{"action":"created","issue":{"url":"https://api.github.com/repos/Unidata/thredds/issues/267","labels_url":"https://api.github.com/repos/Unidata/thredds/issues/267/labels{/name}","comments_url":"https://api.github.com/repos/Unidata/thredds/issues/267/comments","events_url":"https://api.github.com/repos/Unidata/thredds/issues/267/events","html_url":"https://github.com/Unidata/thredds/issues/267","id":114191507,"number":267,"title":"how to tell tomcat to use web proxy? ","user":{"login":"JohnLCaron","id":613568,"avatar_url":"https://avatars.githubusercontent.com/u/613568?v=3","gravatar_id":"","url":"https://api.github.com/users/JohnLCaron","html_url":"https://github.com/JohnLCaron","followers_url":"https://api.github.com/users/JohnLCaron/followers","following_url":"https://api.github.com/users/JohnLCaron/following{/other_user}","gists_url":"https://api.github.com/users/JohnLCaron/gists{/gist_id}","starred_url":"https://api.github.com/users/JohnLCaron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JohnLCaron/subscriptions","organizations_url":"https://api.github.com/users/JohnLCaron/orgs","repos_url":"https://api.github.com/users/JohnLCaron/repos","events_url":"https://api.github.com/users/JohnLCaron/events{/privacy}","received_events_url":"https://api.github.com/users/JohnLCaron/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-10-30T03:18:33Z","updated_at":"2015-11-29T21:54:33Z","closed_at":"2015-11-29T21:54:33Z","body":"Date: Fri, 2 Oct 2015 14:59:00 +0100\r\nFrom: Alan Iwi <alan.iwi@stfc.ac.uk> (ESGF)\r\n\r\nAppears to be actually a tomcat problem? but maybe we can help him out anyway?\r\n\r\nWe do have this page:\r\n\r\nhttp://www.unidata.ucar.edu/software/thredds/v5.0/tds/reference/TomcatBehindProxyServer.html\r\n\r\nfrom Jenn, a long time ago.\r\n\r\nESGF was using TDS 4.3, not sure what version of Tomcat. Upon upgrading to Tomcat 8, the proxy thing stopped working.\r\n\r\nFrom Alan:\r\n\r\n> Do any of you have a setup where you are compelled to make outgoing http\r\n> connections via a proxy (that must be configured explicitly in clients\r\n> rather than with transparent redirect in your firewall)?\r\n>\r\n> I am having difficulty in telling tomcat to use our site proxy. It needs\r\n> to do this when talking to the attribute service at PCMDI for CMIP5 data,\r\n> and despite my attempts to configure the proxy, it is trying to talk\r\n> directly (and inevitably failing).\r\n>\r\n> I set the following environment variables (via /etc/esg.env):\r\n>\r\n> <<<<<\r\n> http_proxy=http://wwwcache.rl.ac.uk:8080/\r\n> https_proxy=http://wwwcache.rl.ac.uk:8080/\r\n> no_proxy=127.0.0.1,ceda.ac.uk,rl.ac.uk,localhost\r\n> JAVA_OPTS=\"-Dhttp.proxyHost=wwwcache.rl.ac.uk -Dhttp.proxyPort=8080\r\n> -Dhttps.proxyHost=wwwcache.rl.ac.uk -Dhttps.proxyPort=8080\r\n> -Dhttp.nonProxyHosts=127.0.0.1|localhost|rl.ac.uk|ceda.ac.uk\"\r\n> >>>>>\r\n>\r\n> The JAVA_OPTS is based on various online references - search e.g. for\r\n> \"java -Dhttp.proxyPort\" to see the sort of stuff I found.\r\n>\r\n> On client request to download a data file, following openid\r\n> authentication, I end up with a process trying to talk to PCMDI but failing\r\n> because outgoing ports 80 and 443 not via the proxy are blocked at our\r\n> site-wide outgoing firewall:\r\n>\r\n> Here is the connection status (from 'lsof'):\r\n>\r\n> <<<<<\r\n> jsvc      27172    tomcat   97r     IPv4            4822177\r\n> 0t0        TCP 130.246.142.220:60254->*MailScanner has detected a\r\n> possible fraud attempt from \"198.128.245.159:443\" claiming to be* *MailScanner\r\n> warning: numerical links are often malicious:* 198.128.245.159:443\r\n> <http://198.128.245.159:443> (SYN_SENT)\r\n> >>>>>\r\n>\r\n> Here 130... is our server, 198... is pcmdi9.llnl.gov, and SYN_SENT means\r\n> that it has initiated the handshake procedure for setting up a TCP\r\n> connection but has yet to see any reply.\r\n>\r\n> Eventually and unsurprisingly:\r\n>\r\n> <<<<<\r\n> [INFO] org.apache.commons.httpclient.HttpMethodDirector: I/O exception\r\n> (java.net.ConnectException) caught when processing request: Connection\r\n> timed out\r\n> >>>>>\r\n>\r\n> Here is the command line for the process (from 'ps'), confirming that the\r\n> flags in JAVA_OPTS indeed materialise on the command line.\r\n>\r\n> <<<<<\r\n> jsvc.exec -Djava.awt.headless=true\r\n> -Dcom.sun.enterprise.server.ss.ASQuickStartup=false\r\n> -Dcatalina.home=/usr/local/tomcat -Dtds.content.root.path=/esg/content\r\n> -Djava.util.prefs.userRoot=/esg/content/thredds/javaUtilPrefs -pidfile\r\n> /var/run/tomcat-jsvc.pid -cp\r\n> /usr/local/apache-tomcat-8.0.26/bin/bootstrap.jar:/usr/local/apache-tomcat-8.0.26/bin/tomcat-juli.jar:/usr/local/apache-tomcat-8.0.26/bin/commons-daemon.jar\r\n> -outfile /usr/local/tomcat/logs/catalina.out -errfile\r\n> /usr/local/tomcat/logs/catalina.err -user tomcat -Xmx2048m -server\r\n> -Xms1024m -XX:MaxPermSize=512m -Dhttp.proxyHost=wwwcache.rl.ac.uk\r\n> -Dhttp.proxyPort=8080 -Dhttps.proxyHost=wwwcache.rl.ac.uk\r\n> -Dhttps.proxyPort=8080 -Dhttp.nonProxyHosts=127.0.0.1|localhost|rl.ac.uk|\r\n> ceda.ac.uk -Dsun.security.ssl.allowUnsafeRenegotiation=false\r\n> org.apache.catalina.startup.Bootstrap\r\n> >>>>>\r\n>\r\n> and looking at the process environment ('e' flag on 'ps') confirms that\r\n> the variables set above (including http_proxy etc) are all still present.\r\n>\r\n> I am pretty sure I didn't previously have to do any more than what I have\r\n> already done here.\r\n>\r\n> What have I missed please?\r\n>\r\n> Thanks,\r\n> Alan"},"comment":{"url":"https://api.github.com/repos/Unidata/thredds/issues/comments/160474774","html_url":"https://github.com/Unidata/thredds/issues/267#issuecomment-160474774","issue_url":"https://api.github.com/repos/Unidata/thredds/issues/267","id":160474774,"user":{"login":"DennisHeimbigner","id":905179,"avatar_url":"https://avatars.githubusercontent.com/u/905179?v=3","gravatar_id":"","url":"https://api.github.com/users/DennisHeimbigner","html_url":"https://github.com/DennisHeimbigner","followers_url":"https://api.github.com/users/DennisHeimbigner/followers","following_url":"https://api.github.com/users/DennisHeimbigner/following{/other_user}","gists_url":"https://api.github.com/users/DennisHeimbigner/gists{/gist_id}","starred_url":"https://api.github.com/users/DennisHeimbigner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DennisHeimbigner/subscriptions","organizations_url":"https://api.github.com/users/DennisHeimbigner/orgs","repos_url":"https://api.github.com/users/DennisHeimbigner/repos","events_url":"https://api.github.com/users/DennisHeimbigner/events{/privacy}","received_events_url":"https://api.github.com/users/DennisHeimbigner/received_events","type":"User","site_admin":false},"created_at":"2015-11-29T21:54:33Z","updated_at":"2015-11-29T21:54:33Z","body":"Since there is no response, I am closing this issue."}}