Security Contraints setup..

[O. Ziggy]

Hi,

Im trying to setup a security realm so that the user can log in via HTTP Authentication.
Im running two machines one with tomcat 5.0(on Windows) and the other one with tomcat 4.1(on Unix)

I have setup the web.xml, tomcat_users and server.xml file
but i dont seem to be able to get it to work on the Unix machine.
The same configuration works fine on my windows box.

Could you please look at this configuration and let me know if i am doing something wrong..
thanks.. (Please note that this works on the windows machine but not on the unix machine)

The Server.xml files are not quite the same, is this where my problem is? I have posted both server.xml files for windows and unix and hopefully someone can spot the problem. All the other files web.xml, tomcat-users are the same on both platforms(Also note tomcat on windows is 5.0 and on unix is 4.1)

web.xml

 
 
<!-- The Usual Welcome File List -->
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
 
<security-constraint>
<web-resource-collection>
<web-resource-name>Web-FHL</web-resource-name>
<url-pattern>/main/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>webfhl</role-name>
</auth-constraint>
</security-constraint>
 
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Web-FHL</realm-name>
</login-config>
 

tomcat-users.xml

 
<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="webfhl"/>
  <role rolename="role1"/>
  <role rolename="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user name="ccsukadmin" password="password" roles="webfhl" />
</tomcat-users>
 

Server.xml (On Unix)

<!-- Example Server Configuration File -->
<!-- Note that component elements are nested corresponding to their
     parent-child relationships with each other -->
 
<!-- A "Server" is a singleton element that represents the entire JVM,
     which may contain one or more "Service" instances.  The Server
     listens for a shutdown command on the indicated port.
 
     Note:  A "Server" is not itself a "Container", so you may not
     define subcomponents such as "Valves" or "Loggers" at this level.
 -->
 
<!--Server port="8005" shutdown="SHUTDOWN" debug="0"-->
<Server>
 
  <!-- A "Service" is a collection of one or more "Connectors" that share
       a single "Container" (and therefore the web applications visible
       within that Container).  Normally, that Container is an "Engine",
       but this is not required.
 
       Note:  A "Service" is not itself a "Container", so you may not
       define subcomponents such as "Valves" or "Loggers" at this level.
   -->
 
  <!-- Define the Tomcat Stand-Alone Service -->
  <Service name="Tomcat-Standalone">
 
    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned.  Each Connector passes requests on to the
         associated "Container" (normally an Engine) for processing.
 
         By default, a non-SSL HTTP/1.1 Connector is established on port 8080.
         You can also enable an SSL HTTP/1.1 Connector on port 8443 by
         following the instructions below and uncommenting the second Connector
         entry.  SSL support requires the following steps (see the SSL Config
         HOWTO in the Tomcat 4.0 documentation bundle for more detailed
         instructions):
         * Download and install JSSE 1.0.2 or later, and put the JAR files
           into "$JAVA_HOME/jre/lib/ext".
         * Execute:
             %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)
             $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)
           with a password value of "changeit" for both the certificate and
           the keystore itself.
 
         By default, DNS lookups are enabled when a web application calls
         request.getRemoteHost().  This can have an adverse impact on
         performance, so you can disable it by setting the
         "enableLookups" attribute to "false".  When DNS lookups are disabled,
         request.getRemoteHost() will return the String version of the
         IP address of the remote client.
    -->
 
    <!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
    <Connector className="org.apache.catalina.connector.http.HttpConnector"
               port="8574" minProcessors="5" maxProcessors="75"
               enableLookups="true" 
               acceptCount="100" debug="0" connectionTimeout="60000"/>
    <!-- Note : To disable connection timeouts, set connectionTimeout value 
     to -1 -->
 
    <!-- Define an SSL HTTP/1.1 Connector on port 8443 -->
    <!--
    <Connector className="org.apache.catalina.connector.http.HttpConnector"
               port="8443" minProcessors="5" maxProcessors="75"
               enableLookups="true"
       acceptCount="50" debug="0" scheme="https" secure="true">
      <Factory className="org.apache.catalina.net.SSLServerSocketFactory"
               clientAuth="false" protocol="TLS"/>
    </Connector>
    -->
 
    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <!--
    <Connector className="org.apache.ajp.tomcat4.Ajp13Connector"
               port="8009" minProcessors="5" maxProcessors="75"
               acceptCount="10" debug="0"/>
    -->
 
    <!-- Define a Proxied HTTP/1.1 Connector on port 8081 -->
    <!-- See proxy documentation for more information about using this. -->
    <!--
    <Connector className="org.apache.catalina.connector.http.HttpConnector"
               port="8081" minProcessors="5" maxProcessors="75"
               enableLookups="true"
               acceptCount="10" debug="0" connectionTimeout="60000"
               proxyPort="80"/>
    -->
 
    <!-- Define a non-SSL HTTP/1.0 Test Connector on port 8082 -->
    <!--
    <Connector className="org.apache.catalina.connector.http10.HttpConnector"
               port="8082" minProcessors="5" maxProcessors="75"
               enableLookups="true" redirectPort="8443"
               acceptCount="10" debug="0"/>
    -->
 
    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host). -->
 
    <!-- Define the top level container in our container hierarchy -->
    <Engine name="Standalone" defaultHost="localhost" debug="0">
 
      <!-- The request dumper valve dumps useful debugging information about
           the request headers and cookies that were received, and the response
           headers and cookies that were sent, for all requests received by
           this instance of Tomcat.  If you care only about requests to a
           particular virtual host, or a particular application, nest this
           element inside the corresponding <Host> or <context> entry instead.
 
           For a similar mechanism that is portable to all Servlet 2.3
           containers, check out the "RequestDumperFilter" Filter in the
           example application (the source for this filter may be found in
           "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").
 
           Request dumping is disabled by default.  Uncomment the following
           element to enable it. -->
      <!--
      <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
      -->
 
      <!-- Global logger unless overridden at lower levels -->
      <Logger className="org.apache.catalina.logger.FileLogger"
              prefix="catalina_log." suffix=".txt"
              timestamp="true"/>
 
      <!-- Because this Realm is here, an instance will be shared globally -->
 
      <Realm className="org.apache.catalina.realm.MemoryRealm" />
 
      <!-- Replace the above Realm with one of the following to get a Realm
           stored in a database and accessed via JDBC -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="org.gjt.mm.mysql.Driver"
          connectionURL="jdbc:mysql://localhost/authority?user=test;password=test"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="oracle.jdbc.driver.OracleDriver"
          connectionURL="jdbc :-o	 racle:thin:@ntserver:1521 :-o	 RCL?user=scott;password=tiger"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="sun.jdbc.odbc.JdbcOdbcDriver"
          connectionURL="jdbc :-o	 dbc:CATALINA"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!-- Define the default virtual host -->
      <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true">
 
        <!-- Normally, users must authenticate themselves to each web app
             individually.  Uncomment the following entry if you would like
             a user to be authenticated the first time they encounter a
             resource protected by a security constraint, and then have that
             user identity maintained across *all* web applications contained
             in this virtual host. -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn"
                   debug="0"/>
        -->
 
        <!-- Access log processes all requests for this virtual host.  By
             default, log files are created in the "logs" directory relative to
             $CATALINA_HOME.  If you wish, you can specify a different
             directory with the "directory" attribute.  Specify either a relative
             (to $CATALINA_HOME) or absolute path to the desired directory.
        -->
        <Valve className="org.apache.catalina.valves.AccessLogValve"
                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
                 pattern="common"/>
 
        <!-- Logger shared by all Contexts related to this virtual host.  By
             default (when using FileLogger), log files are created in the "logs"
             directory relative to $CATALINA_HOME.  If you wish, you can specify
             a different directory with the "directory" attribute.  Specify either a
             relative (to $CATALINA_HOME) or absolute path to the desired
             directory.-->
        <Logger className="org.apache.catalina.logger.FileLogger"
                 directory="logs"  prefix="localhost_log." suffix=".txt"
        timestamp="true"/>
 
        <!-- Define properties for each web application.  This is only needed
             if you want to set non-default properties, or have web application
             document roots in places other than the virtual host's appBase
             directory.  -->
 
        <!-- Tomcat Root Context -->
        <!--
          <Context path="" docBase="ROOT" debug="0"/>
        -->
 
        <!-- Tomcat Manager Context -->
        <Context path="/manager" docBase="manager" 
         debug="0" privileged="true"/>
 
        <!-- Tomcat Examples Context -->
        <Context path="/examples" docBase="examples" debug="0"
                 reloadable="true">
          <Logger className="org.apache.catalina.logger.FileLogger"
                     prefix="localhost_examples_log." suffix=".txt"
          timestamp="true"/>
          <Ejb   name="ejb/EmplRecord" type="Entity"
                 home="com.wombat.empl.EmployeeRecordHome"
               remote="com.wombat.empl.EmployeeRecord"/>
          <!-- PersistentManager: Uncomment the section below to test Persistent 
       Sessions.
                         
               saveOnRestart: If true, all active sessions will be saved
                 to the Store when Catalina is shutdown, regardless of
                 other settings. All Sessions found in the Store will be 
                 loaded on startup. Sessions past their expiration are
                 ignored in both cases.
               maxActiveSessions: If 0 or greater, having too many active 
                 sessions will result in some being swapped out. minIdleSwap
                 limits this. -1 means unlimited sessions are allowed.
                 0 means sessions will almost always be swapped out after
                 use - this will be noticeably slow for your users.
               minIdleSwap: Sessions must be idle for at least this long
                 (in seconds) before they will be swapped out due to 
               maxActiveSessions. This avoids thrashing when the site is 
                 highly active. -1 or 0 means there is no minimum - sessions
                 can be swapped out at any time.
               maxIdleSwap: Sessions will be swapped out if idle for this
                 long (in seconds). If minIdleSwap is higher, then it will
                 override this. This isn't exact: it is checked periodically.
                 -1 means sessions won't be swapped out for this reason,
                 although they may be swapped out for maxActiveSessions.
                 If set to >= 0, guarantees that all sessions found in the
                 Store will be loaded on startup.
               maxIdleBackup: Sessions will be backed up (saved to the Store,
                 but left in active memory) if idle for this long (in seconds), 
                 and all sessions found in the Store will be loaded on startup.
                 If set to -1 sessions will not be backed up, 0 means they
                 should be backed up shortly after being used.
 
               To clear sessions from the Store, set maxActiveSessions, maxIdleSwap,
               and minIdleBackup all to -1, saveOnRestart to false, then restart 
               Catalina.
          -->
  <!--
          <Manager className="org.apache.catalina.session.PersistentManager"
              debug="0"
              saveOnRestart="true"
              maxActiveSessions="-1"
              minIdleSwap="-1"
              maxIdleSwap="-1"
              maxIdleBackup="-1">
                <Store className="org.apache.catalina.session.FileStore"/>
          </Manager>
  -->
          <Environment name="maxExemptions" type="java.lang.Integer"
                      value="15"/>
          <Parameter name="context.param.name" value="context.param.value"
                     override="false"/>
          <Resource name="jdbc/EmployeeAppDb" auth="SERVLET"
                    type="javax.sql.DataSource"/>
          <ResourceParams name="jdbc/EmployeeAppDb">
            <parameter><name>user</name><value>sa</value></parameter>
            <parameter><name>password</name><value></value></parameter>
            <parameter><name>driverClassName</name>
              <value>org.hsql.jdbcDriver</value></parameter>
            <parameter><name>driverName</name>
              <value>jdbc:HypersonicSQL :mrgreen: atabase</value></parameter>
          </ResourceParams>
          <Resource name="mail/Session" auth="Container"
                    type="javax.mail.Session"/>
          <ResourceParams name="mail/Session">
            <parameter>
              <name>mail.smtp.host</name>
              <value>localhost</value>
            </parameter>
          </ResourceParams>
        </Context>
 
      </Host>
 
    </Engine>
 
  </Service>
 
  <!-- The MOD_WEBAPP connector is used to connect Apache 1.3 with Tomcat 4.0
       as its servlet container. Please read the README.txt file coming with
       the WebApp Module distribution on how to build it.
       (Or check out the "jakarta-tomcat-connectors/webapp" CVS repository)
 
       To configure the Apache side, you must ensure that you have the
       "ServerName" and "Port" directives defined in "httpd.conf".  Then,
       lines like these to the bottom of your "httpd.conf" file:
 
         LoadModule webapp_module libexec/mod_webapp.so
         WebAppConnection warpConnection warp localhost:8008
         WebAppDeploy examples warpConnection /examples/
 
       The next time you restart Apache (after restarting Tomcat, if needed)
       the connection will be established, and all applications you make
       visible via "WebAppDeploy" directives can be accessed through Apache.
  -->
 

 
</Server>
 

Server.xml on Windows

<?xml version="1.0" encoding="UTF-8"?>
<!-- Example Server Configuration File --><!-- Note that component elements are nested corresponding to their
     parent-child relationships with each other --><!-- A "Server" is a singleton element that represents the entire JVM,
     which may contain one or more "Service" instances.  The Server
     listens for a shutdown command on the indicated port.
 
     Note:  A "Server" is not itself a "Container", so you may not
     define subcomponents such as "Valves" or "Loggers" at this level.
 --><Server port="8005" shutdown="SHUTDOWN" debug="0">
 

  <!-- Comment these entries out to disable JMX MBeans support -->
  <!-- You may also configure custom components (e.g. Valves/Realms) by 
       including your own mbean-descriptor file(s), and setting the 
       "descriptors" attribute to point to a ';' seperated list of paths
       (in the ClassLoader sense) of files to add to the default list.
       e.g. descriptors="/com/myfirm/mypackage/mbean-descriptor.xml"
  -->
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" debug="0"/>
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" debug="0"/>
 
  <!-- Global JNDI resources -->
  <GlobalNamingResources>
 
    <!-- Test entry for demonstration purposes -->
    <Environment name="simpleValue" type="java.lang.Integer" value="30"/>
 
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users -->
    <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database that can be updated and saved">
    </Resource>
    <ResourceParams name="UserDatabase">
      <parameter>
        <name>factory</name>
        <value>org.apache.catalina.users.MemoryUserDatabaseFactory</value>
      </parameter>
      <parameter>
        <name>pathname</name>
        <value>conf/tomcat-users.xml</value>
      </parameter>
    </ResourceParams>
 
  </GlobalNamingResources>
 
  <!-- A "Service" is a collection of one or more "Connectors" that share
       a single "Container" (and therefore the web applications visible
       within that Container).  Normally, that Container is an "Engine",
       but this is not required.
 
       Note:  A "Service" is not itself a "Container", so you may not
       define subcomponents such as "Valves" or "Loggers" at this level.
   -->
 
  <!-- Define the Tomcat Stand-Alone Service -->
  <Service name="Catalina">
 
    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned.  Each Connector passes requests on to the
         associated "Container" (normally an Engine) for processing.
 
         By default, a non-SSL HTTP/1.1 Connector is established on port 8080.
         You can also enable an SSL HTTP/1.1 Connector on port 8443 by
         following the instructions below and uncommenting the second Connector
         entry.  SSL support requires the following steps (see the SSL Config
         HOWTO in the Tomcat 5 documentation bundle for more detailed
         instructions):
         * If your JDK version 1.3 or prior, download and install JSSE 1.0.2 or
           later, and put the JAR files into "$JAVA_HOME/jre/lib/ext".
         * Execute:
             %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)
             $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)
           with a password value of "changeit" for both the certificate and
           the keystore itself.
 
         By default, DNS lookups are enabled when a web application calls
         request.getRemoteHost().  This can have an adverse impact on
         performance, so you can disable it by setting the
         "enableLookups" attribute to "false".  When DNS lookups are disabled,
         request.getRemoteHost() will return the String version of the
         IP address of the remote client.
    -->
 
    <!-- Define a non-SSL Coyote HTTP/1.1 Connector on port 8080 -->
    <Connector port="8080" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" redirectPort="8443" acceptCount="100" debug="0" connectionTimeout="20000" disableUploadTimeout="true"/>
               
    <Connector port="7000" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" redirectPort="8443" acceptCount="100" debug="0" connectionTimeout="20000" disableUploadTimeout="true"/>               
    <!-- Note : To disable connection timeouts, set connectionTimeout value
     to 0 -->

<!-- Note : To use gzip compression you could set the following properties :

   compression="on" 
   compressionMinSize="2048" 
   noCompressionUserAgents="gozilla, traviata" 
   compressableMimeType="text/html,text/xml"
-->
 
    <!-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
    
    <Connector port="8443" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" debug="0" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS"/>
   
 
    <!-- Define a Coyote/JK2 AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" enableLookups="false" redirectPort="8443" debug="0" protocol="AJP/1.3"/>
 
    <!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
    <!-- See proxy documentation for more information about using this. -->
    <!--
    <Connector port="8082" 
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false"
               acceptCount="100" debug="0" connectionTimeout="20000"
               proxyPort="80" disableUploadTimeout="true" />
    -->
 
    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host). -->
 
    <!-- You should set jvmRoute to support load-balancing via JK/JK2 ie :
    <Engine name="Standalone" defaultHost="localhost" debug="0" jvmRoute="jvm1">         
    --> 
         
    <!-- Define the top level container in our container hierarchy -->
    <Engine name="Catalina" defaultHost="localhost" debug="0">
 
      <!-- The request dumper valve dumps useful debugging information about
           the request headers and cookies that were received, and the response
           headers and cookies that were sent, for all requests received by
           this instance of Tomcat.  If you care only about requests to a
           particular virtual host, or a particular application, nest this
           element inside the corresponding <Host> or <Context> entry instead.
 
           For a similar mechanism that is portable to all Servlet 2.4
           containers, check out the "RequestDumperFilter" Filter in the
           example application (the source for this filter may be found in
           "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").
 
           Request dumping is disabled by default.  Uncomment the following
           element to enable it. -->
      <!--
      <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
      -->
 
      <!-- Global logger unless overridden at lower levels -->
      <Logger className="org.apache.catalina.logger.FileLogger" prefix="catalina_log." suffix=".txt" timestamp="true"/>
 
      <!-- Because this Realm is here, an instance will be shared globally -->
 
      <!-- This Realm uses the UserDatabase configured in the global JNDI
           resources under the key "UserDatabase".  Any edits
           that are performed against this UserDatabase are immediately
           available for use by the Realm.  -->
      <Realm className="org.apache.catalina.realm.UserDatabaseRealm" debug="0" resourceName="UserDatabase"/>
 
      <!-- Comment out the old realm but leave here for now in case we
           need to go back quickly -->
      <!--
      <Realm className="org.apache.catalina.realm.MemoryRealm" />
      -->
 
      <!-- Replace the above Realm with one of the following to get a Realm
           stored in a database and accessed via JDBC -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="org.gjt.mm.mysql.Driver"
          connectionURL="jdbc:mysql://localhost/authority"
         connectionName="test" connectionPassword="test"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="oracle.jdbc.driver.OracleDriver"
          connectionURL="jdbc :-o	 racle:thin:@ntserver:1521 :-o	 RCL"
         connectionName="scott" connectionPassword="tiger"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!--
      <Realm  className="org.apache.catalina.realm.JDBCRealm" debug="99"
             driverName="sun.jdbc.odbc.JdbcOdbcDriver"
          connectionURL="jdbc :-o	 dbc:CATALINA"
              userTable="users" userNameCol="user_name" userCredCol="user_pass"
          userRoleTable="user_roles" roleNameCol="role_name" />
      -->
 
      <!-- Define the default virtual host
           Note: XML Schema validation will not work with Xerces 2.2.
       -->
      <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="true" xmlValidation="false" xmlNamespaceAware="false">
 
        <!-- Defines a cluster for this node,
             By defining this element, means that every manager will be changed.
             So when running a cluster, only make sure that you have webapps in there
             that need to be clustered and remove the other ones.
             A cluster has the following parameters:
 
             className = the fully qualified name of the cluster class
 
             name = a descriptive name for your cluster, can be anything
 
             debug = the debug level, higher means more output
 
             mcastAddr = the multicast address, has to be the same for all the nodes
 
             mcastPort = the multicast port, has to be the same for all the nodes
             
             mcastBindAddr = bind the multicast socket to a specific address
             
             mcastTTL = the multicast TTL if you want to limit your broadcast
             
             mcastSoTimeout = the multicast readtimeout 
 
             mcastFrequency = the number of milliseconds in between sending a "I'm alive" heartbeat
 
             mcastDropTime = the number a milliseconds before a node is considered "dead" if no heartbeat is received
 
             tcpThreadCount = the number of threads to handle incoming replication requests, optimal would be the same amount of threads as nodes 
 
             tcpListenAddress = the listen address (bind address) for TCP cluster request on this host, 
                                in case of multiple ethernet cards.
                                auto means that address becomes
                                InetAddress.getLocalHost().getHostAddress()
 
             tcpListenPort = the tcp listen port
 
             tcpSelectorTimeout = the timeout (ms) for the Selector.select() method in case the OS
                                  has a wakup bug in java.nio. Set to 0 for no timeout
 
             printToScreen = true means that managers will also print to std.out
 
             expireSessionsOnShutdown = true means that 
 
             useDirtyFlag = true means that we only replicate a session after setAttribute,removeAttribute has been called.
                            false means to replicate the session after each request.
                            false means that replication would work for the following piece of code:
                            <%
                            HashMap map = (HashMap)session.getAttribute("map");
                            map.put("key","value");
                            %>
             replicationMode = can be either 'pooled', 'synchronous' or 'asynchronous'.
                               * Pooled means that the replication happens using several sockets in a synchronous way. Ie, the data gets replicated, then the request return. This is the same as the 'synchronous' setting except it uses a pool of sockets, hence it is multithreaded. This is the fastest and safest configuration. To use this, also increase the nr of tcp threads that you have dealing with replication.
                               * Synchronous means that the thread that executes the request, is also the
                               thread the replicates the data to the other nodes, and will not return until all
                               nodes have received the information.
                               * Asynchronous means that there is a specific 'sender' thread for each cluster node,
                               so the request thread will queue the replication request into a "smart" queue,
                               and then return to the client.
                               The "smart" queue is a queue where when a session is added to the queue, and the same session
                               already exists in the queue from a previous request, that session will be replaced
                               in the queue instead of replicating two requests. This almost never happens, unless there is a 
                               large network delay.
        -->             
        <!--
            When configuring for clustering, you also add in a valve to catch all the requests
            coming in, at the end of the request, the session may or may not be replicated.
            A session is replicated if and only if all the conditions are met:
            1. useDirtyFlag is true or setAttribute or removeAttribute has been called AND
            2. a session exists (has been created)
            3. the request is not trapped by the "filter" attribute
 
            The filter attribute is to filter out requests that could not modify the session,
            hence we don't replicate the session after the end of this request.
            The filter is negative, ie, anything you put in the filter, you mean to filter out,
            ie, no replication will be done on requests that match one of the filters.
            The filter attribute is delimited by ;, so you can't escape out ; even if you wanted to.
 
            filter=".*\.gif;.*\.js;" means that we will not replicate the session after requests with the URI
            ending with .gif and .js are intercepted.
            
            The deployer element can be used to deploy apps cluster wide.
            Currently the deployment only deploys/undeploys to working members in the cluster
            so no WARs are copied upons startup of a broken node.
            The deployer watches a directory (watchDir) for WAR files when watchEnabled="true"
            When a new war file is added the war gets deployed to the local instance,
            and then deployed to the other instances in the cluster.
            When a war file is deleted from the watchDir the war is undeployed locally 
            and cluster wide
        -->
        
        <!--
        <Cluster className="org.apache.catalina.cluster.tcp.SimpleTcpCluster"
                 managerClassName="org.apache.catalina.cluster.session.DeltaManager"
                 expireSessionsOnShutdown="false"
                 useDirtyFlag="true">
 
            <Membership 
                className="org.apache.catalina.cluster.mcast.McastService"
                mcastAddr="228.0.0.4"
                mcastPort="45564"
                mcastFrequency="500"
                mcastDropTime="3000"/>
 
            <Receiver 
                className="org.apache.catalina.cluster.tcp.ReplicationListener"
                tcpListenAddress="auto"
                tcpListenPort="4001"
                tcpSelectorTimeout="100"
                tcpThreadCount="6"/>
 
            <Sender
                className="org.apache.catalina.cluster.tcp.ReplicationTransmitter"
                replicationMode="pooled"/>
 
            <Valve className="org.apache.catalina.cluster.tcp.ReplicationValve"
                   filter=".*\.gif;.*\.js;.*\.jpg;.*\.htm;.*\.html;.*\.txt;"/>
                   
            <Deployer className="org.apache.catalina.cluster.deploy.FarmWarDeployer"
                      tempDir="/tmp/war-temp/"
                      deployDir="/tmp/war-deploy/"
                      watchDir="/tmp/war-listen/"
                      watchEnabled="false"/>
        </Cluster>
        -->        
 

 
        <!-- Normally, users must authenticate themselves to each web app
             individually.  Uncomment the following entry if you would like
             a user to be authenticated the first time they encounter a
             resource protected by a security constraint, and then have that
             user identity maintained across *all* web applications contained
             in this virtual host. -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn"
                   debug="0"/>
        -->
 
        <!-- Access log processes all requests for this virtual host.  By
             default, log files are created in the "logs" directory relative to
             $CATALINA_HOME.  If you wish, you can specify a different
             directory with the "directory" attribute.  Specify either a relative
             (to $CATALINA_HOME) or absolute path to the desired directory.
        -->
        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve"
                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
                 pattern="common" resolveHosts="false"/>
        -->
 
        <!-- Logger shared by all Contexts related to this virtual host.  By
             default (when using FileLogger), log files are created in the "logs"
             directory relative to $CATALINA_HOME.  If you wish, you can specify
             a different directory with the "directory" attribute.  Specify either a
             relative (to $CATALINA_HOME) or absolute path to the desired
             directory.-->
        <Logger className="org.apache.catalina.logger.FileLogger" directory="logs" prefix="localhost_log." suffix=".txt" timestamp="true"/>
 
      <Context docBase="D:\Bin\eclipse\workspace\Web-FHL\.deployables\Web-FHL" path="/Web-FHL" reloadable="true" source="com.ibm.wtp.web.server:Web-FHL"/></Host>
 
    </Engine>
 
  </Service>
 
</Server>
 
  

[Ulf Dittmer]

You don't have a <security-role> element; maybe TC 4.1 needs that.

[O. Ziggy]

Hi,

I added the security-role and it seems to have solved the problem. Thanks for that..

Ta..