1

Goal:

We use the Geoserver Extension "Key Authentication Module", to secure our Geoserver services, using the key provider as an external "Web Service". Geoserver authentication-requests to the External Web Service should use HTTPS. Due to our policy all components must communicate via HTTPS.

Issue:

The communication between the Geoserver-mapper and the PHP-Web-Server does not work via HTTPS. The configured file to External Web Service (service.php), is not called/opened at all, if HTTPS is used. https://myHost/service.php?authkey={key}

HTTP works well.

Setups and attempts:

  • We are in a testing environment
  • Tried a GeoServer-Application version 2.20 running on Tomcat 9 (https://tomcat.apache.org/) with CA-certificates (On Windows and Linux)
  • Tried a GeoServer-Application version 2.21 running on Tomcat 9 (https://tomcat.apache.org/) with self-signed-certificates (On Windows and Linux)
  • The PHP-Web-Servers (CA and self-signed-certificates) run on Apache 2.4. (https://httpd.apache.org/) (On Windows and Linux)

We have successfully set up the "Key Authentication Module" and have configured the key provider as an external "Web Service". The browser-requests to Geoserver, run well via HTTPS. The Geoserver-mapper-requests to the PHP-Web-Server, run well via HTTP. This setup works fine and as expected.

If we switch the communication between Geoserver-mapper and the PHP-Web-Server to HTTPS the requests do not reach the PHP-Web-Server.

The browser-request reaches Tomcat and reaches GeoServer and its Authkey-Module. (Authentication-setup with user-property-file in Authkey-Module works fine and works good with HTTPS. Same with non-authenticated services - that means, it seems that GeoServer can handle HTTPS)

The communication is interrupted in both setups, somewhere between Geoserver-Application and Tomcat-Server or between Tomcat-Server and PHP-Web-Server.

(The geoserver log is at the end of the description.)

Requestflow of the used components:

Actual state (works fine): Client (Browser) HTTPS -> GeoServer (Tomcat) -> Authkey-Module (GeoServer) HTTP -> PHP-Web-Server (External Web Service) HTTP -> GeoServer (Tomcat) HTTPS -> Client (Browser)

Target state: Client (Browser) HTTPS -> GeoServer (Tomcat) -> Authkey-Module (GeoServer) HTTPS -> PHP-Web-Server (External Web Service) HTTPS -> GeoServer (Tomcat) HTTPS -> Client (Browser)

Question:

Can anyone confirm that communication between Geoserver mapper and PHP-Web-Server should work via HTTPS, means: does the "Auth Key Module" support the HTTPS-Protocol in its Web Service URL?

In the documentation it is not explicitly mentioned: https://docs.geoserver.org/latest/en/user/extensions/authkey/index.html#key-provider-using-an-external-web-service

GeoServer log from usecase with self-signed-certificates:

28 022 13:22:26 ERROR  [geoserver.security] - Error in WebServiceAuthenticationKeyMapper, error in web service communication javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
at org.geotools.http.SimpleHttpClient.get(SimpleHttpClient.java:134)
at org.geotools.http.SimpleHttpClient.get(SimpleHttpClient.java:105)
at org.geoserver.security.WebServiceAuthenticationKeyMapper.callWebService(WebServiceAuthenticationKeyMapper.java:225)
at org.geoserver.security.WebServiceAuthenticationKeyMapper.getUser(WebServiceAuthenticationKeyMapper.java:170)
at org.geoserver.security.GeoServerAuthenticationKeyFilter.doAuthenticate(GeoServerAuthenticationKeyFilter.java:137)
at org.geoserver.security.GeoServerAuthenticationKeyFilter.doFilter(GeoServerAuthenticationKeyFilter.java:86)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.geoserver.security.filter.GeoServerSecurityContextPersistenceFilter$1.doFilter(GeoServerSecurityContextPersistenceFilter.java:52)
at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:142)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:77)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:48)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:49)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:607)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:668)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source) Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 64 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 70 more 28 022 13:22:26 WARN   [geoserver.security] - Could not find any user associated to webservice url [https://myHost:8448/auth/response.php?authkey={key}] with authkey: 130e858b-b408-461a-9d7d-5bdcda8de86f

GeoServer-Log from usecase with CA-signed-certificates:

2022-08-02 08:11:24,479 DEBUG [org.geoserver.security] - Issuing request to authkey webservice: https://ourhost/authwebservice.php?authkeyParam=egal03
2022-08-02 08:11:24,483 ERROR [org.geoserver.security] - Error in WebServiceAuthenticationKeyMapper, error in web service communication
java.net.SocketException: Connection reset
    at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)
    at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140)
    at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:478)
    at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472)
    at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1416)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
    at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:572)
    at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197)
    at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:168)
    at org.geotools.http.SimpleHttpClient.get(SimpleHttpClient.java:134)
    at org.geotools.http.SimpleHttpClient.get(SimpleHttpClient.java:105)
    at org.geoserver.security.WebServiceAuthenticationKeyMapper.callWebService(WebServiceAuthenticationKeyMapper.java:225)
    at org.geoserver.security.WebServiceAuthenticationKeyMapper.getUser(WebServiceAuthenticationKeyMapper.java:170)
    at org.geoserver.security.GeoServerAuthenticationKeyFilter.doAuthenticate(GeoServerAuthenticationKeyFilter.java:137)
    at org.geoserver.security.GeoServerAuthenticationKeyFilter.doFilter(GeoServerAuthenticationKeyFilter.java:86)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.geoserver.security.filter.GeoServerBasicAuthenticationFilter.doFilter(GeoServerBasicAuthenticationFilter.java:81)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
    at org.geoserver.security.filter.GeoServerSecurityContextPersistenceFilter$1.doFilter(GeoServerSecurityContextPersistenceFilter.java:52)
    at org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
    at org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:142)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:102)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:77)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:48)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:49)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:370)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1591)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:829)
2022-08-02 08:11:24,484 WARN [org.geoserver.security] - Could not find any user associated to webservice url [https://ourhost/authwebservice.php?authkeyParam={key}] with authkey: egal03
Improve this question
6
  • it looks like GeoServer can't find your certificate file to make the HTTPS request
    – Ian Turton ♦
    Jul 29, 2022 at 11:16
  • As per the Tour there should be only one question asked per question.
    – PolyGeo ♦
    Jul 29, 2022 at 11:49
  • @IanTurton: thank you for your idea, as we edited the question, we have adapted that we think this can not be the reason because GeoServer seems to handle all other services very well in HTTPS.
    – geoDev62
    Aug 1, 2022 at 7:44
  • @PolyGeo: sorry that we have not followed strictly the Tour. We have edited the question and believe it should be compliant now to the community-rules.
    – geoDev62
    Aug 1, 2022 at 7:44
  • in this case GeoServer needs access to the certificate to encrypt the request to the php app - the error message clearly indicates this is the issue you are having. I've never used the AuthKey module in this way so I can't really help beyond this
    – Ian Turton ♦
    Aug 1, 2022 at 8:23

2 Answers 2

Reset to default
1

The error message seems clear enough:

... 64 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

You probably used a self-signed certificate that the JVM does not recognize as valid. The JVM needs to have that certificate installed, or you need to create another one that that JVM can link to a trustworthy source.

If you search on the web for that error message, there are numerous resources on how to handle the issue, here is one for your convenience: https://blog.packagecloud.io/solve-unable-to-find-valid-certification-path-to-requested-target/

The second exception shows Authkey trying to talk to the PHP server, just to have the HTTP connection shut down in its face:

ava.net.SocketException: Connection reset
    at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)
Improve this answer
2
  • Yes, we guess you and Ian Turton are right. As mentioned, in "Setups and attempts" we had set up different scenarios. One with self-signed certificates and one with CA-signed certificates. The Error-Logs look different in both scenarios. We switched now again to the scenario with the CA-certificates, and have added here, the GeoServer-Log from this scenario too. Please see at "GeoServer-Log from usecase with CA-signed-certificates". Sorry, for not have mentioned this before.
    – geoDev62
    Aug 2, 2022 at 9:00
  • firewall blocking it?
    – Ian Turton ♦
    Aug 2, 2022 at 9:40
0

@IanTurton, you were right with your assumption. It is the correct answer. The interruption of the communication between Tomcat and the PHP-server, was initiated by the firewall. First, we were told that the firewall does not intervene between the two servers, in the secure area, because there is no need for that. This was not right. We interviewed another firewall-expert in the team, which has told us the contrary is the case. The firewall caught the request, and set a RST-Flag for a TCP Connection Reset. That was the reason for "java.net.SocketException: Connection reset" in the GeoServer-Log-file.

BTW: to all interested readers, YES, the "Auth Key Module" definitely supports an HTTPS communication.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.