Urgent : Tomcat security Manager

[shaju joseph]

Hi,
In order to connect to another server from a webapp, do I need to setup the securityManager ?. Can someone please give an example of what all changes I should make in catalina.policy.
I have an application which works fine from the shell command but fails to open the socket when deployed as a servlet under tomcat 4.1.29.
TIA
SJ

[shaju joseph]

Hello....
I have setup catalina.policy in the following way.
>>
permission java.net.SocketPermission "IP ORT", "connect,accept,listen,resolve";
>>
However, when I run tomcat with security and debug option, I don't see any entry in the catalina.out for the IP I mentioned. What am doing wrong?
Anyone out there.....?

TIA

[suneel suresh]

hi
u shouldint have any problems. I am running a servlet and using jaas to authenticate by connecting thru ldap using tomcat4.1. I have granted the code base and given socket permission 'connect' and works like a charm.
regards
suneel

[suneel suresh]

oh i forgot..yes u need to run tomcat with the security manager. i use the following to startup
win32
catalina start -security
linux rh9
./catalina.sh start -security
regards
suneel

[shaju joseph]

Suneel, thanks for the reply.
I have couple of questions.
1) Do I have to use SecurityManager if I want to connect to another server from servlet? I am not using any SecurityManager from Win2000 and that works fine. Th problem comes only in HP.
2) If you run tomcat with debug option, do you see anything in catalina.out saying 'access allowed' for IP specified. I don't see anything in my catalina.out file.
Following is the params setup for running in debug option.
CATALINA_OPTS=-Djava.security.debug=access,failure

TIA

[suneel suresh]

no you do not need to run security manager to just connect to another remote server. If the remote server request explicitly for a secure connection, only https support needs to be enabled in tomcat and not security manager. I havent tried with the debug option
>>Catalina start -debug
>>Catalina start -security -debug
but i dnt think it will disp that access to socked granted. For example if u specify write access to file and write on it , it will not show that write access granted. You might have to check that with the API. For eg to check if you can write to a file ..i think it is <streamObj>.isWrtie(). Hope it helps
regards
suneel