Apache Tomcat - Embedded Servlet Container Configuration
Note that by default, the embedded container attempts to enable the HTTP2 protocol.
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-webapp-tomcat</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-webapp-tomcat:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-webapp-tomcat"
}
1
2
3
4
5
6
7
8
9
10
11
12
13
dependencies {
/*
The following platform references are included automatically and are listed for reference only.
implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
Including this module in the CAS WAR overlay is optional and unnecessary. This module is automatically included
and bundled with the CAS server distribution and there are alternative options baked in to allow one to replace
this module with another. The entry below is listed for reference only.
*/
implementation "org.apereo.cas:cas-server-webapp-tomcat"
}
Configuration
The following settings and properties are available from the CAS configuration catalog:
server.tomcat.accept-countMaximum queue length for incoming connection requests when all possible request processing threads are in use.
100Maximum queue length for incoming connection requests when all possible request processing threads are in use.
server.tomcat.accesslog.bufferedWhether to buffer output such that it is flushed only periodically.
trueWhether to buffer output such that it is flushed only periodically.
server.tomcat.accesslog.check-existsWhether to check for log file existence so it can be recreated if an external process has renamed it.
falseWhether to check for log file existence so it can be recreated if an external process has renamed it.
server.tomcat.accesslog.condition-ifWhether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionIf)" does not yield null.
Whether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionIf)" does not yield null.
server.tomcat.accesslog.condition-unlessWhether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionUnless)" yield null.
Whether logging of the request will only be enabled if "ServletRequest.getAttribute(conditionUnless)" yield null.
server.tomcat.accesslog.directoryDirectory in which log files are created.
logsDirectory in which log files are created. Can be absolute or relative to the Tomcat base dir.
server.tomcat.accesslog.enabledEnable access log.
falseEnable access log.
server.tomcat.accesslog.encodingCharacter set used by the log file.
Character set used by the log file. Default to the system default character set.
server.tomcat.accesslog.file-date-formatDate format to place in the log file name.
.yyyy-MM-ddDate format to place in the log file name.
server.tomcat.accesslog.ipv6-canonicalWhether to use IPv6 canonical representation format as defined by RFC 5952.
falseWhether to use IPv6 canonical representation format as defined by RFC 5952.
server.tomcat.accesslog.localeLocale used to format timestamps in log entries and in log file name suffix.
Locale used to format timestamps in log entries and in log file name suffix. Default to the default locale of the Java process.
server.tomcat.accesslog.max-daysNumber of days to retain the access log files before they are removed.
-1Number of days to retain the access log files before they are removed.
server.tomcat.accesslog.patternFormat pattern for access logs.
commonFormat pattern for access logs.
server.tomcat.accesslog.prefixLog file name prefix.
access_logLog file name prefix.
server.tomcat.accesslog.rename-on-rotateWhether to defer inclusion of the date stamp in the file name until rotate time.
falseWhether to defer inclusion of the date stamp in the file name until rotate time.
server.tomcat.accesslog.request-attributes-enabledSet request attributes for the IP address, Hostname, protocol, and port used for the request.
falseSet request attributes for the IP address, Hostname, protocol, and port used for the request.
server.tomcat.accesslog.rotateWhether to enable access log rotation.
trueWhether to enable access log rotation.
server.tomcat.accesslog.suffixLog file name suffix.
.logLog file name suffix.
server.tomcat.additional-tld-skip-patterns
server.tomcat.background-processor-delayDelay between the invocation of backgroundProcess methods.
10sDelay between the invocation of backgroundProcess methods. If a duration suffix is not specified, seconds will be used.
server.tomcat.basedirTomcat base directory.
Tomcat base directory. If not specified, a temporary directory is used.
server.tomcat.connection-timeoutAmount of time the connector will wait, after accepting a connection, for the request URI line to be presented.
Amount of time the connector will wait, after accepting a connection, for the request URI line to be presented.
server.tomcat.keep-alive-timeoutTime to wait for another HTTP request before the connection is closed.
Time to wait for another HTTP request before the connection is closed. When not set the connectionTimeout is used. When set to -1 there will be no timeout.
server.tomcat.max-connectionsMaximum number of connections that the server accepts and processes at any given time.
8192Maximum number of connections that the server accepts and processes at any given time. Once the limit has been reached, the operating system may still accept connections based on the "acceptCount" property.
server.tomcat.max-http-form-post-sizeMaximum size of the form content in any HTTP post request.
2MBMaximum size of the form content in any HTTP post request.
server.tomcat.max-http-post-size
server.tomcat.max-http-response-header-sizeMaximum size of the HTTP response header.
8KBMaximum size of the HTTP response header.
server.tomcat.max-keep-alive-requestsMaximum number of HTTP requests that can be pipelined before the connection is closed.
100Maximum number of HTTP requests that can be pipelined before the connection is closed. When set to 0 or 1, keep-alive and pipelining are disabled. When set to -1, an unlimited number of pipelined or keep-alive requests are allowed.
server.tomcat.max-parameter-countMaximum number of parameters (GET plus POST) that will be automatically parsed by the container.
1000Maximum number of parameters (GET plus POST) that will be automatically parsed by the container. A value of less than 0 means no limit.
server.tomcat.max-part-countMaximum total number of parts permitted in a multipart/form-data request.
50Maximum total number of parts permitted in a multipart/form-data request. Requests that exceed this limit will be rejected. A value of less than 0 means no limit.
server.tomcat.max-part-header-sizeMaximum per-part header size permitted in a multipart/form-data request.
512BMaximum per-part header size permitted in a multipart/form-data request. Requests that exceed this limit will be rejected. A value of less than 0 means no limit.
server.tomcat.max-swallow-sizeMaximum amount of request body to swallow.
2MBMaximum amount of request body to swallow.
server.tomcat.mbeanregistry.enabledWhether Tomcat's MBean Registry should be enabled.
falseWhether Tomcat's MBean Registry should be enabled.
server.tomcat.processor-cacheMaximum number of idle processors that will be retained in the cache and reused with a subsequent request.
200Maximum number of idle processors that will be retained in the cache and reused with a subsequent request. When set to -1 the cache will be unlimited with a theoretical maximum size equal to the maximum number of connections.
server.tomcat.redirect-context-root
server.tomcat.reject-illegal-header
server.tomcat.relaxed-path-charsList of additional unencoded characters that should be allowed in URI paths.
List of additional unencoded characters that should be allowed in URI paths. Only "< > [ \ ] ^ ` { | }" are allowed.
server.tomcat.relaxed-query-charsList of additional unencoded characters that should be allowed in URI query strings.
List of additional unencoded characters that should be allowed in URI query strings. Only "< > [ \ ] ^ ` { | }" are allowed.
server.tomcat.remoteip.host-headerName of the HTTP header from which the remote host is extracted.
X-Forwarded-HostName of the HTTP header from which the remote host is extracted.
server.tomcat.remoteip.internal-proxiesInternal proxies that are to be trusted.
10.0.0.0/8, 192.168.0.0/16, 169.254.0.0/16, 100.64.0.0/10, fc00::/7, 172.16.0.0/12, ::1/128, 127.0.0.0/8, fe80::/10Internal proxies that are to be trusted. Can be set as a comma separate list of CIDR or as a regular expression.
server.tomcat.remoteip.port-headerName of the HTTP header used to override the original port value.
X-Forwarded-PortName of the HTTP header used to override the original port value.
server.tomcat.remoteip.protocol-headerHeader that holds the incoming protocol, usually named "X-Forwarded-Proto".
Header that holds the incoming protocol, usually named "X-Forwarded-Proto".
server.tomcat.remoteip.protocol-header-https-valueValue of the protocol header indicating whether the incoming request uses SSL.
httpsValue of the protocol header indicating whether the incoming request uses SSL.
server.tomcat.remoteip.remote-ip-headerName of the HTTP header from which the remote IP is extracted.
Name of the HTTP header from which the remote IP is extracted. For instance, 'X-FORWARDED-FOR'.
server.tomcat.remoteip.trusted-proxiesRegular expression defining proxies that are trusted when they appear in the "remote-ip-header" header.
Regular expression defining proxies that are trusted when they appear in the "remote-ip-header" header.
server.tomcat.resource.allow-cachingWhether static resource caching is permitted for this web application.
trueWhether static resource caching is permitted for this web application.
server.tomcat.resource.cache-max-sizeMaximum size of the static resource cache.
10MBMaximum size of the static resource cache.
server.tomcat.resource.cache-ttlTime-to-live of the static resource cache.
5sTime-to-live of the static resource cache.
server.tomcat.servlet.additional-tld-skip-patternsList of additional patterns that match jars to ignore for TLD scanning.
List of additional patterns that match jars to ignore for TLD scanning. The special '?' and '*' characters can be used in the pattern to match one and only one character and zero or more characters respectively.
server.tomcat.servlet.redirect-context-rootWhether requests to the context root should be redirected by appending a / to the path.
trueWhether requests to the context root should be redirected by appending a / to the path. When using SSL terminated at a proxy, this property should be set to false.
server.tomcat.servlet.use-relative-redirectsWhether HTTP 1.1 and later location headers generated by a call to sendRedirect will use relative or absolute redirects.
trueWhether HTTP 1.1 and later location headers generated by a call to sendRedirect will use relative or absolute redirects.
server.tomcat.threads.maxMaximum amount of worker threads.
200Maximum amount of worker threads. Doesn't have an effect if virtual threads are enabled.
server.tomcat.threads.max-queue-capacityMaximum capacity of the thread pool's backing queue.
2147483647Maximum capacity of the thread pool's backing queue. This setting only has an effect if the value is greater than 0.
server.tomcat.threads.min-spareMinimum amount of worker threads.
10Minimum amount of worker threads. Doesn't have an effect if virtual threads are enabled.
server.tomcat.uri-encodingCharacter encoding to use to decode the URI.
UTF-8Character encoding to use to decode the URI.
server.tomcat.use-aprWhether to use APR.
neverWhether to use APR.
server.tomcat.use-relative-redirects
Required settings may be needed to activate or affect the feature; review them even when they have a default. Optional settings only need to be set to change a default or to turn on the behavior they control. Third party settings belong to libraries such as Spring Boot that CAS builds on; their own documentation may have more detail.
Notes on configuration
Configuration Metadata
The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.
Be Selective
This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.
YAGNI
Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.
Naming Convention
Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all
forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where
this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those
that might be presented to the system via an external library or framework such as Spring Boot, etc.
Note
When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions) MUST remain in camelCase mode.
Settings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided
to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with
the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition
or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the
way you intend.
Validation
Configuration properties are automatically validated on CAS startup to report issues with configuration binding, especially if defined CAS settings cannot be recognized or validated by the configuration schema. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.
Indexed Settings
CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be
incremented by the adopter to allow for distinct multiple configuration blocks.
IPv4 Configuration
In order to force Apache Tomcat to use IPv4, configure the following as a system property for your run command:
1
-Djava.net.preferIPv4Stack=true
The same sort of configuration needs to be applied to your $CATALINA_OPTS
environment variable in case of an external container.