Tomcat security restriction for a valid user

Question

I am trying to protect a resource in tomcat so that only "real users" (those with a valid username and password in the field) can access it. They do not necessarily belong to a group in the kingdom. I tried with many combinations of the <security-constraint> directive without success. Any ideas?

Answer 1

Besides the auth restriction that you add to the security restriction:

  <auth-constraint> <role-name>*</role-name> </auth-constraint> 

you need to specify the security role in the web application:

  <security-role> <role-name>*</role-name> </security-role> 

Answer 2

Tomcat implements several realm implementations, memory, database, JAAS and much more. The easiest way to configure (though not the safest) memory file that contains a single XML file is usually found in conf / tomcat-users.xml:

 <tomcat-users> <user name="tomcat" password="tomcat" roles="tomcat" /> <user name="role1" password="tomcat" roles="role1" /> <user name="both" password="tomcat" roles="tomcat,role1" /> </tomcat-users> 

An area configuration is in context, a host or engine configuration, for example:

 <Realm className="org.apache.catalina.realm.MemoryRealm" pathname="conf/tomcat-users.xml" /> 

Then in web.xml you put the following definition:

  <security-constraint> <web-resource-collection> <web-resource-name>MRC Customer Care</web-resource-name> <url-pattern>/protected/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>role1</role-name> </auth-constraint> </security-constraint> <!-- Define the Login Configuration for this Application --> <login-config> <auth-method>DIGEST</auth-method> <realm-name>YOUR REALM NAME</realm-name> </login-config> <security-role> <description> The role that is required to access the application. Should be on from the realm (the tomcat-users.xml file). </description> <role-name>role1</role-name> </security-role> 

Part of web.xml is taken (with slight modifications) from one of our web applications.