create a proxy for a datapower application - wcf

I am trying to consume a IBM datapower webservice in c#, wcf.
But this is the error the vendor has sent.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Required elements filter setting reject: expression /*[local-name()='Envelope' and (namespace-uri()='http://schemas.xmlsoap.org/soap/envelope/' or namespace-uri()='http://www.w3.org/2003/05/soap-envelope')]/*[local-name()='Header' and (namespace-uri()='http://schemas.xmlsoap.org/soap/envelope/' or namespace-uri()='http://www.w3.org/2003/05/soap-envelope')]//*[local-name()='UsernameToken' and namespace-uri()='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd']/*[local-name()='Password'][not(/following-sibling::*[local-name()='Salt' or local-name()='Iteration'])] was not satisfied
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Required elements filter setting reject: expression /*[local-name()='Envelope' and (namespace-uri()='http://schemas.xmlsoap.org/soap/envelope/' or namespace-uri()='http://www.w3.org/2003/05/soap-envelope')]/*[local-name()='Header' and (namespace-uri()='http://schemas.xmlsoap.org/soap/envelope/' or namespace-uri()='http://www.w3.org/2003/05/soap-envelope')]//*[local-name()='UsernameToken' and namespace-uri()='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd']/*[local-name()='Password'][not(/following-sibling::*[local-name()='Salt' or local-name()='Iteration'])] was not satisfied
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Execution of 'store:///required-elements-filter.xsl' aborted: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Execution of 'store:///required-elements-filter.xsl' aborted: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Rejected by filter 'endpoint_14_5-1-2-request-rule-suptoken' of rule 'endpoint_14_5-req'.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: Rejected by filter 'endpoint_14_5-1-2-request-rule-suptoken' of rule 'endpoint_14_5-req'.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: request endpoint_14_5-req #3 filter: 'INPUT store:///required-elements-filter.xsl' failed: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: request endpoint_14_5-req #3 filter: 'INPUT store:///required-elements-filter.xsl' failed: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: rule (MedsHistoryWSP_default_request-rule): implied action Calling rule var://service/wspolicy/endpoint/configname with input INPUT and output PIPE failed: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[request][ ]: rule (MedsHistoryWSP_default_request-rule): implied action Calling rule var://service/wspolicy/endpoint/configname with input INPUT and output PIPE failed: Rejected by policy.
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[error][ ]: Rejected by filter; SOAP fault sent
May 23 10:29:44 [error] wsgw(MedsHistoryWSP): trans(308571109)[error][ ]: Rejected by filter; SOAP fault sent
1) Questions: First of all, any hints to consume a datapower webservice.
I won't let me add a service reference in Visual studio.
2) This is how the sample soap looks like.
https://stackoverflow.com/questions/16705812/wcf-client-usernametoken-nonce-x509-binary-security
3) Please suggest
2) Suppose I have this wsdl https://service100.emedny.org:9047/MHService?wsdl, what could be the custom binding

From the reject by filter I can guess that : the vendor sent message not according your wsdl file.
I would suggest you open "prob"
And maybe for the test peruse disable the policy.
Hope I helped some how :)

The SOAP packet posted by you to the datapower seems to be incorrect. First you need to see WSDL and see if it contains any .. element. From the message it looks that it is using it.
Now when you are posting a SOAP message to the datapower, datapower is saying the SOAP message is not correctly formed according the WSDL contract [In this case this is happening because 'UserNameToken' and its related content in SOAP header is not correctly structure.].
You need to re-structure the SOAP message. The best is to use any policy aware WS client and generate a sample request. Use that sample request as a starting point to understand how SOAP message needs to be formulated in case WS-Policy is attached with provided WSDL [The WSDL link above is not working, may be I can help if you post the WSDL file in this forum].
Ajitabh

Related

Apache server reverse proxy: increase file upload limit

I'm configuring a httpd to perform as a reverse proxy which should allow file uploads as well. Average file size is around 20MB. With basic configurations I could only upload files of max size 128KB.
After referring some materials, I installed modsecurity plugin to enable uploading files with max allowance of 30 MB.
In the mod_security.conf file, I have:
SecRuleEngine On
SecRequestBodyAccess On
SecRequestBodyLimit 31457280
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 1048576
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!#eq 0" "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
But if I try to upload even 1MB file, I get the below error:
[:error] [pid 7877] [client 10.192.10.186:47406] [client 10.192.10.186] ModSecurity: Multipart parsing error (init): Multipart: Invalid boundary in C-T (malformed). [hostname "<host>"] [uri "<uri>"] [unique_id "YmE-3e7SizASbXjV8cTWfQAAAAQ"]
[proxy:error] [pid 7877] (32)Broken pipe: [client 10.192.10.186:47406] AH01084: pass request body failed to 10.192.21.143:443
[proxy_http:error] [pid 7877] [client 10.192.10.186:47406] AH01097: pass request body failed to 10.192.21.143:443 () from 10.192.10.186 ()
The questions I have are:
Am I using the correct plugging?
What is the error in the above configuration?
OWASP ModSecurity Core Rule Set dev-on-duty here. Your error is the first alert message: "Multipart parsing error (init): Multipart: Invalid boundary in C-T (malformed)." The rest is Apache reacting to the ModSecurity parsing abort.
Based on my experience with ModSecurity I am confident we're facing a malformed multipart request. Try to submit a multipart request with curl to see if it works out. If it does, as I suspect, you need to look at your client. Probably by taking a very close look at the request body and the Content-Type header.

Rabbitmq client loosing connection and does not recover

I am using Rabbitmq 3.8.16 with Vertx 3.9.4 Rabbitmq client for my backend application and noticed that sometimes the client looses the connection and it fails to recover correctly (autorecovery is turned ON). It means that after the recovery, It stops to consume messages and the durable queues has no consumers.
This happens randomly and with different exceptions. Since I am using Vertx Rabbitmq client, I cannot create different channel per consumer/publisher, I have something like 10 publishers and 10 consumers on the same node (same connection same channel) sometimes reaching up to 400 messages per second. Can it cause this kind of issues ??
Other problem can be that I have a queues representing websocket connections to my backend, these websocket connections are short living so it quite often declare and then remove a queue representing this user session. Is that a problem for Rabbitmq ?
From the Rabbitmq log I found following exceptions which were related to the connection crash:
First one :
2021-09-08 08:14:15.321 [error] <0.24867.686> ** Generic server <0.24867.686> terminating
** Last message in was {'$gen_cast',{method,{'basic.publish',0,<<"NOTIFICATION_EXCHANGE">>,<<"BROADCAST_NOTIFICATION_ADDRESS">>,false,false},{content,60,none,<<0,0>>,rabbit_framing_amqp_0_9_1,[<<"{MY_MESSAGE}">>]},flow}}
** When Server state == {ch,{conf,running,rabbit_framing_amqp_0_9_1,1,<0.24846.686>,<0.24862.686>,<0.24846.686>,<<"172.20.24.177:60848 -> 172.20.28.73:5672">>,undefined,{user,<<"backend">>,[],[{rabbit_auth_backend_internal,none}]},<<"backend">>,<<"8a4a4f71-251a-4ab6-85f6-50d594db46b9">>,<0.24850.686>,[{<<"exchange_exchange_bindings">>,bool,true},{<<"connection.blocked">>,bool,true},{<<"authentication_failure_close">>,bool,true},{<<"basic.nack">>,bool,true},{<<"publisher_confirms">>,bool,true},{<<"consumer_cancel_notify">>,bool,true}],none,200,134217728,900000,#{},1000000000},{lstate,<0.24877.686>,false},none,4927,{2,{[{4926,<<"amq.ctag-ckMzQHTLitAIZ86qk0_R0Q">>,1631088855286,{{'backend_SERVICE_QUEUE','rabbit#rabbitmq-server-2.rabbitmq-nodes.rabbitmq'},321}}],[{4925,<<"amq.ctag-xDoqkK1VmPptIM9OG3YaPw">>,1631088855286,{{'backend_SERVICE_QUEUE','rabbit#rabbitmq-server-2.rabbitmq-nodes.rabbitmq'},321}}]}},#{'backend_9fb541c5-a9ae-4bbc-99a4-ff444316b3f1' => {resource,<<"backend">>,queue,<<"9fb541c5-a9ae-4bbc-99a4-ff444316b3f1">>},'backend_5f188762-0a66-47e3-bfa8-76aa11481cb9' => {resource,<<"backend">>,queue,<<"5f188762-0a66-47e3-bfa8-76aa11481cb9">>},'backend_e4a3cec7-3f6f-4b05-bdf2-ade8a087425d' => {resource,<<"backend">>,queue,<<"e4a3cec7-3f6f-4b05-bdf2-ade8a087425d">>},'backend_e7a9834a-7ddc-4690-a317-4f19433edafd' => {resource,<<"backend">>,queue,<<"e7a9834a-7ddc-4690-a317-4f19433edafd">>},'backend_6fdcc521-4ff1-4721-bf12-cefffe1181eb' => ...,...},...}
** Reason for termination ==
** {{error,noproc},[{rabbit_fifo_client,enqueue,3,[{file,"src/rabbit_fifo_client.erl"},{line,168}]},{rabbit_quorum_queue,deliver,3,[{file,"src/rabbit_quorum_queue.erl"},{line,754}]},{rabbit_amqqueue,'-deliver/3-fun-3-',4,[{file,"src/rabbit_amqqueue.erl"},{line,2239}]},{lists,foldl,3,[{file,"lists.erl"},{line,1267}]},{rabbit_amqqueue,deliver,3,[{file,"src/rabbit_amqqueue.erl"},{line,2236}]},{rabbit_channel,deliver_to_queues,2,[{file,"src/rabbit_channel.erl"},{line,2204}]},{rabbit_channel,handle_method,3,[{file,"src/rabbit_channel.erl"},{line,1375}]},{rabbit_channel,handle_cast,2,[{file,"src/rabbit_channel.erl"},{line,643}]}]}
2021-09-08 08:14:15.321 [error] <0.24867.686> CRASH REPORT Process <0.24867.686> with 0 neighbours exited with reason: {error,noproc} in rabbit_fifo_client:enqueue/3 line 168 in gen_server2:terminate/3 line 1183
2021-09-08 08:14:15.322 [error] <0.24859.686> Supervisor {<0.24859.686>,rabbit_channel_sup} had child channel started with rabbit_channel:start_link(1, <0.24846.686>, <0.24862.686>, <0.24846.686>, <<"172.20.24.177:60848 -> 172.20.28.73:5672">>, rabbit_framing_amqp_0_9_1, {user,<<"backend">>,[],[{rabbit_auth_backend_internal,none}]}, <<"backend">>, [{<<"exchange_exchange_bindings">>,bool,true},{<<"connection.blocked">>,bool,true},{<<"authentica...">>,...},...], <0.24850.686>, <0.24877.686>) at <0.24867.686> exit with reason {error,noproc} in rabbit_fifo_client:enqueue/3 line 168 in context child_terminated
2021-09-08 08:14:15.322 [error] <0.24859.686> Supervisor {<0.24859.686>,rabbit_channel_sup} had child channel started with rabbit_channel:start_link(1, <0.24846.686>, <0.24862.686>, <0.24846.686>, <<"172.20.24.177:60848 -> 172.20.28.73:5672">>, rabbit_framing_amqp_0_9_1, {user,<<"backend">>,[],[{rabbit_auth_backend_internal,none}]}, <<"backend">>, [{<<"exchange_exchange_bindings">>,bool,true},{<<"connection.blocked">>,bool,true},{<<"authentica...">>,...},...], <0.24850.686>, <0.24877.686>) at <0.24867.686> exit with reason reached_max_restart_intensity in context shutdown
2021-09-08 08:14:15.323 [error] <0.24846.686> Error on AMQP connection <0.24846.686> (172.20.24.177:60848 -> 172.20.28.73:5672, vhost: 'backend', state: running), channel 1:
{{error,noproc},
[{rabbit_fifo_client,enqueue,3,
[{file,"src/rabbit_fifo_client.erl"},{line,168}]},
{rabbit_quorum_queue,deliver,3,
[{file,"src/rabbit_quorum_queue.erl"},{line,754}]},
{rabbit_amqqueue,'-deliver/3-fun-3-',4,
[{file,"src/rabbit_amqqueue.erl"},{line,2239}]},
{lists,foldl,3,[{file,"lists.erl"},{line,1267}]},
{rabbit_amqqueue,deliver,3,[{file,"src/rabbit_amqqueue.erl"},{line,2236}]},
{rabbit_channel,deliver_to_queues,2,
[{file,"src/rabbit_channel.erl"},{line,2204}]},
{rabbit_channel,handle_method,3,
[{file,"src/rabbit_channel.erl"},{line,1375}]},
{rabbit_channel,handle_cast,2,
[{file,"src/rabbit_channel.erl"},{line,643}]}]}
2021-09-08 08:14:15.323 [warning] <0.24846.686> Non-AMQP exit reason '{{error,noproc},[{rabbit_fifo_client,enqueue,3,[{file,"src/rabbit_fifo_client.erl"},{line,168}]},{rabbit_quorum_queue,deliver,3,[{file,"src/rabbit_quorum_queue.erl"},{line,754}]},{rabbit_amqqueue,'-deliver/3-fun-3-',4,[{file,"src/rabbit_amqqueue.erl"},{line,2239}]},{lists,foldl,3,[{file,"lists.erl"},{line,1267}]},{rabbit_amqqueue,deliver,3,[{file,"src/rabbit_amqqueue.erl"},{line,2236}]},{rabbit_channel,deliver_to_queues,2,[{file,"src/rabbit_channel.erl"},{line,2204}]},{rabbit_channel,handle_method,3,[{file,"src/rabbit_channel.erl"},{line,1375}]},{rabbit_channel,handle_cast,2,[{file,"src/rabbit_channel.erl"},{line,643}]}]}'
Another one that I noticed is :
2021-09-02 14:59:43.260 [error] <0.17646.16> closing AMQP connection <0.17646.16> (172.20.23.201:35420 -> 172.20.36.197:5672):
missed heartbeats from client, timeout: 60s
2021-09-02 14:59:43.263 [info] <0.29592.28> Closing all channels from '172.20.23.201:35420 -> 172.20.36.197:5672' because it has been closed
And the last one :
2021-09-08 09:47:14.948 [warning] <0.7610.564> segment_writer: skipping segment as directory /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHES3OXCNJJBB4VW does not exist
2021-09-08 09:47:14.948 [warning] <0.7611.564> segment_writer: failed to open segment file /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHES0C5F3P5Y6WKO/00000001.segmenterror: enoent
2021-09-08 09:47:14.948 [warning] <0.199.564> segment_writer: failed to open segment file /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHES9RZ4RFC37MDG/00000001.segmenterror: enoent
2021-09-08 09:47:14.948 [warning] <0.7611.564> segment_writer: skipping segment as directory /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHES0C5F3P5Y6WKO does not exist
2021-09-08 09:47:14.948 [warning] <0.199.564> segment_writer: skipping segment as directory /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHES9RZ4RFC37MDG does not exist
2021-09-08 09:47:14.950 [warning] <0.7600.564> segment_writer: failed to open segment file /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHESAQL00HNNSPK4/00000001.segmenterror: enoent
2021-09-08 09:47:14.950 [warning] <0.7600.564> segment_writer: skipping segment as directory /var/lib/rabbitmq/mnesia/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/quorum/rabbit#rabbitmq-server-1.rabbitmq-nodes.rabbitmq/ORCHESAQL00HNNSPK4 does not exist
On the client side I noticed :
15:11:30.816 [vert.x-eventloop-thread-0]Fail to handle message
com.rabbitmq.client.AlreadyClosedException: connection is already closed due to connection error; cause: java.lang.IllegalStateException: Unsolicited delivery - see Channel.setDefaultConsumer to handle this case.
at com.rabbitmq.client.impl.AMQConnection.ensureIsOpen(AMQConnection.java:172)
at com.rabbitmq.client.impl.AMQConnection.createChannel(AMQConnection.java:550)
at com.rabbitmq.client.impl.recovery.AutorecoveringConnection.createChannel(AutorecoveringConnection.java:165)
at io.vertx.rabbitmq.impl.RabbitMQClientImpl.forChannel(RabbitMQClientImpl.java:476)
at io.vertx.rabbitmq.impl.RabbitMQClientImpl.basicPublish(RabbitMQClientImpl.java:194)
at io.vertx.reactivex.rabbitmq.RabbitMQClient.basicPublish(RabbitMQClient.java:363)
at io.vertx.reactivex.rabbitmq.RabbitMQClient.lambda$rxBasicPublish$9(RabbitMQClient.java:376)
at io.vertx.reactivex.rabbitmq.RabbitMQClient$$Lambda$699/0x00000000102c38c0.accept(Unknown Source)
at io.vertx.reactivex.impl.AsyncResultCompletable.subscribeActual(AsyncResultCompletable.java:44)
or
08:14:15.330 [AMQP Connection 10.100.56.15:5672] WARN com.rabbitmq.client.impl.ForgivingExceptionHandler - An unexpected connection driver error occured (Exception message: Connection reset)
08:14:15.332 [AMQP Connection 10.100.56.15:5672] INFO io.vertx.rabbitmq.impl.RabbitMQClientImpl - RabbitMQ connection shutdown! The client will attempt to reconnect automatically
com.rabbitmq.client.ShutdownSignalException: connection error; protocol method: #method<connection.close>(reply-code=541, reply-text=INTERNAL_ERROR, class-id=0, method-id=0)
at com.rabbitmq.client.impl.AMQConnection.startShutdown(AMQConnection.java:916)
at com.rabbitmq.client.impl.AMQConnection.shutdown(AMQConnection.java:906)
at com.rabbitmq.client.impl.AMQConnection.handleConnectionClose(AMQConnection.java:844)
at com.rabbitmq.client.impl.AMQConnection.processControlCommand(AMQConnection.java:799)
at com.rabbitmq.client.impl.AMQConnection$1.processAsync(AMQConnection.java:242)
at com.rabbitmq.client.impl.AMQChannel.handleCompleteInboundCommand(AMQChannel.java:178)
at com.rabbitmq.client.impl.AMQChannel.handleFrame(AMQChannel.java:111)
at com.rabbitmq.client.impl.AMQConnection.readFrame(AMQConnection.java:650)
at com.rabbitmq.client.impl.AMQConnection.access$300(AMQConnection.java:48)
at com.rabbitmq.client.impl.AMQConnection$MainLoop.run(AMQConnection.java:597)
Since those errors are not clear to my, does anybody has an idea why is this happening ??
Thank you for your help

Jboss Mod_cluster

I have a jboss cluster with 2 nodes (a and b) + 1 apache working as mod_cluster (apache in a separate server)
If one of the nodeA goes down, mod cluster can't connect to another one.
So, if nodeA crashes, I can't access jboss aplication by http://apache_server/myapp, but I can by http://nodeb/myapp and vice-versa
I dig on google almost all i have found say that is related to sessions but I can't fnd whats is wron with my config. (Mod_cluster as configured with this tool Load Balancer Configuration Tool
NodeA Log
15/05/2016 07:45:22,741 ERROR [org.jgroups.protocols.TCP] (http-/nodeA:8080-90) failed sending message to jbossnodeb:jbossnodeb/web (4148 bytes): java.net.SocketException: Socket closed, cause: null
15/05/2016 07:45:22,790 ERROR [org.jgroups.protocols.TCP] (OOB-6464,shared=tcp) failed sending message to jbossnodeb:jbossnodeb/web (4141 bytes): java.net.SocketException: Broken pipe, cause: null
NodeB Log
15/05/2016 07:45:23,126 ERROR [org.jgroups.protocols.TCP] (OOB-4949,shared=tcp) failed sending message to jbossnodea:jbossnodea/web (79 bytes): java.net.SocketException: Broken pipe, cause: null
15/05/2016 07:45:53,457 WARN [org.jgroups.protocols.TCP] (Timer-1,shared=tcp) null: no physical address for jbossnodea:jbossnodea/web, dropping message
Apache mod_cluster server log
[Sun May 15 07:45:04 2016] [error] (70007)The timeout specified has expired: proxy: read response failed from (null) (nodeA_IP)
[Sun May 15 07:45:34 2016] [error] (70007)The timeout specified has expired: ajp_cping_cpong: apr_socket_recv failed
[Sun May 15 07:45:38 2016] [error] ajp_handle_cping_cpong: ajp_ilink_receive failed
[Sun May 15 07:45:38 2016] [error] (70007)The timeout specified has expired: proxy: AJP: cping/cpong failed to (null) (nodeA_IP)
[Sun May 15 07:45:44 2016] [error] (70007)The timeout specified has expired: ajp_cping_cpong: apr_socket_recv failed
[Sun May 15 07:45:44 2016] [error] (70007)The timeout specified has expired: proxy: dialog to nodeA_IP:8009 (nodeA_IP) failed
[Sun May 15 07:45:44 2016] [error] ajp_read_header: ajp_ilink_receive failed
[Sun May 15 07:45:44 2016] [error] (70007)The timeout specified has expired: proxy: dialog to nodeA_IP:8009 (nodeA_IP) failed
[Sun May 15 07:45:44 2016] [error] (70007)The timeout specified has expired: proxy: dialog to nodeA_IP:8009 (nodeA_IP) failed
[Sun May 15 07:45:45 2016] [error] ajp_read_header: ajp_ilink_receive failed
[Sun May 15 07:45:45 2016] [error] (70007)The timeout specified has expired: proxy: dialog to (null) (nodeA_IP) failed
[Sun May 15 07:45:45 2016] [error] ajp_read_header: ajp_ilink_receive failed
[Sun May 15 07:45:45 2016] [error] (70007)The timeout specified has expired: proxy: dialog to (null) (nodeA_IP) failed
[Sun May 15 07:45:45 2016] [error] ajp_read_header: ajp_ilink_receive failed
[Sun May 15 07:45:45 2016] [error] proxy: CLUSTER: (balancer://clusterjboss). All workers are in error state
Config apache mod_cluster
AdvertiseGroup 225.0.1.107:23364
KeepAliveTimeout 60
ManagerBalancerName clusterjboss
ServerAdvertise On
AdvertiseFrequency 5
EnableMCPMReceive
CreateBalancers 0
AllowDisplay On
ProxyPass / balancer://clusterjboss/ stickysession=JSESSIONID|jsessionid nofailover=On
Visibility
JBoss worker instances must be able to contact your ```EnableMCPMReceive`` VirtualHost
Your JBoss worker instances report their IP address and AJP port to the Apache HTTP Server
Your Apache HTTP Server must be able to contact them back on those reported addresses
ProxyPass
JGroups, Infinispan, Domains, Clustering
mod_cluster, i.e. modcluster subsystem has nothing to do with the aforementioned whatsoever. The subsystem is completely oblivious to the fact that there is some cluster formed or that you have your instances in a domain -- which is also irrelevant to having your instances in a cluster in the first place. Don't bother with JGroups messages while investigating mod_cluster configuration.
Although, if your JGroups cluster is broken...
Infinispan - i.e. distributed or replicated cache of your web session data in this case, relies on JGroups for forming a cluster and for exchanging messages in this cluster. If your instances cannot for a cluster or fail to exchange messages, you might experience a loss of session data on failover.
For example: Apache HTTP Server mod_cluster balacner decides to send request with JSESSIONID yadayadaXXX.worker-1 to worker-2, because worker-1 is down. Due to a network configuration error, worker-1 and worker-2 has never correctly formed a cluster, so worker-2 does not have the session data of worker-1. The result is a web application with a new session created, i.e. your client lost his context, e.g. shopping cart (popular showcase).
ProxyPass
Don't use it unless you have something specific in mind. The whole point of mod_cluster is that it creates all proxy directives in memory, on the fly dynamically as your worker nodes and their web applications come and go. You start fiddling with additional ProxyPass directives if you want to:
react to special error codes from a special web applciation, e.g. to treat HTTP codes that are supposed to mean an error as valid and vice versa
to serve static content directly from the Apache HTTP Server and not from worker nodes - e.g. pictures...
to load balance some contexts to mod_cluster-aware JBoss worker nodes and some contexts to non-mod_cluster servers, e.g. another Apache HTTP Server running Drupal in PHP...
ManagerBalancerName
It is not clear to me why you would need to change it. If you change the default value, you have to also alter balancer="new_value" in your Jboss modcluster subsystem configuration. What is actually does is that it tells mod_cluster in the Apache HTTP Server to create more separate named ProxyPass Balacners internally. One then could use ProxyPass directives to tweak them separately. Do you need to tweak them? According to the rest of your config I am convinced it is not the case. For example, the session stickiness is configured in JBoss nodes in mod_cluster subsystems - worker ndoes report this to the Apache HTTP Server balancer.
HTH, -K-
Possible changes that need to be done in domain.xml:
1. Under < domain-controller>, add < remote host="< ip-address-of-master-node>" port="< port>" security-realm="ManagementRealm"/>
2. Under < servers>, add < server name="slave-node" group="server-group" auto-start="true">
3. Under mod-cluster subsystem, add < mod-cluster-config advertise-socket="modcluster" proxy-list="< ip-address>:< port-in-mod-cluster-config" connector="ajp">
In mod-cluster configuration:
1. Allow from all
2. ManagerBalancerName server-group (exact name as above)
Also, are you using any virtualization/containers? To deal problems with session replication in such cases, you might need to try out "sticky session".

CAS w/ SPNEGO Authentication error

I'm trying to set up CAS SSO with SPNEGO on a Windows environment. I've followed all the instructions in http://jasig.github.io/cas/4.0.x/installation/SPNEGO-Authentication.html but the authentication process fails.
This is the output from the cas.log:
2015-03-04 11:36:22,732 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoNegociateCredentialsAction] - Authorization header not found. Sending WWW-Authenticate header
2015-03-04 11:36:22,738 DEBUG [org.jasig.cas.web.support.CasArgumentExtractor] - Extractor did not generate service.
2015-03-04 11:36:22,738 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction] - SPNEGO Authorization header found with 1800 bytes
2015-03-04 11:36:22,739 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction] - Obtained token: `‚A+ ‚50‚1 $0" *†H‚÷ *†H†÷
+‚7
¢‚‚`‚ÿ *†H†÷ n‚î0‚ê ¡¢ £‚a‚0‚ ¡ STU.EDU¢$0" ¡0HTTPrenato-pc.stu.edu£‚Ò0‚Π¡¢‚À‚¼';Kù«î Qx‹¦ô¨Oö©$É(L)AµyaC²}wÚ(W+ˆeŽ»vj[èAe¿…íZÍ®CŸ”ÑúD€‘É’5©–k¼/Οêý7¨ÊÙþÅ’B´;Ñ€ã⽿ÌWat,ó5LJýÅÙ{¡3ê”G¦GÄ¥IyǤé¯Õ?9k`Zz!;cºE­•Û[·˜Œª|{´:t%j¡ía”??H£³òØ×ë÷œoG ¦]+é<Ìàʨ®2›Uòx|㨱: a%ÆÔaJ6_½B:"õ¯Fܪ"\N+¼ª
çšòÓ%Öá?xõyƒ;࿺õ$ÀŒã=»#›¹õç4 ²m>„¥U,»G!Ô½‰ô—C÷ȇݽo"ß;=ÿ™fáÉÁ¸^ŽÒÛÇÔa~µ‚üë‡³× ]Kôp2jž¬ÔP^§2§€jöù)4LLª˜“Œ‘¸"S8‚½óÞ°ÊæÏ‘R<%2Iÿ{‚E§½6¨FÌkÙ„<¡ãyŽù g]ü.B&²Äõ-ò\¿%:ØydˆTÈÊ jù® Æ®XŠ0EC§×CôèG?]b Ž#6“¾(3z`ñ×ðCWµkm¦<9µÓ^4éÐ5«›éÿÄ»«_™1åÁÖZÉ}ÁªG€0±½H¿Ì%oÎW‡Hj{¨8ÕÉ÷>Í8?×Ù­ZW)’¤žtK2é^A$(k¦ÒÇFñޤǰ¬#ÒÑÕHYXëªöϳgšÙK!9r(a9«ÐÜçPÓ¯ù[ºò«w¹Åm_#ÐÐyÚnVêø?ª3­”›‚ Š§‰¦É”˜3iÅ_ûĦ¬8€ËókOŠ2uSkÒ[àù†hG³õí:aÌIUg´‹§ñÍSŸr2a?¥C“Ãpv2ÃÚ"Fk•W%\$Žò³ÇÁ8B#ðŠj‡xŒx ÈÛtSE½QMÓ¡x™I?•æW§‘¶¿èà?
†ÏÅÎœßù›Ôžå?Ÿ‘˜‚e¾B¿L?$$8Ú`¼#p©‰ú0}´ðŒÎ`hâĤ? M ¶>[UMC*Ö#ã½Xùd…!#$?
=²^cÌZ…&þ³P#q[©ƒB^t?PjÁWd~…©?¥ZƒêQ!)h:=“öy(‹?©½ä‡£ú]´1ìEØxÆ7‹BÞôÒ‹Ámr}kß½Ø&Ãxšö+ h((Ÿçå|?¼ÈNZô{hÎŽŒ_ª?}žl?_¼áa¤?¼0?¹ ¢?±?®ú4“kuñO§Bq9¸A¦0c©?0ƒòÕ‚N¶~)¨$TyÚì%µÈÓÉÌ\üšzǘÅ™?$QSªØºrÝž :Ä®6¤2ì¦Ä74Œù‰pÆäL?÷z¸çz’­ì3Ó$ߢݨ?þNVo™qí—§ˆ´u¨Þ“Âè?É×&‘c΢Y& «JèÈYU£§(¯…Ô°'/~ðÁó±ò“™F²”Ä8"ú
This is the output from the tomcat server:
04-Mar-2015 11:34:00.187 SEVERE [http-nio-8443-exec-6] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [cas] in context with path [/cas] threw exception [Handler processing failed; nested exception is java.lang.ExceptionInInitializerError] with root cause
java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.Byte;
at org.jasig.cas.support.spnego.util.SpnegoConstants.<clinit>(SpnegoConstants.java:52)
at org.jasig.cas.support.spnego.authentication.principal.SpnegoCredential.isTokenNtlm(SpnegoCredential.java:133)
at org.jasig.cas.support.spnego.authentication.principal.SpnegoCredential.<init>(SpnegoCredential.java:79)
at org.jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction.constructCredentialsFromRequest(SpnegoCredentialsAction.java:79)
at org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExecute(AbstractNonInteractiveCredentialsAction.java:73)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188)
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51)
04-Mar-2015 10:41:58.240 SEVERE [http-nio-8443-exec-5] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [cas] in context with path [/cas] threw exception [Handler processing failed; nested exception is java.lang.NoClassDefFoundError: Could not initialize class org.jasig.cas.support.spnego.util.SpnegoConstants] with root cause
java.lang.NoClassDefFoundError: Could not initialize class org.jasig.cas.support.spnego.util.SpnegoConstants
at org.jasig.cas.support.spnego.authentication.principal.SpnegoCredential.isTokenNtlm(SpnegoCredential.java:133)
at org.jasig.cas.support.spnego.authentication.principal.SpnegoCredential.<init>(SpnegoCredential.java:79)
at org.jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction.constructCredentialsFromRequest(SpnegoCredentialsAction.java:79)
at org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExecute(AbstractNonInteractiveCredentialsAction.java:73)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188)
I'm guessing that SPNEGO authentication is failing at Step 5 (Negotiate w/ SPNEGO Token). Does anyone know how to troubleshoot this? Thanks!

Carriage return "%0A" in ActiveMQ/Camel message raise an exception

I'm working on an API for my website, using ActiveMQ and Camel in order iPhones to connect via Stomp protocol.
The body of the message is a JSON with different parameters that I will then pass to a PHP web app, for example Post data, and so on.
We got a form on the iphone, with a "textarea". If I submit a simple line, without carriage returns, ActiveMQ and Camel handle it, pass it to my PHP app which save it in DB, and everything is fine.
But when there is a carriage return in the textarea value, encoded as "%0A", ActiveMQ raises an exception, and the PHP app is not called.
In my apache error log, I only have this line :
[Mon May 14 16:08:54 2012] [error] [client 127.0.0.1] An URL must be provided
In my ActiveMQ log I have (I havent pasted all of it, only the first raise) :
2012-05-14 16:42:22,038 | DEBUG | Caused by: [org.apache.camel.RuntimeCamelException - org.apache.camel.component.http.HttpOperationFailedException: HTTP operation failed invoking http//localapi:80/api_dev.php/dispatcher with statusCode: 500] | org.apache.camel.component.jms.EndpointMessageListener | Camel (camel) thread #0 - JmsConsumer[query]
org.apache.camel.RuntimeCamelException: org.apache.camel.component.http.HttpOperationFailedException: HTTP operation failed invoking http//localapi:80/api_dev.php/dispatcher with statusCode: 500
at org.apache.camel.util.ObjectHelper.wrapRuntimeCamelException(ObjectHelper.java:1139)
at org.apache.camel.component.jms.EndpointMessageListener.onMessage(EndpointMessageListener.java:115)
at org.springframework.jms.listener.AbstractMessageListenerContainer.doInvokeListener(AbstractMessageListenerContainer.java:560)
at org.springframework.jms.listener.AbstractMessageListenerContainer.invokeListener(AbstractMessageListenerContainer.java:498)
at org.springframework.jms.listener.AbstractMessageListenerContainer.doExecuteListener(AbstractMessageListenerContainer.java:467)
at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.doReceiveAndExecute(AbstractPollingMessageListenerContainer.java:323)
at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.receiveAndExecute(AbstractPollingMessageListenerContainer.java:261)
at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.invokeListener(DefaultMessageListenerContainer.java:1056)
at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.executeOngoingLoop(DefaultMessageListenerContainer.java:1048)
at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.run(DefaultMessageListenerContainer.java:947)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.apache.camel.component.http.HttpOperationFailedException: HTTP operation failed invoking http//localapi:80/api_dev.php/dispatcher with statusCode: 500
at org.apache.camel.component.jetty.DefaultJettyHttpBinding.populateHttpOperationFailedException(DefaultJettyHttpBinding.java:143)
at org.apache.camel.component.jetty.DefaultJettyHttpBinding.populateResponse(DefaultJettyHttpBinding.java:61)
at org.apache.camel.component.jetty.JettyContentExchange.doTaskCompleted(JettyContentExchange.java:149)
at org.apache.camel.component.jetty.JettyContentExchange.onResponseComplete(JettyContentExchange.java:86)
at org.eclipse.jetty.client.HttpExchange$Listener.onResponseComplete(HttpExchange.java:887)
at org.eclipse.jetty.client.HttpExchange.setStatus(HttpExchange.java:258)
at org.eclipse.jetty.client.HttpConnection$Handler.messageComplete(HttpConnection.java:580)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:314)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:211)
at org.eclipse.jetty.client.HttpConnection.handle(HttpConnection.java:254)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:506)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:436)
... 1 more
The message's body looks like :
Message:
body={
"session_id":"XXXX",
"method":"post",
"params":{
"post":{
"form_name":{
"field_name":"foo%0Abar"
}
}
},
"url":"/my_object/update",
"query_id":"XXX"
}
My ActiveMQ conf is made with Spring, as I'm not too much (at all) into Java
Thank you for any clue