In a previous blog entry, Mercurial on GlassFish 2.1 Using Multiple Repositories, I successfully deployed Mercurial repositories on GlassFish. This time I have given everything a Java EE 6 upgrade.
One of the great aspects of using GlassFish to provide SSL is that we don't require messy configuration in Python and Mercurial to implement SSL. GlassFish handles the security for us. The only thing that the end client users will want to do is add the server fingerprint to the .hgrc file in their home directory. This will remove any warnings about a missing server fingerprint, or cacerts file.
If you have used Mercurial on Apache HTTPD Server, along with cacerts, and client certificates... this will make you make the switch immediately.
Note: The requirements include repos.zip which is optional. The repos.zip contains sample mercurial repos which are required for the demo.
- Start the GlassFish administration console.
- Go to Configuration → server-config → Security → Realms → file.
Note: You may create your own realm, this is just for demonstration purposes.
- Click on Manage Users.
GlassFish Security Configuration
- Click on New. Add a user called mercurial in a group called Mercurial Users with the password hg.
Note: Please change the username, group, and password for production.
- The server configuration is complete.
- Using NetBeans open the Mercurial project from the requirements link above.
- There are four files in the project (simple huh?) which control the behavior of the Mercurial repository on GlassFish: hgweb.cgi, hgweb.config, web.xml, and glassfish-web.xml.
- The hgweb.cgi should not need to be modified under normal circumstances.
- Open the hgweb.config file. Make any changes that you would like to customize the application. Pay particular attention to the location of the repositories.
There are two examples: (1) using the "/" along with a * on the end of the file path will list all repositories in the specified directory, and (2) a specific listing.
Note: Please note that allow_push = * and push_ssl = false are set. This will allow push to the server and let GlassFish take care of the SSL.
- The web.xml file has been modified to add security constraints for the alpha, and beta example repositories.
The alpha repository has security only on PUT, POST, and DELETE.
The beta repository will not allow you to perform any actions without logging into the server.
The gamma repository has no security constraints.
Note: You will need to modify the security constraints to meet your requirements.
Note: You secure the entire repository by adding:
- The glassfish-web.xml is used to map the security role(s) to the file realm on the GlassFish server.
- Clean, build, and Run the application.
- When the application successfully deploys, go to the secure connection on https://localhost:8181/Mercurial. It may prompt you to accept the server certificate. Accept it.
- You should see something like the image below:
- Click on the beta repository. It should prompt you to login.
- Congratulations you are running Mercurial on GlassFish securely.
Note: To secure the application completely, you should disable the non-secure http port listener on port 8080, or redirect requests to the secure port.
VerificationIt would be unwise to accept that the application is secure without verification.
I made this demonstration video to prove the connection is secure. The demonstration shows both insecure and secure connections to the repository. I use Wireshark to sniff the connection, and pull the repository from the command line using