Cannot log into management pages

[Scott Jackson]

I'm sure this comes up too often, and I've found other threads but the solutions given have not helped me.

I've installed Tomcat 7 on OSX Mountain Lion according to the instructions at:
http://www.joel.lopes-da-silva.com/2008/05/13/installing-tomcat-on-mac-os-x/

I'm using the following tomcat-users.xml:<?xml version="1.0" encoding="utf-8"?> <tomcat-users> <role rolename="manager-gui"/> <role rolename="manager-script"/> <role rolename="manager-jmx"/> <role rolename="manager-status"/> <user username="tomcat" password="password" roles="manager-gui,manager-script,manager-jmx,manager-status"/> </tomcat>The login prompt is repeated over-and-over, until canceled and a 401 Unauthorized is returned.

Thank you for your assistance,
-Scott Jackson

[Tim Holloway]

Welcome to the JavaRanch, Scott!

Usually people worry about the tomcat-users.xml file (which appears to be OK for you), but neglect to switch on the Realm that uses it.

Tomcat (like most J2EE servers) supports a "plug-in" security system. The tomcat-users.xml file is used by the MemoryRealm and UserDataBaseRealm plugins, so you have to activate one of them. In the Tomcat6 supplied server.xml, that Realm is already coded in, but it's commented out.

[Scott Jackson]

Hi Tim. It's been a warm welcome from all.

I looked at the server.xml, and it appears the UserDatabaseRealm was already enabled. <Realm className="org.apache.catalina.realm.LockOutRealm"> <!-- This Realm uses the UserDatabase configured in the global JNDI resources under the key "UserDatabase". Any edits that are performed against this UserDatabase are immediately available for use by the Realm. --> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/> </Realm>My XML editor says that block is not commented out, so this doesn't appear to be the problem?

Thank you!
-Scott

[Scott Jackson]

Not sure if it is related, but the security listener IS commented out: <!-- Security listener. Documentation at /docs/config/listeners.html <Listener className="org.apache.catalina.security.SecurityListener" /> -->

[Scott Jackson]

OK I have it working, but I'm not sure what I did that did it.

First, I attempted to see if it was a permissions issue. Since my instructions configured tomcat to run under a specific account, I gave that account (and group) blanket ownership of the files in the install directory (and below).

cd /usr/local/tomcat
chown -R _tomcat:_tomcat *

This did not solve the problem. A coworker suggested replacing my tomcat-users.xml with the one in the distribution archive, which I did. I then added the manager-gui role to the tomcat user as follows:<?xml version='1.0' encoding='utf-8'?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <tomcat-users> <!-- NOTE: By default, no user is included in the "manager-gui" role required to operate the "/manager/html" web application. If you wish to use this app, you must define such a user - the username and password are arbitrary. --> <!-- NOTE: The sample user and role entries below are wrapped in a comment and thus are ignored when reading this file. Do not forget to remove <!.. ..> that surrounds them. --> <role rolename="tomcat"/> <role rolename="role1"/> <role rolename="manager-gui"/> <user username="tomcat" password="tomcat" roles="tomcat,manager-gui"/> <user username="both" password="tomcat" roles="tomcat,role1"/> <user username="role1" password="tomcat" roles="role1"/> </tomcat-users>And at this point I can login as the user "tomcat". With it operational now, I'm a little timid about tearing it all back down and trying to reproduce my success. Hopefully this will help someone in the future, though.