Tomcat security constraint for valid user

Question

I\'m trying to protect a resource in tomcat so that only \"valid users\" (those with a valid login and password in the realm) can access it. They do not necessarily belong to a

Answer 1

If we are using Tomcat 8.x , as the provided server.xml will come in a nested Realm element, please add 'allRolesMode="authOnly"' in the "outmost" Realm element and change aforementioned web.xml for testing. e.g.

Please read org.apache.catalina.realm.RealmBase.java for details.

Also, following settings in logging.properties are useful.

org.apache.catalina.realm.level=ALL
org.apache.catalina.realm.useParentHandlers=true
org.apache.catalina.authenticator.level=ALL
org.apache.catalina.authenticator.useParentHandlers=true