AccessControlException when connecting to HTTP server from Tomcat servlet

Question

I'm trying to make my tomcat servlet download a number of files, but I have apache and tomcat running on the same server, so I assume that is why it doesn't work. I've tested on servers not running apache, and all is well.

Here's the exception I'm getting when I try to use new Url( fileUrl ).openStream():

 Opening input stream Attempted to download: http://www.stefankendall.com/files/test.txt java.security.AccessControlException: access denied (java.net.SocketPermission www.stefankendall.com:80 connect,resolve)

How can I run http downloads via tomcat while running apache at the same time? Am I stuck?

EDIT:
No matter what I do, I can't get past tomcat. Here's 03catalina.policy:

// ========== CATALINA CODE PERMISSIONS =======================================

// These permissions apply to the logging API
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
        permission java.util.PropertyPermission "java.util.logging.config.class", "read";
        permission java.util.PropertyPermission "java.util.logging.config.file", "read";
        permission java.lang.RuntimePermission "shutdownHooks";
        permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
        permission java.util.PropertyPermission "catalina.base", "read";
        permission java.util.logging.LoggingPermission "control";
        permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write";
        permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
        permission java.lang.RuntimePermission "getClassLoader";
        // To enable per context logging configuration, permit read access to the appropriate file.
        // Be sure that the logging configuration is secure before enabling such access
        // eg for the examples web application:
        // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read";
};

// These permissions apply to the server startup code
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
        permission java.security.AllPermission;
 permission java.net.socketPermission "*:80", "connect, resolve";
};

// These permissions apply to the servlet API classes
// and those that are shared across all class loaders
// located in the "lib" directory
grant codeBase "file:${catalina.home}/lib/-" {
        permission java.security.AllPermission;
       permission java.net.socketPermission "*:80", "connect, resolve";
};

grant codeBase "file:${catalina.home}/webapps/-" {
 permission java.security.AllPermission;
 permission java.net.socketPermission "*:80", "connect, resolve";
};

score 2 · Accepted Answer · edited Oct 08 '09 at 20:10

2

Your problem has nothing to do with the presence or absence of some program running on the same box; it has to do with the presence of a SecurityManager in Tomcat (which, probably, means that you're running an old version of Tomcat).

Here is detailed documentation on how to configure the Tomcat SecurityManager. In your case, you'll add some lines to the local.policy file, along the lines of

grant codeBase "file:${catalina.home}/webapps/-" {
  permission java.net.SocketPermission "*:80", "connect";
};

edited Oct 08 '09 at 20:10

Stefan Kendall

66,414
68
253
406

answered Oct 08 '09 at 17:13

Jonathan Feinberg

44,698
7
80
103

Clearly I did not understand the problem, as I believed my only setup difference to be the existence of apache. I'll try this and see if it works. The perils of using preconfigured software.... – Stefan Kendall Oct 08 '09 at 17:20
Changes need to be in 50local.policy. – Stefan Kendall Oct 08 '09 at 20:10
Thanks for the "accept". Since I don't have edit privileges yet, may i suggest that you edit your question to say something like "AccessControlException when connecting to HTTP server from Tomcat servlet", or something like that? – Jonathan Feinberg Oct 08 '09 at 23:41

AccessControlException when connecting to HTTP server from Tomcat servlet

1 Answers1