In a test environment:
When enabling the AJP13 connector, update the server.xml with:
secretRequired="false"# /conf/server.xml
<!-- feature:begin:AJP13:on -->
<Connector executor="tomcatThreadPool"
address="${psc.as.ajp13.address}"
port="${psc.as.ajp13.port}"
protocol="AJP/1.3"
asyncTimeout="${psc.as.msg.timeout}"
maxPostSize="${psc.as.msg.maxpostsize}"
acceptCount="${psc.as.http.maxqueuesize}"
maxConnections="${psc.as.http.maxconnections}"
tomcatAuthentication="${psc.as.ajp13.tomcatauth}"
redirectPort="${psc.as.https.port}"
URIEncoding="${psc.as.http.uriencoding}"
secretRequired="false" />
<!-- feature:end:AJP13:on -->
feature:end:AJP13:on -->
# /conf/Catalina.properties
# AJP13 user tomcat auth versus parent server
psc.as.ajp13.tomcatauth=false
# AJP13 IP address AJPConnector listens on
# To receive connections from anywhere when PAS and LB on different machines
psc.as.ajp13.address=::
# To receive connections from a specific server
psc.as.ajp13.address=[private IP of Server]
psc.as.ajp13.port=50000
Considerations in production:
0. If the reverse proxy and Tomcat are on the same box:
Use the loopback address if all the users that can access this box are trusted.
They can issue requests directly to the AJP13 port once logged on to the machine:
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="0.0.0.0" secretRequired="false" />
If the reverse proxy and Tomcat are on different boxes:
a. Use a firewall on the PASOE box to accept connections to the AJP13 port only from specific hosts
b. A dedicated subnet for the reverse proxy to Tomcat communications
1. Protect AJP with a secret for the reverse proxy workers and the AJP connector
This requires using either mod_jk or a version of httpd that supports the secret parameter:
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="0.0.0.0" secretRequired="true" />
# httpd-ajp.conf
ProxyPass / ajp://127.0.0.1:8009/ secret=123
2. Disable AJP altogether in Tomcat, and instead use HTTP or HTTPS for incoming proxy connections by configuring an Apache server to work as a reverse proxy and use the HTTP connector in Tomcat
Currently (as of 09-Feb-2021) the following enhancement request is open, suggesting that the secretRequired parameter for AJP13 be included by default in conf/server.xml. Voting from more Customers indicating the importance of this Idea will determine it's priority for inclusionL
