source: main/trunk/greenstone3/resources/tomcat/greenstone3.xml.svn

<!-- For deployment-time modifications ensure that you are editing greenstone3.xml.in, found in resources/tomcat. -->
<!-- set allowLinking to true if you want to use symlinks to files or directories outside the docBase directory -->
<!-- set reloadable to false for a production version. if true, automatically reloads the webapp if it detects changes in classes or lib directories -->
<!-- see http://tomcat.apache.org/tomcat-8.5-doc/config/context.html for more Context attributes -->
        
<Context
    docBase="@gsdl3webwritablehome@" 
    aliases="/interfaces=@gsdl3webhome@/interfaces,/sites=@gsdl3webhome@/sites"
    debug="1" reloadable="true" 
    privileged="true"
    allowLinking="@allowlinking@"
    xmlBlockExternal="false">

  <!-- if greenstone is to be run in an iframe, need to use the -->
  <!-- sameSiteCookies=none version of the CookieProcessor -->
        <!--<CookieProcessor sameSiteCookies="none" partitioned="true"/>-->
        <CookieProcessor sameSiteCookies="strict"/>
        
    <!-- increase the cacheMaxSize if you get errors like the following in packages/tomcat/logs/catalina.out-->
    <!-- org.apache.catalina.webresources.Cache.getResource Unable to add the resource at [... class name ...] to the cache for web application [/greenstone3] because there was insufficient free space available after evicting expired cache entries - consider increasing the maximum size of the cache -->
    <Resources allowLinking="@allowlinking@" cacheMaxSize="51200"/>

    <!--
        For embedded derby db:
        driverName="org.apache.derby.jdbc.EmbeddedDriver"
        connectionURL="jdbc:derby:@gsdl3webhome@/etc/usersDB"
    -->
    <!--
        JNDI resources require the validationQuery parameter if you are using validations (which we are).
        A list of values for this parameter, depending on your database driver, can be found here:
        https://stackoverflow.com/questions/10684244/dbcp-validationquery-for-different-databases
        For more info about why you need the parameter value, see here:
        https://stackoverflow.com/a/41232124

        Because the derby networked server is now launched with the
        derby.system.home JAVA_OPT property set to the folder containing
        usersDB, we don't need url set to the full GS3 path to the usersDB.
    -->
    <Resource 
        name="jdbc/realmDB"
        auth="Container"
        type="javax.sql.DataSource"
        maxActive="10"
        maxIdle="4"
        maxWaitMillis="10000"
        validationQuery="values 1"
        driverClassName="org.apache.derby.jdbc.ClientDriver"
        url="jdbc:derby://@derbyserver@:@derbyserverport@/usersDB" />

    <Realm className="org.apache.catalina.realm.LockOutRealm">
        <Realm
            className="org.greenstone.gsdl3.GoogleSigninJDBCRealm"
            userTable="USERS" userNameCol="USERNAME" userCredCol="PASSWORD"
            userRoleTable="ROLES" roleNameCol="ROLE"
            userEmailCol="email"
            googlesigninClientId="@googlesigninclientid@"
            localDataSource="true"
            dataSourceName="jdbc/realmDB" />
    </Realm>

    <!-- Session Manager. Default values are used. See
         packages/tomcat/webapps/docs/config/manager.html for more info.
         Pathname may be absolute, or relative to greenstone3 context work 
         directory: packages/tomcat/work/Catalina/localhost/greenstone3.
         Set pathname="" to disable storing session info between restarts. 
         To manually clear session info, stop Tomcat and delete the session
         file. -->
    <Manager pathname="SESSIONS.ser" />

    <!-- Allow all machines or just this machine: 127.0.0.1 (IPv4) and 0:0:0:0:0:0:0:1 (IPv6, needed on windows)
         https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html -->
    <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="@allowedIPs@"/>

    <!-- Allows us to include the file:
           <GSDL3SRCHOME>/web/WEB-INF/rewrite.config
         Currently used (by default) to monitor for GS3 DL calls that use:
           &href=... and rl=0 ...
         and rewrite them so they are forbidden by the server.
         This is because malicious users can use this form of CGI URL supported by Greenstone3
         to mount an Open Redirect attack -->
    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve"/>
    
</Context>