Apache Tomcat - Embedded Servlet Container Configuration

Note that by default, the embedded container attempts to enable the HTTP2 protocol.

1
2
3
4
5
<dependency>
    <groupId>org.apereo.cas</groupId>
    <artifactId>cas-server-webapp-tomcat</artifactId>
    <version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-webapp-tomcat:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
    imports {
        mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
    }
}

dependencies {
    implementation "org.apereo.cas:cas-server-webapp-tomcat"
}
1
2
3
4
5
6
7
8
9
10
11
12
13
dependencies {
    /*
        The following platform references should be included automatically and are listed here for reference only.

        implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
        implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
        
        Including this module in the CAS WAR overlay is optional and unnecessary. This module is automatically included
        and bundled with the CAS server distribution and there are alternative options baked in to allow one to replace
        this module with another. The entry below is listed for reference only.
    */
    implementation "org.apereo.cas:cas-server-webapp-tomcat"
}

Configuration

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.

The configuration settings listed below are tagged as Optional in the CAS configuration metadata. This flag indicates that the presence of the setting is not immediately necessary in the end-user CAS configuration, because a default value is assigned or the activation of the feature is not conditionally controlled by the setting value. In other words, you should only include this field in your configuration if you need to modify the default value or if you need to turn on the feature controlled by the setting.

The configuration settings listed below are tagged as Third Party in the CAS configuration metadata. This flag indicates that the configuration setting is not controlled, owned or managed by the CAS ecosystem, and affects functionality that is offered by a third-party library, such as Spring Boot or Spring Cloud to CAS. For additional info, you might have to visit the third-party source to find more details.

  • server.tomcat.accept-count=100
  • Maximum queue length for incoming connection requests when all possible request processing threads are in use.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.accesslog.buffered=true
  • Whether to buffer output such that it is flushed only periodically.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.check-exists=false
  • Whether to check for log file existence so it can be recreated if an external process has renamed it.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.condition-if=
  • Whether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionIf)" does not yield null.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.condition-unless=
  • Whether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionUnless)" yield null.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.directory=logs
  • Directory in which log files are created. Can be absolute or relative to the Tomcat base dir.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.enabled=false
  • Enable access log.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.encoding=
  • Character set used by the log file. Default to the system default character set.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.file-date-format=.yyyy-MM-dd
  • Date format to place in the log file name.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.ipv6-canonical=false
  • Whether to use IPv6 canonical representation format as defined by RFC 5952.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.locale=
  • Locale used to format timestamps in log entries and in log file name suffix. Default to the default locale of the Java process.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.max-days=-1
  • Number of days to retain the access log files before they are removed.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.pattern=common
  • Format pattern for access logs.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.prefix=access_log
  • Log file name prefix.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.rename-on-rotate=false
  • Whether to defer inclusion of the date stamp in the file name until rotate time.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.request-attributes-enabled=false
  • Set request attributes for the IP address, Hostname, protocol, and port used for the request.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.rotate=true
  • Whether to enable access log rotation.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.accesslog.suffix=.log
  • Log file name suffix.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Accesslog.

    How can I configure this property?

  • server.tomcat.additional-tld-skip-patterns=
  • Comma-separated list of additional patterns that match jars to ignore for TLD scanning. The special '?' and '*' characters can be used in the pattern to match one and only one character and zero or more characters respectively.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.background-processor-delay=10s
  • Delay between the invocation of backgroundProcess methods. If a duration suffix is not specified, seconds will be used.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.basedir=
  • Tomcat base directory. If not specified, a temporary directory is used.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.connection-timeout=
  • Amount of time the connector will wait, after accepting a connection, for the request URI line to be presented.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.keep-alive-timeout=
  • Time to wait for another HTTP request before the connection is closed. When not set the connectionTimeout is used. When set to -1 there will be no timeout.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.max-connections=8192
  • Maximum number of connections that the server accepts and processes at any given time. Once the limit has been reached, the operating system may still accept connections based on the "acceptCount" property.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.max-http-form-post-size=2MB
  • Maximum size of the form content in any HTTP post request.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.max-http-post-size=
  • How can I configure this property?

    Deprecation status is ERRORwith a replacement setting: server.tomcat.max-http-form-post-size.

  • server.tomcat.max-http-response-header-size=8KB
  • Maximum size of the HTTP response header.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.max-keep-alive-requests=100
  • Maximum number of HTTP requests that can be pipelined before the connection is closed. When set to 0 or 1, keep-alive and pipelining are disabled. When set to -1, an unlimited number of pipelined or keep-alive requests are allowed.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.max-swallow-size=2MB
  • Maximum amount of request body to swallow.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.mbeanregistry.enabled=false
  • Whether Tomcat's MBean Registry should be enabled.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Mbeanregistry.

    How can I configure this property?

  • server.tomcat.processor-cache=200
  • Maximum number of idle processors that will be retained in the cache and reused with a subsequent request. When set to -1 the cache will be unlimited with a theoretical maximum size equal to the maximum number of connections.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.redirect-context-root=true
  • Whether requests to the context root should be redirected by appending a / to the path. When using SSL terminated at a proxy, this property should be set to false.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.reject-illegal-header=true
  • Whether to reject requests with illegal header names or values. Deprecation: since 2.7.12 for removal in 3.3.0

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

    Deprecation status is WARNINGwithout a replacement setting.

  • server.tomcat.relaxed-path-chars=
  • Comma-separated list of additional unencoded characters that should be allowed in URI paths. Only "< > [ \ ] ^ ` { | }" are allowed.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.relaxed-query-chars=
  • Comma-separated list of additional unencoded characters that should be allowed in URI query strings. Only "< > [ \ ] ^ ` { | }" are allowed.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.remoteip.host-header=X-Forwarded-Host
  • Name of the HTTP header from which the remote host is extracted.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.internal-proxies=10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|100\.6[4-9]{1}\.\d{1,3}\.\d{1,3}|100\.[7-9]{1}\d{1}\.\d{1,3}\.\d{1,3}|100\.1[0-1]{1}\d{1}\.\d{1,3}\.\d{1,3}|100\.12[0-7]{1}\.\d{1,3}\.\d{1,3}|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}|0:0:0:0:0:0:0:1|::1
  • Regular expression that matches proxies that are to be trusted.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.port-header=X-Forwarded-Port
  • Name of the HTTP header used to override the original port value.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.protocol-header=
  • Header that holds the incoming protocol, usually named "X-Forwarded-Proto".

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.protocol-header-https-value=https
  • Value of the protocol header indicating whether the incoming request uses SSL.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.remote-ip-header=
  • Name of the HTTP header from which the remote IP is extracted. For instance, 'X-FORWARDED-FOR'.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.remoteip.trusted-proxies=
  • Regular expression defining proxies that are trusted when they appear in the "remote-ip-header" header.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Remoteip.

    How can I configure this property?

  • server.tomcat.resource.allow-caching=true
  • Whether static resource caching is permitted for this web application.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Resource.

    How can I configure this property?

  • server.tomcat.resource.cache-ttl=
  • Time-to-live of the static resource cache.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Resource.

    How can I configure this property?

  • server.tomcat.threads.max=200
  • Maximum amount of worker threads. Doesn't have an effect if virtual threads are enabled.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Threads.

    How can I configure this property?

  • server.tomcat.threads.max-queue-capacity=2147483647
  • Maximum capacity of the thread pool's backing queue.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Threads.

    How can I configure this property?

  • server.tomcat.threads.min-spare=10
  • Minimum amount of worker threads. Doesn't have an effect if virtual threads are enabled.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat$Threads.

    How can I configure this property?

  • server.tomcat.uri-encoding=UTF-8
  • Character encoding to use to decode the URI.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

  • server.tomcat.use-relative-redirects=false
  • Whether HTTP 1.1 and later location headers generated by a call to sendRedirect will use relative or absolute redirects.

    org.springframework.boot.autoconfigure.web.ServerProperties$Tomcat.

    How can I configure this property?

    Configuration Metadata

    The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.

    Be Selective

    This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.

    YAGNI

    Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.

    Naming Convention

    Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc.

    :information_source: Note

    When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value. The only possible exception to this rule is when naming actuator endpoints; The name of the actuator endpoints (i.e. ssoSessions) MUST remain in camelCase mode.

    Settings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.

    Validation

    Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.

    Indexed Settings

    CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.

    IPv4 Configuration

    In order to force Apache Tomcat to use IPv4, configure the following as a system property for your run command:

    1
    
    -Djava.net.preferIPv4Stack=true 
    

    The same sort of configuration needs to be applied to your $CATALINA_OPTS environment variable in case of an external container.