Authentication problems with MySQL and Tomcat 6.0

[Dani Thorp]

Hi everyone,
I'm trying to get FORMS authentication with Tomcat 6.0 and MySQL DB, but I can access to a directory that should be protected... There's my configuration files:

tomcat-users.xml

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="manager"/>
  <role rolename="standard"/>
  <user username="player" password="investking" roles="standard"/>
  <user username="tomcat" password="pxcgrup03" roles="manager"/>
</tomcat-users>

server.xml

...
<Engine name="Catalina" defaultHost="localhost">
      <Realm className="org.apache.catalina.realm.JDBCRealm" debug="99"
        driverName="com.mysql.jdbc.Driver"
        connectionURL="jdbc:mysql://localhost/IKDB?user=myuser&password=mypass"
        userTable="user" userNameCol="username" userCredCol="password"
userRoleTable="role" roleNameCol="role"/>
 
      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true"
            xmlValidation="false" xmlNamespaceAware="false">
      </Host>
</Engine>
...

And web.xml

    <security-role>
 
      <role-name>player</role-name>
 
    </security-role>
 
    <security-constraint>
      <web-resource-collection>
          <web-resource-name>Investking Registered</web-resource-name>
          <url-pattern>/secure/*</url-pattern>
      </web-resource-collection>
      <auth-constraint>
          <role-name>player</role-name>
      </auth-constraint>
    </security-constraint>
 
    <login-config>
      <auth-method>FORM</auth-method>
      <realm-name>Investking Registered</realm-name>
      <form-login-config>
        <form-login-page>/index.html</form-login-page>
        <form-error-page>/index.html</form-error-page>
      </form-login-config>
    </login-config>

The 'user' and 'role' tables are created, and the ODBC driver is set correctly. In the /security directory I have some html pages that I would protect, but I don't know what I'm doing wrong.
Any help will be highly appreciate.

[Dani Thorp]

I've noticed that in the /secure directory the html pages are shown without CSS, so I suppose that FORMS security is working, but somehow I'm not redirected to the login page.
Does anyone knows if it's possible to block html pages with that security? I mean, I only would like to know if it's possible to do it, because googling around I've mainly found information with jsp pages.
Many thanks,

Dani

[Dani Thorp]

Pffff... at last I got it. Just in case someone needs my solution: in the 'server.xml' file I had the the 'context' defined inside the 'engine' tag, when would be inside the 'host'.

Jaja, I know nobody has responded me, but writing here also helps me to put my thoughts in order ^^'

[Lenny Peter]

Like this?

 <Engine name="Catalina" defaultHost="localhost">   
       
    
      <Host name="localhost"  appBase="webapps"  
            unpackWARs="true" autoDeploy="true"  
            xmlValidation="false" xmlNamespaceAware="false">   

          <Realm className="org.apache.catalina.realm.JDBCRealm" debug="99"  
        driverName="com.mysql.jdbc.Driver"  
        connectionURL="jdbc:mysql://localhost/IKDB?user=myuser&password=mypass"  
        userTable="user" userNameCol="username" userCredCol="password"  
userRoleTable="role" roleNameCol="role"/>  


      </Host>   
</Engine>