>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 296 | <li><b>%F</b> - Time taken to commit the response, in millis</li>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 297 | <li><b>%I</b> - Current request thread name (can compare later with stacktraces)</li>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 298 | </ul>
|
| 299 |
|
| 300 | <p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 301 | There is also support to write information incoming or outgoing
|
| 302 | headers, cookies, session or request attributes and special
|
| 303 | timestamp formats.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 304 | It is modeled after the
|
| 305 | <a href="http://httpd.apache.org/">Apache HTTP Server</a> log configuration
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 306 | syntax. Each of them can be used multiple times with different <code>xxx</code> keys:
|
| 307 | </p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 308 | <ul>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 309 | <li><b><code>%{xxx}i</code></b> write value of incoming header with name <code>xxx</code></li>
|
| 310 | <li><b><code>%{xxx}o</code></b> write value of outgoing header with name <code>xxx</code></li>
|
| 311 | <li><b><code>%{xxx}c</code></b> write value of cookie with name <code>xxx</code></li>
|
| 312 | <li><b><code>%{xxx}r</code></b> write value of ServletRequest attribute with name <code>xxx</code></li>
|
| 313 | <li><b><code>%{xxx}s</code></b> write value of HttpSession attribute with name <code>xxx</code></li>
|
| 314 | <li><b><code>%{xxx}p</code></b> write local (server) port (<code>xxx==local</code>) or
|
| 315 | remote (client) port (<code>xxx=remote</code>)</li>
|
| 316 | <li><b><code>%{xxx}t</code></b> write timestamp at the end of the request formatted using the
|
| 317 | enhanced SimpleDateFormat pattern <code>xxx</code></li>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 318 | </ul>
|
| 319 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 320 | <p>All formats supported by SimpleDateFormat are allowed in <code>%{xxx}t</code>.
|
| 321 | In addition the following extensions have been added:</p>
|
| 322 | <ul>
|
| 323 | <li><b><code>sec</code></b> - number of seconds since the epoch</li>
|
| 324 | <li><b><code>msec</code></b> - number of milliseconds since the epoch</li>
|
| 325 | <li><b><code>msec_frac</code></b> - millisecond fraction</li>
|
| 326 | </ul>
|
| 327 | <p>These formats can not be mixed with SimpleDateFormat formats in the same format
|
| 328 | token.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 329 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 330 | <p>Furthermore one can define whether to log the timestamp for the request start
|
| 331 | time or the response finish time:</p>
|
| 332 | <ul>
|
| 333 | <li><b><code>begin</code></b> or prefix <b><code>begin:</code></b> chooses
|
| 334 | the request start time</li>
|
| 335 | <li><b><code>end</code></b> or prefix <b><code>end:</code></b> chooses
|
| 336 | the response finish time</li>
|
| 337 | </ul>
|
| 338 | <p>By adding multiple <code>%{xxx}t</code> tokens to the pattern, one can
|
| 339 | also log both timestamps.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 340 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 341 | <p>The shorthand pattern <code>pattern="common"</code>
|
| 342 | corresponds to the Common Log Format defined by
|
| 343 | <strong>'%h %l %u %t "%r" %s %b'</strong>.</p>
|
| 344 |
|
| 345 | <p>The shorthand pattern <code>pattern="combined"</code>
|
| 346 | appends the values of the <code>Referer</code> and <code>User-Agent</code>
|
| 347 | headers, each in double quotes, to the <code>common</code> pattern.</p>
|
| 348 |
|
| 349 | <p>When Tomcat is operating behind a reverse proxy, the client information
|
| 350 | logged by the Access Log Valve may represent the reverse proxy, the browser
|
| 351 | or some combination of the two depending on the configuration of Tomcat and
|
| 352 | the reverse proxy. For Tomcat configuration options see
|
| 353 | <a href="#Proxies_Support">Proxies Support</a> and the
|
| 354 | <a href="../proxy-howto.html">Proxy How-To</a>. For reverse proxies that
|
| 355 | use mod_jk, see the <a href="http://tomcat.apache.org/connectors-doc/generic_howto/proxy.html">generic
|
| 356 | proxy</a> documentation. For other reverse proxies, consult their
|
| 357 | documentation.</p>
|
| 358 | </blockquote></td></tr></table>
|
| 359 |
|
| 360 | </blockquote></td></tr></table>
|
| 361 |
|
| 362 |
|
| 363 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Extended Access Log Valve"><!--()--></a><a name="Extended_Access_Log_Valve"><strong>Extended Access Log Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 364 |
|
| 365 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Extended Access Log Valve/Introduction"><!--()--></a><a name="Extended_Access_Log_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 366 |
|
| 367 | <p>The <strong>Extended Access Log Valve</strong> extends the
|
| 368 | <a href="#Access_Log_Valve">Access Log Valve</a> class, and so
|
| 369 | uses the same self-contained logging logic. This means it
|
| 370 | implements many of the same file handling attributes. The main
|
| 371 | difference to the standard <code>AccessLogValve</code> is that
|
| 372 | <code>ExtendedAccessLogValve</code> creates log files which
|
| 373 | conform to the Working Draft for the
|
| 374 | <a href="http://www.w3.org/TR/WD-logfile.html">Extended Log File Format</a>
|
| 375 | defined by the W3C.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 376 |
|
| 377 | </blockquote></td></tr></table>
|
| 378 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 379 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Extended Access Log Valve/Attributes"><!--()--></a><a name="Extended_Access_Log_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 380 |
|
| 381 | <p>The <strong>Extended Access Log Valve</strong> supports all
|
| 382 | configuration attributes of the standard
|
| 383 | <a href="#Access_Log_Valve">Access Log Valve.</a> Only the
|
| 384 | values used for <code>className</code> and <code>pattern</code> differ.</p>
|
| 385 |
|
| 386 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 387 | <p>Java class name of the implementation to use. This MUST be set to
|
| 388 | <strong>org.apache.catalina.valves.ExtendedAccessLogValve</strong> to
|
| 389 | use the extended access log valve.</p>
|
| 390 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">pattern</code></td><td align="left" valign="center">
|
| 391 | <p>A formatting layout identifying the various information fields
|
| 392 | from the request and response to be logged.
|
| 393 | See below for more information on configuring this attribute.</p>
|
| 394 | </td></tr></table>
|
| 395 |
|
| 396 | <p>Values for the <code>pattern</code> attribute are made up of
|
| 397 | format tokens. Some of the tokens need an additional prefix. Possible
|
| 398 | prefixes are <code>c</code> for "client", <code>s</code> for "server",
|
| 399 | <code>cs</code> for "client to server", <code>sc</code> for
|
| 400 | "server to client" or <code>x</code> for "application specific".
|
| 401 | Furthermore some tokens are completed by an additional selector.
|
| 402 | See the <a href="http://www.w3.org/TR/WD-logfile.html">W3C specification</a>
|
| 403 | for more information about the format.</p>
|
| 404 |
|
| 405 | <p>The following format tokens are supported:</p>
|
| 406 | <ul>
|
| 407 | <li><b>bytes</b> - Bytes sent, excluding HTTP headers, or '-' if zero</li>
|
| 408 | <li><b>c-dns</b> - Remote host name (or IP address if
|
| 409 | <code>enableLookups</code> for the connector is false)</li>
|
| 410 | <li><b>c-ip</b> - Remote IP address</li>
|
| 411 | <li><b>cs-method</b> - Request method (GET, POST, etc.)</li>
|
| 412 | <li><b>cs-uri</b> - Request URI</li>
|
| 413 | <li><b>cs-uri-query</b> - Query string (prepended with a '?' if it exists)</li>
|
| 414 | <li><b>cs-uri-stem</b> - Requested URL path</li>
|
| 415 | <li><b>date</b> - The date in yyyy-mm-dd format for GMT</li>
|
| 416 | <li><b>s-dns</b> - Local host name</li>
|
| 417 | <li><b>s-ip</b> - Local IP address</li>
|
| 418 | <li><b>sc-status</b> - HTTP status code of the response</li>
|
| 419 | <li><b>time</b> - Time the request was served in HH:mm:ss format for GMT</li>
|
| 420 | <li><b>time-taken</b> - Time (in seconds as floating point) taken to serve the request</li>
|
| 421 | <li><b>x-threadname</b> - Current request thread name (can compare later with stacktraces)</li>
|
| 422 | </ul>
|
| 423 |
|
| 424 | <p>For any of the <code>x-H(XXX)</code> the following method will be called from the
|
| 425 | HttpServletRequest object:</p>
|
| 426 | <ul>
|
| 427 | <li><b><code>x-H(authType)</code></b>: getAuthType </li>
|
| 428 | <li><b><code>x-H(characterEncoding)</code></b>: getCharacterEncoding </li>
|
| 429 | <li><b><code>x-H(contentLength)</code></b>: getContentLength </li>
|
| 430 | <li><b><code>x-H(locale)</code></b>: getLocale</li>
|
| 431 | <li><b><code>x-H(protocol)</code></b>: getProtocol </li>
|
| 432 | <li><b><code>x-H(remoteUser)</code></b>: getRemoteUser</li>
|
| 433 | <li><b><code>x-H(requestedSessionId)</code></b>: getRequestedSessionId</li>
|
| 434 | <li><b><code>x-H(requestedSessionIdFromCookie)</code></b>:
|
| 435 | isRequestedSessionIdFromCookie </li>
|
| 436 | <li><b><code>x-H(requestedSessionIdValid)</code></b>:
|
| 437 | isRequestedSessionIdValid</li>
|
| 438 | <li><b><code>x-H(scheme)</code></b>: getScheme</li>
|
| 439 | <li><b><code>x-H(secure)</code></b>: isSecure</li>
|
| 440 | </ul>
|
| 441 |
|
| 442 | <p>
|
| 443 | There is also support to write information about headers
|
| 444 | cookies, context, request or session attributes and request
|
| 445 | parameters.
|
| 446 | </p>
|
| 447 | <ul>
|
| 448 | <li><b><code>cs(XXX)</code></b> for incoming request headers with name XXX</li>
|
| 449 | <li><b><code>sc(XXX)</code></b> for outgoing response headers with name XXX</li>
|
| 450 | <li><b><code>x-A(XXX)</code></b> for the servlet context attribute with name XXX</li>
|
| 451 | <li><b><code>x-C(XXX)</code></b> for the first cookie with name XXX</li>
|
| 452 | <li><b><code>x-O(XXX)</code></b> for a concatenation of all outgoing response headers with name XXX</li>
|
| 453 | <li><b><code>x-P(XXX)</code></b> for the URL encoded (using UTF-8) request parameter with name XXX</li>
|
| 454 | <li><b><code>x-R(XXX)</code></b> for the request attribute with name XXX</li>
|
| 455 | <li><b><code>x-S(XXX)</code></b> for the session attribute with name XXX</li>
|
| 456 | </ul>
|
| 457 |
|
| 458 | </blockquote></td></tr></table>
|
| 459 |
|
| 460 | </blockquote></td></tr></table>
|
| 461 |
|
| 462 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Access Control"><!--()--></a><a name="Access_Control"><strong>Access Control</strong></a></font></td></tr><tr><td><blockquote>
|
| 463 |
|
| 464 |
|
| 465 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Address Filter"><!--()--></a><a name="Remote_Address_Filter"><strong>Remote Address Filter</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 466 |
|
| 467 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Address Filter/Introduction"><!--()--></a><a name="Remote_Address_Filter/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 468 |
|
| 469 | <p>The <strong>Remote Address Filter</strong> allows you to compare the
|
| 470 | IP address of the client that submitted this request against one or more
|
| 471 | <em>regular expressions</em>, and either allow the request to continue
|
| 472 | or refuse to process the request from this client. A Remote Address
|
| 473 | Filter can be associated with any Catalina container
|
| 474 | (<a href="engine.html">Engine</a>, <a href="host.html">Host</a>, or
|
| 475 | <a href="context.html">Context</a>), and must accept any request
|
| 476 | presented to this container for processing before it will be passed on.</p>
|
| 477 |
|
| 478 | <p>The syntax for <em>regular expressions</em> is different than that for
|
| 479 | 'standard' wildcard matching. Tomcat uses the <code>java.util.regex</code>
|
| 480 | package. Please consult the Java documentation for details of the
|
| 481 | expressions supported.</p>
|
| 482 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 483 | <p>Optionally one can append the server connector port separated with a
|
| 484 | semicolon (";") to allow different expressions for each connector.</p>
|
| 485 |
|
| 486 | <p>The behavior when a request is refused can be changed
|
| 487 | to not deny but instead set an invalid <code>authentication</code>
|
| 488 | header. This is useful in combination with the context attribute
|
| 489 | <code>preemptiveAuthentication="true"</code>.</p>
|
| 490 |
|
| 491 | <p><strong>Note:</strong> There is a caveat when using this valve with
|
| 492 | IPv6 addresses. Format of the IP address that this valve is processing
|
| 493 | depends on the API that was used to obtain it. If the address was obtained
|
| 494 | from Java socket using Inet6Address class, its format will be
|
| 495 | <code>x:x:x:x:x:x:x:x</code>. That is, the IP address for localhost
|
| 496 | will be <code>0:0:0:0:0:0:0:1</code> instead of the more widely used
|
| 497 | <code>::1</code>. Consult your access logs for the actual value.</p>
|
| 498 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 499 | <p>See also: <a href="#Remote_Host_Filter">Remote Host Filter</a>,
|
| 500 | <a href="#Remote_IP_Valve">Remote IP Valve</a>.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 501 | </blockquote></td></tr></table>
|
| 502 |
|
| 503 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Address Filter/Attributes"><!--()--></a><a name="Remote_Address_Filter/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 504 |
|
| 505 | <p>The <strong>Remote Address Filter</strong> supports the following
|
| 506 | configuration attributes:</p>
|
| 507 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 508 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 509 | <p>Java class name of the implementation to use. This MUST be set to
|
| 510 | <strong>org.apache.catalina.valves.RemoteAddrValve</strong>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 511 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">allow</code></td><td align="left" valign="center">
|
| 512 | <p>A regular expression (using <code>java.util.regex</code>) that the
|
| 513 | remote client's IP address is compared to. If this attribute
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 514 | is specified, the remote address MUST match for this request to be
|
| 515 | accepted. If this attribute is not specified, all requests will be
|
| 516 | accepted UNLESS the remote address matches a <code>deny</code>
|
| 517 | pattern.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 518 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">deny</code></td><td align="left" valign="center">
|
| 519 | <p>A regular expression (using <code>java.util.regex</code>) that the
|
| 520 | remote client's IP address is compared to. If this attribute
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 521 | is specified, the remote address MUST NOT match for this request to be
|
| 522 | accepted. If this attribute is not specified, request acceptance is
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 523 | governed solely by the <code>allow</code> attribute.</p>
|
| 524 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">denyStatus</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 525 | <p>HTTP response status code that is used when rejecting denied
|
| 526 | request. The default value is <code>403</code>. For example,
|
| 527 | it can be set to the value <code>404</code>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 528 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">addConnectorPort</code></td><td align="left" valign="center">
|
| 529 | <p>Append the server connector port to the client IP address separated
|
| 530 | with a semicolon (";"). If this is set to <code>true</code>, the
|
| 531 | expressions configured with <code>allow</code> and
|
| 532 | <code>deny</code> is compared against <code>ADDRESS;PORT</code>
|
| 533 | where <code>ADDRESS</code> is the client IP address and
|
| 534 | <code>PORT</code> is the Tomcat connector port which received the
|
| 535 | request. The default value is <code>false</code>.</p>
|
| 536 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">invalidAuthenticationWhenDeny</code></td><td align="left" valign="center">
|
| 537 | <p>When a request should be denied, do not deny but instead
|
| 538 | set an invalid <code>authentication</code> header. This only works
|
| 539 | if the context has the attribute <code>preemptiveAuthentication="true"</code>
|
| 540 | set. An already existing <code>authentication</code> header will not be
|
| 541 | overwritten. In effect this will trigger authentication instead of deny
|
| 542 | even if the application does not have a security constraint configured.</p>
|
| 543 | <p>This can be combined with <code>addConnectorPort</code> to trigger authentication
|
| 544 | depending on the client and the connector that is used to access an application.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 545 | </td></tr></table>
|
| 546 |
|
| 547 | </blockquote></td></tr></table>
|
| 548 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 549 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote_Address_Valve/Example_localhost"><strong>Example 1</strong></a></font></td></tr><tr><td><blockquote>
|
| 550 | <p>To allow access only for the clients connecting from localhost:</p>
|
| 551 | <div class="codeBox"><pre><code><Valve className="org.apache.catalina.valves.RemoteAddrValve"
|
| 552 | allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1"/></code></pre></div>
|
| 553 | </blockquote></td></tr></table>
|
| 554 |
|
| 555 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote_Address_Valve/Example_localhost_port"><strong>Example 2</strong></a></font></td></tr><tr><td><blockquote>
|
| 556 | <p>To allow unrestricted access for the clients connecting from localhost
|
| 557 | but for all other clients only to port 8443:</p>
|
| 558 | <div class="codeBox"><pre><code><Valve className="org.apache.catalina.valves.RemoteAddrValve"
|
| 559 | addConnectorPort="true"
|
| 560 | allow="127\.\d+\.\d+\.\d+;\d*|::1;\d*|0:0:0:0:0:0:0:1;\d*|.*;8443"/></code></pre></div>
|
| 561 | </blockquote></td></tr></table>
|
| 562 |
|
| 563 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote_Address_Valve/Example_port_auth"><strong>Example 3</strong></a></font></td></tr><tr><td><blockquote>
|
| 564 | <p>To allow unrestricted access to port 8009, but trigger basic
|
| 565 | authentication if the application is accessed on another port:</p>
|
| 566 | <div class="codeBox"><pre><code><Context>
|
| 567 | ...
|
| 568 | <Valve className="org.apache.catalina.valves.RemoteAddrValve"
|
| 569 | addConnectorPort="true"
|
| 570 | invalidAuthenticationWhenDeny="true"
|
| 571 | allow=".*;8009"/>
|
| 572 | <Valve className="org.apache.catalina.authenticator.BasicAuthenticator" />
|
| 573 | ...
|
| 574 | </Context></code></pre></div>
|
| 575 | </blockquote></td></tr></table>
|
| 576 |
|
| 577 | </blockquote></td></tr></table>
|
| 578 |
|
| 579 |
|
| 580 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Host Filter"><!--()--></a><a name="Remote_Host_Filter"><strong>Remote Host Filter</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 581 |
|
| 582 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Host Filter/Introduction"><!--()--></a><a name="Remote_Host_Filter/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 583 |
|
| 584 | <p>The <strong>Remote Host Filter</strong> allows you to compare the
|
| 585 | hostname of the client that submitted this request against one or more
|
| 586 | <em>regular expressions</em>, and either allow the request to continue
|
| 587 | or refuse to process the request from this client. A Remote Host
|
| 588 | Filter can be associated with any Catalina container
|
| 589 | (<a href="engine.html">Engine</a>, <a href="host.html">Host</a>, or
|
| 590 | <a href="context.html">Context</a>), and must accept any request
|
| 591 | presented to this container for processing before it will be passed on.</p>
|
| 592 |
|
| 593 | <p>The syntax for <em>regular expressions</em> is different than that for
|
| 594 | 'standard' wildcard matching. Tomcat uses the <code>java.util.regex</code>
|
| 595 | package. Please consult the Java documentation for details of the
|
| 596 | expressions supported.</p>
|
| 597 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 598 | <p>Optionally one can append the server connector port separated with a
|
| 599 | semicolon (";") to allow different expressions for each connector.</p>
|
| 600 |
|
| 601 | <p>The behavior when a request is refused can be changed
|
| 602 | to not deny but instead set an invalid <code>authentication</code>
|
| 603 | header. This is useful in combination with the context attribute
|
| 604 | <code>preemptiveAuthentication="true"</code>.</p>
|
| 605 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 606 | <p><strong>Note:</strong> This filter processes the value returned by
|
| 607 | method <code>ServletRequest.getRemoteHost()</code>. To allow the method
|
| 608 | to return proper host names, you have to enable "DNS lookups" feature on
|
| 609 | a <strong>Connector</strong>.</p>
|
| 610 |
|
| 611 | <p>See also: <a href="#Remote_Address_Filter">Remote Address Filter</a>,
|
| 612 | <a href="http.html">HTTP Connector</a> configuration.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 613 | </blockquote></td></tr></table>
|
| 614 |
|
| 615 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote Host Filter/Attributes"><!--()--></a><a name="Remote_Host_Filter/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 616 |
|
| 617 | <p>The <strong>Remote Host Filter</strong> supports the following
|
| 618 | configuration attributes:</p>
|
| 619 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 620 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 621 | <p>Java class name of the implementation to use. This MUST be set to
|
| 622 | <strong>org.apache.catalina.valves.RemoteHostValve</strong>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 623 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">allow</code></td><td align="left" valign="center">
|
| 624 | <p>A regular expression (using <code>java.util.regex</code>) that the
|
| 625 | remote client's hostname is compared to. If this attribute
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 626 | is specified, the remote hostname MUST match for this request to be
|
| 627 | accepted. If this attribute is not specified, all requests will be
|
| 628 | accepted UNLESS the remote hostname matches a <code>deny</code>
|
| 629 | pattern.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 630 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">deny</code></td><td align="left" valign="center">
|
| 631 | <p>A regular expression (using <code>java.util.regex</code>) that the
|
| 632 | remote client's hostname is compared to. If this attribute
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 633 | is specified, the remote hostname MUST NOT match for this request to be
|
| 634 | accepted. If this attribute is not specified, request acceptance is
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 635 | governed solely by the <code>allow</code> attribute.</p>
|
| 636 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">denyStatus</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 637 | <p>HTTP response status code that is used when rejecting denied
|
| 638 | request. The default value is <code>403</code>. For example,
|
| 639 | it can be set to the value <code>404</code>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 640 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">addConnectorPort</code></td><td align="left" valign="center">
|
| 641 | <p>Append the server connector port to the client hostname separated
|
| 642 | with a semicolon (";"). If this is set to <code>true</code>, the
|
| 643 | expressions configured with <code>allow</code> and
|
| 644 | <code>deny</code> is compared against <code>HOSTNAME;PORT</code>
|
| 645 | where <code>HOSTNAME</code> is the client hostname and
|
| 646 | <code>PORT</code> is the Tomcat connector port which received the
|
| 647 | request. The default value is <code>false</code>.</p>
|
| 648 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">invalidAuthenticationWhenDeny</code></td><td align="left" valign="center">
|
| 649 | <p>When a request should be denied, do not deny but instead
|
| 650 | set an invalid <code>authentication</code> header. This only works
|
| 651 | if the context has the attribute <code>preemptiveAuthentication="true"</code>
|
| 652 | set. An already existing <code>authentication</code> header will not be
|
| 653 | overwritten. In effect this will trigger authentication instead of deny
|
| 654 | even if the application does not have a security constraint configured.</p>
|
| 655 | <p>This can be combined with <code>addConnectorPort</code> to trigger authentication
|
| 656 | depending on the client and the connector that is used to access an application.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 657 | </td></tr></table>
|
| 658 |
|
| 659 | </blockquote></td></tr></table>
|
| 660 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 661 | </blockquote></td></tr></table>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 662 |
|
| 663 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 664 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Proxies Support"><!--()--></a><a name="Proxies_Support"><strong>Proxies Support</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 665 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 666 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote IP Valve"><!--()--></a><a name="Remote_IP_Valve"><strong>Remote IP Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 667 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 668 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote IP Valve/Introduction"><!--()--></a><a name="Remote_IP_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 669 |
|
| 670 | <p>Tomcat port of
|
| 671 | <a href="http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html">mod_remoteip</a>,
|
| 672 | this valve replaces the apparent client remote IP address and hostname for
|
| 673 | the request with the IP address list presented by a proxy or a load balancer
|
| 674 | via a request headers (e.g. "X-Forwarded-For").</p>
|
| 675 |
|
| 676 | <p>Another feature of this valve is to replace the apparent scheme
|
| 677 | (http/https), server port and <code>request.secure</code> with the scheme presented
|
| 678 | by a proxy or a load balancer via a request header
|
| 679 | (e.g. "X-Forwarded-Proto").</p>
|
| 680 |
|
| 681 | <p>This Valve may be used at the <code>Engine</code>, <code>Host</code> or
|
| 682 | <code>Context</code> level as required. Normally, this Valve would be used
|
| 683 | at the <code>Engine</code> level.</p>
|
| 684 |
|
| 685 | <p>If used in conjunction with Remote Address/Host valves then this valve
|
| 686 | should be defined first to ensure that the correct client IP address is
|
| 687 | presented to the Remote Address/Host valves.</p>
|
| 688 |
|
| 689 | <p><strong>Note:</strong> By default this valve has no effect on the
|
| 690 | values that are written into access log. The original values are restored
|
| 691 | when request processing leaves the valve and that always happens earlier
|
| 692 | than access logging. To pass the remote address, remote host, server port
|
| 693 | and protocol values set by this valve to the access log,
|
| 694 | they are put into request attributes. Publishing these values here
|
| 695 | is enabled by default, but <code>AccessLogValve</code> should be explicitly
|
| 696 | configured to use them. See documentation for
|
| 697 | <code>requestAttributesEnabled</code> attribute of
|
| 698 | <code>AccessLogValve</code>.</p>
|
| 699 |
|
| 700 | <p>The names of request attributes that are set by this valve
|
| 701 | and can be used by access logging are the following:</p>
|
| 702 |
|
| 703 | <ul>
|
| 704 | <li><code>org.apache.catalina.AccessLog.RemoteAddr</code></li>
|
| 705 | <li><code>org.apache.catalina.AccessLog.RemoteHost</code></li>
|
| 706 | <li><code>org.apache.catalina.AccessLog.Protocol</code></li>
|
| 707 | <li><code>org.apache.catalina.AccessLog.ServerPort</code></li>
|
| 708 | <li><code>org.apache.tomcat.remoteAddr</code></li>
|
| 709 | </ul>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 710 |
|
| 711 | </blockquote></td></tr></table>
|
| 712 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 713 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Remote IP Valve/Attributes"><!--()--></a><a name="Remote_IP_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 714 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 715 | <p>The <strong>Remote IP Valve</strong> supports the
|
| 716 | following configuration attributes:</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 717 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 718 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 719 | <p>Java class name of the implementation to use. This MUST be set to
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 720 | <strong>org.apache.catalina.valves.RemoteIpValve</strong>.</p>
|
| 721 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">remoteIpHeader</code></td><td align="left" valign="center">
|
| 722 | <p>Name of the HTTP Header read by this valve that holds the list of
|
| 723 | traversed IP addresses starting from the requesting client. If not
|
| 724 | specified, the default of <code>x-forwarded-for</code> is used.</p>
|
| 725 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">internalProxies</code></td><td align="left" valign="center">
|
| 726 | <p>Regular expression (using <code>java.util.regex</code>) that a
|
| 727 | proxy's IP address must match to be considered an internal proxy.
|
| 728 | Internal proxies that appear in the <strong>remoteIpHeader</strong> will
|
| 729 | be trusted and will not appear in the <strong>proxiesHeader</strong>
|
| 730 | value. If not specified the default value of <code>
|
| 731 | 10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}
|
| 732 | </code> will be used.</p>
|
| 733 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">proxiesHeader</code></td><td align="left" valign="center">
|
| 734 | <p>Name of the HTTP header created by this valve to hold the list of
|
| 735 | proxies that have been processed in the incoming
|
| 736 | <strong>remoteIpHeader</strong>. If not specified, the default of
|
| 737 | <code>x-forwarded-by</code> is used.</p>
|
| 738 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">requestAttributesEnabled</code></td><td align="left" valign="center">
|
| 739 | <p>Set to <code>true</code> to set the request attributes used by
|
| 740 | AccessLog implementations to override the values returned by the
|
| 741 | request for remote address, remote host, server port and protocol.
|
| 742 | Request attributes are also used to enable the forwarded remote address
|
| 743 | to be displayed on the status page of the Manager web application.
|
| 744 | If not set, the default value of <code>true</code> will be used.</p>
|
| 745 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">trustedProxies</code></td><td align="left" valign="center">
|
| 746 | <p>Regular expression (using <code>java.util.regex</code>) that a
|
| 747 | proxy's IP address must match to be considered an trusted proxy.
|
| 748 | Trusted proxies that appear in the <strong>remoteIpHeader</strong> will
|
| 749 | be trusted and will appear in the <strong>proxiesHeader</strong> value.
|
| 750 | If not specified, no proxies will be trusted.</p>
|
| 751 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">protocolHeader</code></td><td align="left" valign="center">
|
| 752 | <p>Name of the HTTP Header read by this valve that holds the protocol
|
| 753 | used by the client to connect to the proxy. If not specified, the
|
| 754 | default of <code>null</code> is used.</p>
|
| 755 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">portHeader</code></td><td align="left" valign="center">
|
| 756 | <p>Name of the HTTP Header read by this valve that holds the port
|
| 757 | used by the client to connect to the proxy. If not specified, the
|
| 758 | default of <code>null</code> is used.</p>
|
| 759 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">protocolHeaderHttpsValue</code></td><td align="left" valign="center">
|
| 760 | <p>Value of the <strong>protocolHeader</strong> to indicate that it is
|
| 761 | an HTTPS request. If not specified, the default of <code>https</code> is
|
| 762 | used.</p>
|
| 763 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">httpServerPort</code></td><td align="left" valign="center">
|
| 764 | <p>Value returned by <code>ServletRequest.getServerPort()</code>
|
| 765 | when the <strong>protocolHeader</strong> indicates <code>http</code>
|
| 766 | protocol and no <strong>portHeader</strong> is present. If not
|
| 767 | specified, the default of <code>80</code> is used.</p>
|
| 768 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">httpsServerPort</code></td><td align="left" valign="center">
|
| 769 | <p>Value returned by <code>ServletRequest.getServerPort()</code>
|
| 770 | when the <strong>protocolHeader</strong> indicates <code>https</code>
|
| 771 | protocol and no <strong>portHeader</strong> is present. If not
|
| 772 | specified, the default of <code>443</code> is used.</p>
|
| 773 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeLocalPort</code></td><td align="left" valign="center">
|
| 774 | <p>If <code>true</code>, the value returned by
|
| 775 | <code>ServletRequest.getLocalPort()</code> and
|
| 776 | <code>ServletRequest.getServerPort()</code> is modified by the this
|
| 777 | valve. If not specified, the default of <code>false</code> is used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 778 | </td></tr></table>
|
| 779 |
|
| 780 | </blockquote></td></tr></table>
|
| 781 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 782 | </blockquote></td></tr></table>
|
| 783 |
|
| 784 |
|
| 785 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Valve"><!--()--></a><a name="SSL_Valve"><strong>SSL Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 786 |
|
| 787 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Valve/Introduction"><!--()--></a><a name="SSL_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 788 |
|
| 789 | <p>When using mod_proxy_http, the client SSL information is not included in
|
| 790 | the protocol (unlike mod_jk and mod_proxy_ajp). To make the client SSL
|
| 791 | information available to Tomcat, some additional configuration is required.
|
| 792 | In httpd, mod_headers is used to add the SSL information as HTTP headers. In
|
| 793 | Tomcat, this valve is used to read the information from the HTTP headers and
|
| 794 | insert it into the request.</p>
|
| 795 |
|
| 796 | <p>Note: Ensure that the headers are always set by httpd for all requests to
|
| 797 | prevent a client spoofing SSL information by sending fake headers.</p>
|
| 798 |
|
| 799 | <p>To configure httpd to set the necessary headers, add the following:</p>
|
| 800 | <div class="codeBox"><pre><code><IfModule ssl_module>
|
| 801 | RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
|
| 802 | RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
|
| 803 | RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
|
| 804 | RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
|
| 805 | </IfModule></code></pre></div>
|
| 806 |
|
| 807 | </blockquote></td></tr></table>
|
| 808 |
|
| 809 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Valve/Attributes"><!--()--></a><a name="SSL_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 810 |
|
| 811 | <p>The <strong>SSL Valve</strong> supports the following configuration
|
| 812 | attribute:</p>
|
| 813 |
|
| 814 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 815 | <p>Java class name of the implementation to use. This MUST be set to
|
| 816 | <strong>org.apache.catalina.valves.SSLValve</strong>.
|
| 817 | </p>
|
| 818 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslClientCertHeader</code></td><td align="left" valign="center">
|
| 819 | <p>Allows setting a custom name for the ssl_client_cert header.
|
| 820 | If not specified, the default of <code>ssl_client_cert</code> is
|
| 821 | used.</p>
|
| 822 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslCipherHeader</code></td><td align="left" valign="center">
|
| 823 | <p>Allows setting a custom name for the ssl_cipher header.
|
| 824 | If not specified, the default of <code>ssl_cipher</code> is
|
| 825 | used.</p>
|
| 826 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslSessionIdHeader</code></td><td align="left" valign="center">
|
| 827 | <p>Allows setting a custom name for the ssl_session_id header.
|
| 828 | If not specified, the default of <code>ssl_session_id</code> is
|
| 829 | used.</p>
|
| 830 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslCipherUserKeySizeHeader</code></td><td align="left" valign="center">
|
| 831 | <p>Allows setting a custom name for the ssl_cipher_usekeysize header.
|
| 832 | If not specified, the default of <code>ssl_cipher_usekeysize</code> is
|
| 833 | used.</p>
|
| 834 | </td></tr></table>
|
| 835 |
|
| 836 | </blockquote></td></tr></table>
|
| 837 |
|
| 838 | </blockquote></td></tr></table>
|
| 839 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 840 |
|
| 841 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Single Sign On Valve"><!--()--></a><a name="Single_Sign_On_Valve"><strong>Single Sign On Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 842 |
|
| 843 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Single Sign On Valve/Introduction"><!--()--></a><a name="Single_Sign_On_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 844 |
|
| 845 | <p>The <em>Single Sign On Valve</em> is utilized when you wish to give users
|
| 846 | the ability to sign on to any one of the web applications associated with
|
| 847 | your virtual host, and then have their identity recognized by all other
|
| 848 | web applications on the same virtual host.</p>
|
| 849 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 850 | <p>See the <a href="host.html#Single_Sign_On">Single Sign On</a> special
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 851 | feature on the <strong>Host</strong> element for more information.</p>
|
| 852 |
|
| 853 | </blockquote></td></tr></table>
|
| 854 |
|
| 855 |
|
| 856 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Single Sign On Valve/Attributes"><!--()--></a><a name="Single_Sign_On_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 857 |
|
| 858 | <p>The <strong>Single Sign On</strong> Valve supports the following
|
| 859 | configuration attributes:</p>
|
| 860 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 861 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 862 | <p>Java class name of the implementation to use. This MUST be set to
|
| 863 | <strong>org.apache.catalina.authenticator.SingleSignOn</strong>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 864 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">requireReauthentication</code></td><td align="left" valign="center">
|
| 865 | <p>Default false. Flag to determine whether each request needs to be
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 866 | reauthenticated to the security <strong>Realm</strong>. If "true", this
|
| 867 | Valve uses cached security credentials (username and password) to
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 868 | reauthenticate to the <strong>Realm</strong> each request associated
|
| 869 | with an SSO session. If "false", the Valve can itself authenticate
|
| 870 | requests based on the presence of a valid SSO cookie, without
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 871 | rechecking with the <strong>Realm</strong>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 872 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">cookieDomain</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 873 | <p>Sets the host domain to be used for sso cookies.</p>
|
| 874 | </td></tr></table>
|
| 875 |
|
| 876 | </blockquote></td></tr></table>
|
| 877 |
|
| 878 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 879 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Authentication"><strong>Authentication</strong></a></font></td></tr><tr><td><blockquote>
|
| 880 |
|
| 881 | <p>The valves in this section implement
|
| 882 | <strong>org.apache.catalina.Authenticator</strong> interface.</p>
|
| 883 |
|
| 884 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Basic Authenticator Valve"><!--()--></a><a name="Basic_Authenticator_Valve"><strong>Basic Authenticator Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 885 |
|
| 886 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Basic Authenticator Valve/Introduction"><!--()--></a><a name="Basic_Authenticator_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 887 |
|
| 888 | <p>The <strong>Basic Authenticator Valve</strong> is automatically added to
|
| 889 | any <a href="context.html">Context</a> that is configured to use BASIC
|
| 890 | authentication.</p>
|
| 891 |
|
| 892 | <p>If any non-default settings are required, the valve may be configured
|
| 893 | within <a href="context.html">Context</a> element with the required
|
| 894 | values.</p>
|
| 895 |
|
| 896 | </blockquote></td></tr></table>
|
| 897 |
|
| 898 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Basic Authenticator Valve/Attributes"><!--()--></a><a name="Basic_Authenticator_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 899 |
|
| 900 | <p>The <strong>Basic Authenticator Valve</strong> supports the following
|
| 901 | configuration attributes:</p>
|
| 902 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 903 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
|
| 904 | <p>Should a session always be used once a user is authenticated? This
|
| 905 | may offer some performance benefits since the session can then be used
|
| 906 | to cache the authenticated Principal, hence removing the need to
|
| 907 | authenticate the user via the Realm on every request. This may be of
|
| 908 | help for combinations such as BASIC authentication used with the
|
| 909 | JNDIRealm or DataSourceRealms. However there will also be the
|
| 910 | performance cost of creating and GC'ing the session. If not set, the
|
| 911 | default value of <code>false</code> will be used.</p>
|
| 912 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
|
| 913 | <p>Should we cache authenticated Principals if the request is part of an
|
| 914 | HTTP session? If not specified, the default value of <code>true</code>
|
| 915 | will be used.</p>
|
| 916 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 917 | <p>Controls if the session ID is changed if a session exists at the
|
| 918 | point where users are authenticated. This is to prevent session fixation
|
| 919 | attacks. If not set, the default value of <code>true</code> will be
|
| 920 | used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 921 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 922 | <p>Java class name of the implementation to use. This MUST be set to
|
| 923 | <strong>org.apache.catalina.authenticator.BasicAuthenticator</strong>.</p>
|
| 924 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 925 | <p>Controls the caching of pages that are protected by security
|
| 926 | constraints. Setting this to <code>false</code> may help work around
|
| 927 | caching issues in some browsers but will also cause secured pages to be
|
| 928 | cached by proxies which will almost certainly be a security issue.
|
| 929 | <code>securePagesWithPragma</code> offers an alternative, secure,
|
| 930 | workaround for browser caching issues. If not set, the default value of
|
| 931 | <code>true</code> will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 932 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 933 | <p>Controls the caching of pages that are protected by security
|
| 934 | constraints. Setting this to <code>false</code> may help work around
|
| 935 | caching issues in some browsers by using
|
| 936 | <code>Cache-Control: private</code> rather than the default of
|
| 937 | <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 938 | If not set, the default value of <code>false</code> will be used.</p>
|
| 939 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
|
| 940 | <p>Name of the algorithm to use to create the
|
| 941 | <code>java.security.SecureRandom</code> instances that generate session
|
| 942 | IDs. If an invalid algorithm and/or provider is specified, the platform
|
| 943 | default provider and the default algorithm will be used. If not
|
| 944 | specified, the default algorithm of SHA1PRNG will be used. If the
|
| 945 | default algorithm is not supported, the platform default will be used.
|
| 946 | To specify that the platform default should be used, do not set the
|
| 947 | secureRandomProvider attribute and set this attribute to the empty
|
| 948 | string.</p>
|
| 949 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
|
| 950 | <p>Name of the Java class that extends
|
| 951 | <code>java.security.SecureRandom</code> to use to generate SSO session
|
| 952 | IDs. If not specified, the default value is
|
| 953 | <code>java.security.SecureRandom</code>.</p>
|
| 954 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
|
| 955 | <p>Name of the provider to use to create the
|
| 956 | <code>java.security.SecureRandom</code> instances that generate SSO
|
| 957 | session IDs. If an invalid algorithm and/or provider is specified, the
|
| 958 | platform default provider and the default algorithm will be used. If not
|
| 959 | specified, the platform default provider will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 960 | </td></tr></table>
|
| 961 |
|
| 962 | </blockquote></td></tr></table>
|
| 963 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 964 | </blockquote></td></tr></table>
|
| 965 |
|
| 966 |
|
| 967 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Digest Authenticator Valve"><!--()--></a><a name="Digest_Authenticator_Valve"><strong>Digest Authenticator Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 968 |
|
| 969 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Digest Authenticator Valve/Introduction"><!--()--></a><a name="Digest_Authenticator_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 970 |
|
| 971 | <p>The <strong>Digest Authenticator Valve</strong> is automatically added to
|
| 972 | any <a href="context.html">Context</a> that is configured to use DIGEST
|
| 973 | authentication.</p>
|
| 974 |
|
| 975 | <p>If any non-default settings are required, the valve may be configured
|
| 976 | within <a href="context.html">Context</a> element with the required
|
| 977 | values.</p>
|
| 978 |
|
| 979 | </blockquote></td></tr></table>
|
| 980 |
|
| 981 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Digest Authenticator Valve/Attributes"><!--()--></a><a name="Digest_Authenticator_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 982 |
|
| 983 | <p>The <strong>Digest Authenticator Valve</strong> supports the following
|
| 984 | configuration attributes:</p>
|
| 985 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 986 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
|
| 987 | <p>Should a session always be used once a user is authenticated? This
|
| 988 | may offer some performance benefits since the session can then be used
|
| 989 | to cache the authenticated Principal, hence removing the need to
|
| 990 | authenticate the user via the Realm on every request. This may be of
|
| 991 | help for combinations such as BASIC authentication used with the
|
| 992 | JNDIRealm or DataSourceRealms. However there will also be the
|
| 993 | performance cost of creating and GC'ing the session. If not set, the
|
| 994 | default value of <code>false</code> will be used.</p>
|
| 995 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 996 | <p>Should we cache authenticated Principals if the request is part of an
|
| 997 | HTTP session? If not specified, the default value of <code>false</code>
|
| 998 | will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 999 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1000 | <p>Controls if the session ID is changed if a session exists at the
|
| 1001 | point where users are authenticated. This is to prevent session fixation
|
| 1002 | attacks. If not set, the default value of <code>true</code> will be
|
| 1003 | used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1004 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 1005 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1006 | <strong>org.apache.catalina.authenticator.DigestAuthenticator</strong>.</p>
|
| 1007 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1008 | <p>Controls the caching of pages that are protected by security
|
| 1009 | constraints. Setting this to <code>false</code> may help work around
|
| 1010 | caching issues in some browsers but will also cause secured pages to be
|
| 1011 | cached by proxies which will almost certainly be a security issue.
|
| 1012 | <code>securePagesWithPragma</code> offers an alternative, secure,
|
| 1013 | workaround for browser caching issues. If not set, the default value of
|
| 1014 | <code>true</code> will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1015 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">key</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1016 | <p>The secret key used by digest authentication. If not set, a secure
|
| 1017 | random value is generated. This should normally only be set when it is
|
| 1018 | necessary to keep key values constant either across server restarts
|
| 1019 | and/or across a cluster.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1020 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceCacheSize</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1021 | <p>To protect against replay attacks, the DIGEST authenticator tracks
|
| 1022 | server nonce and nonce count values. This attribute controls the size
|
| 1023 | of that cache. If not specified, the default value of 1000 is used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1024 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceCountWindowSize</code></td><td align="left" valign="center">
|
| 1025 | <p>Client requests may be processed out of order which in turn means
|
| 1026 | that the nonce count values may be processed out of order. To prevent
|
| 1027 | authentication failures when nonce counts are presented out of order
|
| 1028 | the authenticator tracks a window of nonce count values. This attribute
|
| 1029 | controls how big that window is. If not specified, the default value of
|
| 1030 | 100 is used.</p>
|
| 1031 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceValidity</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1032 | <p>The time, in milliseconds, that a server generated nonce will be
|
| 1033 | considered valid for use in authentication. If not specified, the
|
| 1034 | default value of 300000 (5 minutes) will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1035 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">opaque</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1036 | <p>The opaque server string used by digest authentication. If not set, a
|
| 1037 | random value is generated. This should normally only be set when it is
|
| 1038 | necessary to keep opaque values constant either across server restarts
|
| 1039 | and/or across a cluster.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1040 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1041 | <p>Controls the caching of pages that are protected by security
|
| 1042 | constraints. Setting this to <code>false</code> may help work around
|
| 1043 | caching issues in some browsers by using
|
| 1044 | <code>Cache-Control: private</code> rather than the default of
|
| 1045 | <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1046 | If not set, the default value of <code>false</code> will be used.</p>
|
| 1047 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
|
| 1048 | <p>Name of the algorithm to use to create the
|
| 1049 | <code>java.security.SecureRandom</code> instances that generate session
|
| 1050 | IDs. If an invalid algorithm and/or provider is specified, the platform
|
| 1051 | default provider and the default algorithm will be used. If not
|
| 1052 | specified, the default algorithm of SHA1PRNG will be used. If the
|
| 1053 | default algorithm is not supported, the platform default will be used.
|
| 1054 | To specify that the platform default should be used, do not set the
|
| 1055 | secureRandomProvider attribute and set this attribute to the empty
|
| 1056 | string.</p>
|
| 1057 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
|
| 1058 | <p>Name of the Java class that extends
|
| 1059 | <code>java.security.SecureRandom</code> to use to generate SSO session
|
| 1060 | IDs. If not specified, the default value is
|
| 1061 | <code>java.security.SecureRandom</code>.</p>
|
| 1062 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
|
| 1063 | <p>Name of the provider to use to create the
|
| 1064 | <code>java.security.SecureRandom</code> instances that generate SSO
|
| 1065 | session IDs. If an invalid algorithm and/or provider is specified, the
|
| 1066 | platform default provider and the default algorithm will be used. If not
|
| 1067 | specified, the platform default provider will be used.</p>
|
| 1068 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">validateUri</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1069 | <p>Should the URI be validated as required by RFC2617? If not specified,
|
| 1070 | the default value of <code>true</code> will be used. This should
|
| 1071 | normally only be set when Tomcat is located behind a reverse proxy and
|
| 1072 | the proxy is modifying the URI passed to Tomcat such that DIGEST
|
| 1073 | authentication always fails.</p>
|
| 1074 | </td></tr></table>
|
| 1075 |
|
| 1076 | </blockquote></td></tr></table>
|
| 1077 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1078 | </blockquote></td></tr></table>
|
| 1079 |
|
| 1080 |
|
| 1081 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Form Authenticator Valve"><!--()--></a><a name="Form_Authenticator_Valve"><strong>Form Authenticator Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1082 |
|
| 1083 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Form Authenticator Valve/Introduction"><!--()--></a><a name="Form_Authenticator_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1084 |
|
| 1085 | <p>The <strong>Form Authenticator Valve</strong> is automatically added to
|
| 1086 | any <a href="context.html">Context</a> that is configured to use FORM
|
| 1087 | authentication.</p>
|
| 1088 |
|
| 1089 | <p>If any non-default settings are required, the valve may be configured
|
| 1090 | within <a href="context.html">Context</a> element with the required
|
| 1091 | values.</p>
|
| 1092 |
|
| 1093 | </blockquote></td></tr></table>
|
| 1094 |
|
| 1095 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Form Authenticator Valve/Attributes"><!--()--></a><a name="Form_Authenticator_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 1096 |
|
| 1097 | <p>The <strong>Form Authenticator Valve</strong> supports the following
|
| 1098 | configuration attributes:</p>
|
| 1099 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1100 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1101 | <p>Controls if the session ID is changed if a session exists at the
|
| 1102 | point where users are authenticated. This is to prevent session fixation
|
| 1103 | attacks. If not set, the default value of <code>true</code> will be
|
| 1104 | used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1105 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">characterEncoding</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1106 | <p>Character encoding to use to read the username and password parameters
|
| 1107 | from the request. If not set, the encoding of the request body will be
|
| 1108 | used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1109 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 1110 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1111 | <strong>org.apache.catalina.authenticator.FormAuthenticator</strong>.</p>
|
| 1112 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1113 | <p>Controls the caching of pages that are protected by security
|
| 1114 | constraints. Setting this to <code>false</code> may help work around
|
| 1115 | caching issues in some browsers but will also cause secured pages to be
|
| 1116 | cached by proxies which will almost certainly be a security issue.
|
| 1117 | <code>securePagesWithPragma</code> offers an alternative, secure,
|
| 1118 | workaround for browser caching issues. If not set, the default value of
|
| 1119 | <code>true</code> will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1120 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">landingPage</code></td><td align="left" valign="center">
|
| 1121 | <p>Controls the behavior of the FORM authentication process if the
|
| 1122 | process is misused, for example by directly requesting the login page
|
| 1123 | or delaying logging in for so long that the session expires. If this
|
| 1124 | attribute is set, rather than returning an error response code, Tomcat
|
| 1125 | will redirect the user to the specified landing page if the login form
|
| 1126 | is submitted with valid credentials. For the login to be processed, the
|
| 1127 | landing page must be a protected resource (i.e. one that requires
|
| 1128 | authentication). If the landing page does not require authentication
|
| 1129 | then the user will not be logged in and will be prompted for their
|
| 1130 | credentials again when they access a protected page.</p>
|
| 1131 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1132 | <p>Controls the caching of pages that are protected by security
|
| 1133 | constraints. Setting this to <code>false</code> may help work around
|
| 1134 | caching issues in some browsers by using
|
| 1135 | <code>Cache-Control: private</code> rather than the default of
|
| 1136 | <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1137 | If not set, the default value of <code>false</code> will be used.</p>
|
| 1138 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
|
| 1139 | <p>Name of the algorithm to use to create the
|
| 1140 | <code>java.security.SecureRandom</code> instances that generate session
|
| 1141 | IDs. If an invalid algorithm and/or provider is specified, the platform
|
| 1142 | default provider and the default algorithm will be used. If not
|
| 1143 | specified, the default algorithm of SHA1PRNG will be used. If the
|
| 1144 | default algorithm is not supported, the platform default will be used.
|
| 1145 | To specify that the platform default should be used, do not set the
|
| 1146 | secureRandomProvider attribute and set this attribute to the empty
|
| 1147 | string.</p>
|
| 1148 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
|
| 1149 | <p>Name of the Java class that extends
|
| 1150 | <code>java.security.SecureRandom</code> to use to generate SSO session
|
| 1151 | IDs. If not specified, the default value is
|
| 1152 | <code>java.security.SecureRandom</code>.</p>
|
| 1153 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
|
| 1154 | <p>Name of the provider to use to create the
|
| 1155 | <code>java.security.SecureRandom</code> instances that generate SSO
|
| 1156 | session IDs. If an invalid algorithm and/or provider is specified, the
|
| 1157 | platform default provider and the default algorithm will be used. If not
|
| 1158 | specified, the platform default provider will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1159 | </td></tr></table>
|
| 1160 |
|
| 1161 | </blockquote></td></tr></table>
|
| 1162 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1163 | </blockquote></td></tr></table>
|
| 1164 |
|
| 1165 |
|
| 1166 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Authenticator Valve"><!--()--></a><a name="SSL_Authenticator_Valve"><strong>SSL Authenticator Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1167 |
|
| 1168 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Authenticator Valve/Introduction"><!--()--></a><a name="SSL_Authenticator_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1169 |
|
| 1170 | <p>The <strong>SSL Authenticator Valve</strong> is automatically added to
|
| 1171 | any <a href="context.html">Context</a> that is configured to use SSL
|
| 1172 | authentication.</p>
|
| 1173 |
|
| 1174 | <p>If any non-default settings are required, the valve may be configured
|
| 1175 | within <a href="context.html">Context</a> element with the required
|
| 1176 | values.</p>
|
| 1177 |
|
| 1178 | </blockquote></td></tr></table>
|
| 1179 |
|
| 1180 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Authenticator Valve/Attributes"><!--()--></a><a name="SSL_Authenticator_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 1181 |
|
| 1182 | <p>The <strong>SSL Authenticator Valve</strong> supports the following
|
| 1183 | configuration attributes:</p>
|
| 1184 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1185 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
|
| 1186 | <p>Should we cache authenticated Principals if the request is part of an
|
| 1187 | HTTP session? If not specified, the default value of <code>true</code>
|
| 1188 | will be used.</p>
|
| 1189 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1190 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1191 | <strong>org.apache.catalina.authenticator.SSLAuthenticator</strong>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1192 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1193 | <p>Controls if the session ID is changed if a session exists at the
|
| 1194 | point where users are authenticated. This is to prevent session fixation
|
| 1195 | attacks. If not set, the default value of <code>true</code> will be
|
| 1196 | used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1197 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1198 | <p>Controls the caching of pages that are protected by security
|
| 1199 | constraints. Setting this to <code>false</code> may help work around
|
| 1200 | caching issues in some browsers but will also cause secured pages to be
|
| 1201 | cached by proxies which will almost certainly be a security issue.
|
| 1202 | <code>securePagesWithPragma</code> offers an alternative, secure,
|
| 1203 | workaround for browser caching issues. If not set, the default value of
|
| 1204 | <code>true</code> will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1205 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1206 | <p>Controls the caching of pages that are protected by security
|
| 1207 | constraints. Setting this to <code>false</code> may help work around
|
| 1208 | caching issues in some browsers by using
|
| 1209 | <code>Cache-Control: private</code> rather than the default of
|
| 1210 | <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1211 | If not set, the default value of <code>false</code> will be used.</p>
|
| 1212 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
|
| 1213 | <p>Name of the algorithm to use to create the
|
| 1214 | <code>java.security.SecureRandom</code> instances that generate session
|
| 1215 | IDs. If an invalid algorithm and/or provider is specified, the platform
|
| 1216 | default provider and the default algorithm will be used. If not
|
| 1217 | specified, the default algorithm of SHA1PRNG will be used. If the
|
| 1218 | default algorithm is not supported, the platform default will be used.
|
| 1219 | To specify that the platform default should be used, do not set the
|
| 1220 | secureRandomProvider attribute and set this attribute to the empty
|
| 1221 | string.</p>
|
| 1222 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
|
| 1223 | <p>Name of the Java class that extends
|
| 1224 | <code>java.security.SecureRandom</code> to use to generate SSO session
|
| 1225 | IDs. If not specified, the default value is
|
| 1226 | <code>java.security.SecureRandom</code>.</p>
|
| 1227 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
|
| 1228 | <p>Name of the provider to use to create the
|
| 1229 | <code>java.security.SecureRandom</code> instances that generate SSO
|
| 1230 | session IDs. If an invalid algorithm and/or provider is specified, the
|
| 1231 | platform default provider and the default algorithm will be used. If not
|
| 1232 | specified, the platform default provider will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1233 | </td></tr></table>
|
| 1234 |
|
| 1235 | </blockquote></td></tr></table>
|
| 1236 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1237 | </blockquote></td></tr></table>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1238 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1239 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1240 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SPNEGO Valve"><!--()--></a><a name="SPNEGO_Valve"><strong>SPNEGO Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 1241 |
|
| 1242 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SPNEGO Valve/Introduction"><!--()--></a><a name="SPNEGO_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1243 |
|
| 1244 | <p>The <strong>SPNEGO Authenticator Valve</strong> is automatically added to
|
| 1245 | any <a href="context.html">Context</a> that is configured to use SPNEGO
|
| 1246 | authentication.</p>
|
| 1247 |
|
| 1248 | <p>If any non-default settings are required, the valve may be configured
|
| 1249 | within <a href="context.html">Context</a> element with the required
|
| 1250 | values.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1251 |
|
| 1252 | </blockquote></td></tr></table>
|
| 1253 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1254 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SPNEGO Valve/Attributes"><!--()--></a><a name="SPNEGO_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1255 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1256 | <p>The <strong>SPNEGO Authenticator Valve</strong> supports the following
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1257 | configuration attributes:</p>
|
| 1258 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1259 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">applyJava8u40Fix</code></td><td align="left" valign="center">
|
| 1260 | <p>A fix introduced in Java 8 update 40 (
|
| 1261 | <a href="https://bugs.openjdk.java.net/browse/JDK-8048194">JDK-8048194</a>)
|
| 1262 | onwards broke SPNEGO authentication for IE with Tomcat running on
|
| 1263 | Windows 2008 R2 servers. This option enables a work-around that allows
|
| 1264 | SPNEGO authentication to continue working. The work-around should not
|
| 1265 | impact other configurations so it is enabled by default. If necessary,
|
| 1266 | the workaround can be disabled by setting this attribute to
|
| 1267 | <code>false</code>.</p>
|
| 1268 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
|
| 1269 | <p>Should a session always be used once a user is authenticated? This
|
| 1270 | may offer some performance benefits since the session can then be used
|
| 1271 | to cache the authenticated Principal, hence removing the need to
|
| 1272 | authenticate the user on every request. This will also help with clients
|
| 1273 | that assume that the server will cache the authenticated user. However
|
| 1274 | there will also be the performance cost of creating and GC'ing the
|
| 1275 | session. For an alternative solution see
|
| 1276 | <code>noKeepAliveUserAgents</code>. If not set, the default value of
|
| 1277 | <code>false</code> will be used.</p>
|
| 1278 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
|
| 1279 | <p>Should we cache authenticated Principals if the request is part of an
|
| 1280 | HTTP session? If not specified, the default value of <code>true</code>
|
| 1281 | will be used.</p>
|
| 1282 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1283 | <p>Java class name of the implementation to use. This MUST be set to
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1284 | <strong>org.apache.catalina.authenticator.SpnegoAuthenticator</strong>.
|
| 1285 | </p>
|
| 1286 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
|
| 1287 | <p>Controls if the session ID is changed if a session exists at the
|
| 1288 | point where users are authenticated. This is to prevent session fixation
|
| 1289 | attacks. If not set, the default value of <code>true</code> will be
|
| 1290 | used.</p>
|
| 1291 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
|
| 1292 | <p>Controls the caching of pages that are protected by security
|
| 1293 | constraints. Setting this to <code>false</code> may help work around
|
| 1294 | caching issues in some browsers but will also cause secured pages to be
|
| 1295 | cached by proxies which will almost certainly be a security issue.
|
| 1296 | <code>securePagesWithPragma</code> offers an alternative, secure,
|
| 1297 | workaround for browser caching issues. If not set, the default value of
|
| 1298 | <code>true</code> will be used.</p>
|
| 1299 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">loginConfigName</code></td><td align="left" valign="center">
|
| 1300 | <p>The name of the JAAS login configuration to be used to login as the
|
| 1301 | service. If not specified, the default of
|
| 1302 | <code>com.sun.security.jgss.krb5.accept</code> is used.</p>
|
| 1303 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">noKeepAliveUserAgents</code></td><td align="left" valign="center">
|
| 1304 | <p>Some clients (not most browsers) expect the server to cache the
|
| 1305 | authenticated user information for a connection and do not resend the
|
| 1306 | credentials with every request. Tomcat will not do this unless an HTTP
|
| 1307 | session is available. A session will be available if either the
|
| 1308 | application creates one or if <code>alwaysUseSession</code> is enabled
|
| 1309 | for this Authenticator.</p>
|
| 1310 | <p>As an alternative to creating a session, this attribute may be used
|
| 1311 | to define the user agents for which HTTP keep-alive is disabled. This
|
| 1312 | means that a connection will only used for a single request and hence
|
| 1313 | there is no ability to cache authenticated user information per
|
| 1314 | connection. There will be a performance cost in disabling HTTP
|
| 1315 | keep-alive.</p>
|
| 1316 | <p>The attribute should be a regular expression that matches the entire
|
| 1317 | user-agent string, e.g. <code>.*Chrome.*</code>. If not specified, no
|
| 1318 | regular expression will be defined and no user agents will have HTTP
|
| 1319 | keep-alive disabled.</p>
|
| 1320 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
|
| 1321 | <p>Controls the caching of pages that are protected by security
|
| 1322 | constraints. Setting this to <code>false</code> may help work around
|
| 1323 | caching issues in some browsers by using
|
| 1324 | <code>Cache-Control: private</code> rather than the default of
|
| 1325 | <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
|
| 1326 | If not set, the default value of <code>false</code> will be used.</p>
|
| 1327 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
|
| 1328 | <p>Name of the algorithm to use to create the
|
| 1329 | <code>java.security.SecureRandom</code> instances that generate session
|
| 1330 | IDs. If an invalid algorithm and/or provider is specified, the platform
|
| 1331 | default provider and the default algorithm will be used. If not
|
| 1332 | specified, the default algorithm of SHA1PRNG will be used. If the
|
| 1333 | default algorithm is not supported, the platform default will be used.
|
| 1334 | To specify that the platform default should be used, do not set the
|
| 1335 | secureRandomProvider attribute and set this attribute to the empty
|
| 1336 | string.</p>
|
| 1337 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
|
| 1338 | <p>Name of the Java class that extends
|
| 1339 | <code>java.security.SecureRandom</code> to use to generate SSO session
|
| 1340 | IDs. If not specified, the default value is
|
| 1341 | <code>java.security.SecureRandom</code>.</p>
|
| 1342 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
|
| 1343 | <p>Name of the provider to use to create the
|
| 1344 | <code>java.security.SecureRandom</code> instances that generate SSO
|
| 1345 | session IDs. If an invalid algorithm and/or provider is specified, the
|
| 1346 | platform default provider and the default algorithm will be used. If not
|
| 1347 | specified, the platform default provider will be used.</p>
|
| 1348 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">storeDelegatedCredential</code></td><td align="left" valign="center">
|
| 1349 | <p>Controls if the user' delegated credential will be stored in
|
| 1350 | the user Principal. If available, the delegated credential will be
|
| 1351 | available to applications (e.g. for onward authentication to external
|
| 1352 | services) via the <code>org.apache.catalina.realm.GSS_CREDENTIAL</code>
|
| 1353 | request attribute. If not set, the default value of <code>true</code>
|
| 1354 | will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1355 | </td></tr></table>
|
| 1356 |
|
| 1357 | </blockquote></td></tr></table>
|
| 1358 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1359 | </blockquote></td></tr></table>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1360 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1361 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1362 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Error Report Valve"><!--()--></a><a name="Error_Report_Valve"><strong>Error Report Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 1363 |
|
| 1364 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Error Report Valve/Introduction"><!--()--></a><a name="Error_Report_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1365 |
|
| 1366 | <p>The <strong>Error Report Valve</strong> is a simple error handler
|
| 1367 | for HTTP status codes that will generate and return HTML error pages.</p>
|
| 1368 |
|
| 1369 | <p><strong>NOTE:</strong> Disabling both showServerInfo and showReport will
|
| 1370 | only return the HTTP status code and remove all CSS.</p>
|
| 1371 |
|
| 1372 | </blockquote></td></tr></table>
|
| 1373 |
|
| 1374 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Error Report Valve/Attributes"><!--()--></a><a name="Error_Report_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 1375 |
|
| 1376 | <p>The <strong>Error Report Valve</strong> supports the following
|
| 1377 | configuration attributes:</p>
|
| 1378 |
|
| 1379 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 1380 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1381 | <strong>org.apache.catalina.valves.ErrorReportValve</strong> to use the
|
| 1382 | default error report valve.</p>
|
| 1383 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">showReport</code></td><td align="left" valign="center">
|
| 1384 | <p>Flag to determine if the error report is presented when an error
|
| 1385 | occurs. If set to <code>false</code>, then the error report is not in
|
| 1386 | the HTML response.
|
| 1387 | Default value: <code>true</code>
|
| 1388 | </p>
|
| 1389 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">showServerInfo</code></td><td align="left" valign="center">
|
| 1390 | <p>Flag to determine if server information is presented when an error
|
| 1391 | occurs. If set to <code>false</code>, then the server version is not
|
| 1392 | returned in the HTML response.
|
| 1393 | Default value: <code>true</code>
|
| 1394 | </p>
|
| 1395 | </td></tr></table>
|
| 1396 |
|
| 1397 | </blockquote></td></tr></table>
|
| 1398 |
|
| 1399 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Crawler Session Manager Valve"><!--()--></a><a name="Crawler_Session_Manager_Valve"><strong>Crawler Session Manager Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 1400 |
|
| 1401 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Crawler Session Manager Valve/Introduction"><!--()--></a><a name="Crawler_Session_Manager_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1402 |
|
| 1403 | <p>Web crawlers can trigger the creation of many thousands of sessions as
|
| 1404 | they crawl a site which may result in significant memory consumption. This
|
| 1405 | Valve ensures that crawlers are associated with a single session - just like
|
| 1406 | normal users - regardless of whether or not they provide a session token
|
| 1407 | with their requests.</p>
|
| 1408 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1409 | <p>This Valve may be used at the <code>Engine</code>, <code>Host</code> or
|
| 1410 | <code>Context</code> level as required. Normally, this Valve would be used
|
| 1411 | at the <code>Engine</code> level.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1412 |
|
| 1413 | <p>If used in conjunction with Remote IP valve then the Remote IP valve
|
| 1414 | should be defined before this valve to ensure that the correct client IP
|
| 1415 | address is presented to this valve.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1416 |
|
| 1417 | </blockquote></td></tr></table>
|
| 1418 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1419 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Crawler Session Manager Valve/Attributes"><!--()--></a><a name="Crawler_Session_Manager_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1420 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1421 | <p>The <strong>Crawler Session Manager Valve</strong> supports the
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1422 | following configuration attributes:</p>
|
| 1423 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1424 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1425 | <p>Java class name of the implementation to use. This MUST be set to
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1426 | <strong>org.apache.catalina.valves.CrawlerSessionManagerValve</strong>.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1427 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1428 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">crawlerUserAgents</code></td><td align="left" valign="center">
|
| 1429 | <p>Regular expression (using <code>java.util.regex</code>) that the user
|
| 1430 | agent HTTP request header is matched against to determine if a request
|
| 1431 | is from a web crawler. If not set, the default of
|
| 1432 | <code>.*[bB]ot.*|.*Yahoo! Slurp.*|.*Feedfetcher-Google.*</code> is used.</p>
|
| 1433 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sessionInactiveInterval</code></td><td align="left" valign="center">
|
| 1434 | <p>The minimum time in seconds that the Crawler Session Manager Valve
|
| 1435 | should keep the mapping of client IP to session ID in memory without any
|
| 1436 | activity from the client. The client IP / session cache will be
|
| 1437 | periodically purged of mappings that have been inactive for longer than
|
| 1438 | this interval. If not specified the default value of <code>60</code>
|
| 1439 | will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1440 | </td></tr></table>
|
| 1441 |
|
| 1442 | </blockquote></td></tr></table>
|
| 1443 |
|
| 1444 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Stuck Thread Detection Valve"><!--()--></a><a name="Stuck_Thread_Detection_Valve"><strong>Stuck Thread Detection Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| 1445 |
|
| 1446 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Stuck Thread Detection Valve/Introduction"><!--()--></a><a name="Stuck_Thread_Detection_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 1447 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1448 | <p>This valve allows to detect requests that take a long time to process,
|
| 1449 | which might indicate that the thread that is processing it is stuck.
|
| 1450 | Additionally it can optionally interrupt such threads to try and unblock
|
| 1451 | them.</p>
|
| 1452 | <p>When such a request is detected, the current stack trace of its thread is
|
| 1453 | written to Tomcat log with a WARN level.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1454 | <p>The IDs and names of the stuck threads are available through JMX in the
|
| 1455 | <code>stuckThreadIds</code> and <code>stuckThreadNames</code> attributes.
|
| 1456 | The IDs can be used with the standard Threading JVM MBean
|
| 1457 | (<code>java.lang:type=Threading</code>) to retrieve other information
|
| 1458 | about each stuck thread.</p>
|
| 1459 |
|
| 1460 | </blockquote></td></tr></table>
|
| 1461 |
|
| 1462 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Stuck Thread Detection Valve/Attributes"><!--()--></a><a name="Stuck_Thread_Detection_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 1463 |
|
| 1464 | <p>The <strong>Stuck Thread Detection Valve</strong> supports the
|
| 1465 | following configuration attributes:</p>
|
| 1466 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1467 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1468 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1469 | <strong>org.apache.catalina.valves.StuckThreadDetectionValve</strong>.
|
| 1470 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1471 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">threshold</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1472 | <p>Minimum duration in seconds after which a thread is considered stuck.
|
| 1473 | Default is 600 seconds. If set to 0, the detection is disabled.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1474 | <p>Note: since the detection (and optional interruption) is done in the
|
| 1475 | background thread of the Container (Engine, Host or Context) declaring
|
| 1476 | this Valve, the threshold should be higher than the
|
| 1477 | <code>backgroundProcessorDelay</code> of this Container.</p>
|
| 1478 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">interruptThreadThreshold</code></td><td align="left" valign="center">
|
| 1479 | <p>Minimum duration in seconds after which a stuck thread should be
|
| 1480 | interrupted to attempt to "free" it.</p>
|
| 1481 | <p>Note that there's no guarantee that the thread will get unstuck.
|
| 1482 | This usually works well for threads stuck on I/O or locks, but is
|
| 1483 | probably useless in case of infinite loops.</p>
|
| 1484 | <p>Default is -1 which disables the feature. To enable it, the value
|
| 1485 | must be greater or equal to <code>threshold</code>.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1486 | </td></tr></table>
|
| 1487 |
|
| 1488 | </blockquote></td></tr></table>
|
| 1489 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1490 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Semaphore Valve"><!--()--></a><a name="Semaphore_Valve"><strong>Semaphore Valve</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1491 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1492 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Semaphore Valve/Introduction"><!--()--></a><a name="Semaphore_Valve/Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1493 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1494 | <p>The <strong>Semaphore Valve</strong> is able to limit the number of
|
| 1495 | concurrent request processing threads.</p>
|
| 1496 | <p><strong>org.apache.catalina.valves.SemaphoreValve</strong> provides
|
| 1497 | methods which may be overridden by a subclass to customize behavior:</p>
|
| 1498 | <ul>
|
| 1499 | <li><b><code>controlConcurrency</code></b> may be overridden to add
|
| 1500 | conditions;</li>
|
| 1501 | <li><b><code>permitDenied</code></b> may be overridden to add error handling
|
| 1502 | when a permit isn't granted.</li>
|
| 1503 | </ul>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1504 |
|
| 1505 | </blockquote></td></tr></table>
|
| 1506 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1507 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Semaphore Valve/Attributes"><!--()--></a><a name="Semaphore_Valve/Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1508 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1509 | <p>The <strong>Semaphore Valve</strong> supports the following
|
| 1510 | configuration attributes:</p>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1511 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1512 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">block</code></td><td align="left" valign="center">
|
| 1513 | <p>Flag to determine if a thread is blocked until a permit is available.
|
| 1514 | The default value is <strong>true</strong>.</p>
|
| 1515 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">className</code></strong></td><td align="left" valign="center">
|
| 1516 | <p>Java class name of the implementation to use. This MUST be set to
|
| 1517 | <strong>org.apache.catalina.valves.SemaphoreValve</strong>.</p>
|
| 1518 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">concurrency</code></td><td align="left" valign="center">
|
| 1519 | <p>Concurrency level of the semaphore. The default value is
|
| 1520 | <strong>10</strong>.</p>
|
| 1521 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">fairness</code></td><td align="left" valign="center">
|
| 1522 | <p>Fairness of the semaphore. The default value is
|
| 1523 | <strong>false</strong>.</p>
|
| 1524 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">interruptible</code></td><td align="left" valign="center">
|
| 1525 | <p>Flag to determine if a thread may be interrupted until a permit is
|
| 1526 | available. The default value is <strong>false</strong>.</p>
|
| Hongqing Liu | 7189829 | 2014-10-15 13:31:32 +0800 | [diff] [blame] | 1527 | </td></tr></table>
|
| 1528 |
|
| 1529 | </blockquote></td></tr></table>
|
| 1530 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1531 | </blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
|
| 1532 | on improving documentation for Apache Tomcat.<br><br>
|
| 1533 | If you have trouble and need help, read
|
| 1534 | <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
|
| 1535 | and ask your question on the tomcat-users
|
| 1536 | <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
|
| 1537 | Do not ask such questions here. This is not a Q&A section.<br><br>
|
| 1538 | The Apache Comments System is explained <a href="../comments.html">here</a>.
|
| 1539 | Comments may be removed by our moderators if they are either
|
| 1540 | implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
|
| 1541 | var comments_shortname = 'tomcat';
|
| 1542 | var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/config/valve.html';
|
| 1543 | (function(w, d) {
|
| 1544 | if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
|
| 1545 | d.write('<div id="comments_thread"><\/div>');
|
| 1546 | var s = d.createElement('script');
|
| 1547 | s.type = 'text/javascript';
|
| 1548 | s.async = true;
|
| 1549 | s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
|
| 1550 | (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
|
| 1551 | }
|
| 1552 | else {
|
| 1553 | d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
|
| 1554 | }
|
| 1555 | })(window, document);
|
| 1556 | //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
|
| 1557 | Copyright © 1999-2017, Apache Software Foundation
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1558 | </em></font></div></td></tr></table></body></html> |