Unable to login to manager GUI

[Michael Staszewski]

Hi there,

Tomcat 7.0.14 installed via NetBeans 7 installation.

I'm receiving HTTP 401 errors attempting to login to the manager GUI "http://localhost:8084/manager/html." At the prompt I enter tomcat/password as my login credentials. My tomcat-users.xml file is...

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>  
  <role rolename="manager-gui"/> 
  <role rolename="manager-script"/>  
  <role rolename="manager-jmx"/>  
  <role rolename="manager-status"/>  
  <user username="tomcat" password="password" roles="manager-gui,manager-script,manager-jmx,manager-status"/>  
</tomcat-users>  

I've scoured the Internet looking for solutions and the setup above appears to be correct. I've seen another post on this forum that suggests the <role> elements specified above are not needed as they are predefined roles so I've tried again with the following tomcat-users.xml file.

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>  
  <user username="tomcat" password="password" roles="manager-gui,manager-script,manager-jmx,manager-status"/>  
</tomcat-users>  

And also with only the manager-gui role.

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>  
  <user username="tomcat" password="password" roles="manager-gui"/>  
</tomcat-users>  

And...

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>  
  <role rolename="manager-gui"/> 
  <user username="tomcat" password="password" roles="manager-gui"/>  
</tomcat-users>  

None of the above formats is working for me. I continually get the login prompt after entering tomcat/password and clicking OK. When I click Cancel I see the HTTP 401 error page with suggestions to setup my tomcat-users.xml to be exactly as I've done. I've been restarting the server after each edit of the XML file. Any ideas?

Thanks,
Michael

[Tim Holloway]

Welcome to the JavaRanch, Michael!

I'm not quite sure what you're asking here. It sound like you have a working solution but you're hoping for a shortcut?

Roles are defined in web.xml. The tomcat-users.xml file, however, is used to assign roles to a user. One of the great flexibilities of the role-based access control architecture can be demonstrated as follows:

Mary is the "it" person the for accounting webapp. Her login is authorized for the "data-entry" and "report-printing" roles and for the "app-administrator" roles

Catherine runs reports. Her login is only authorized for "report-printing"

Claude is the data entry clerk. His login is only authorized for "data entry".

Claude is going on vacation. Someone has to take over data entry. Mary dumps the job on Catherine, has the system administrator add the "data-entry" role to Catherine's login definition. So now Catherine's tomcat-users.xml entry now has 'roles="report-printing,data-entry". When Claude returns, the system administrator removes "data-entry" from Catherine's roles.

Incidentally, one of the reasons that tomcat-users.xml isn't recommended for production environments is that the Realm that uses it (MemoryRealm) loads in the entries when Tomcat starts up and does not monitor for changes to that file. To see the roles change, Tomcat has to be restarted. When a more dynamic Realm is used, such as a JDBCRealm or LDAP Realm, the roles a user has are determined at login time, so to get the changes, Tomcat doesn't have to be restarted. All that's required is for the user to log out and then log back in again. It could get really messy trying to program for role changes that happened while logged in, so that level of flexibility isn't available.

Now you see (I hope) why the complete set of credentials for a user - including roles for that user - have to be explicitly defined in tomcat-users.xml.

[Michael Staszewski]

I'm not quite sure what you're asking here.

I'm just trying to login to the Tomcat manager GUI and am unable to. I'm new to web service development in Java and the Tomcat application server and I'm just poking around trying to familiarize myself with it.

It sound like you have a working solution but you're hoping for a shortcut?

No, I don't have anything working at the moment. In my original message, all of those XML snippets are failed attempts at setting up tomcat-users.xml so that I can login to the manager app (http://localhost:8084/manager/html).

Roles are defined in web.xml.

Thanks, I see that the roles are defined in the following location in my installation. C:\Program Files\Apache Software Foundation\Apache Tomcat 7.0.14\webapps\manager\WEB-INF\web.xml. However, the web.xml file in the conf directory does not have defined roles. In which location should the roles be defined? The error message returned by Tomcat when I fail to login is an HTTP 401 and specifically says the following.

You are not authorized to view this page. If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation. That file must contain the credentials to let you use this webapp.

For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above.

<role rolename="manager-gui"/>
<user username="tomcat" password="s3cret" roles="manager-gui"/>

It seems that the manager-gui role must be defined in the tomcat-users.xml file unless the message is incorrect. Note in my original message that I did have my tomcat-users.xml setup as follows and this does not work in my installation.

<?xml version='1.0' encoding='utf-8'?> <tomcat-users> <user username="tomcat" password="password" roles="manager-gui"/> </tomcat-users>

Incidentally, one of the reasons that tomcat-users.xml isn't recommended for production environments is that the Realm that uses it (MemoryRealm) loads in the entries when Tomcat starts up and does not monitor for changes to that file. To see the roles change, Tomcat has to be restarted

I have been restarting the server after each modification to tomcat-users.xml without success.

When a more dynamic Realm is used, such as a JDBCRealm or LDAP Realm, the roles a user has are determined at login time, so to get the changes, Tomcat doesn't have to be restarted.

For my web service application, this is what I will use. In Glassfish I am already setup to use JDBCRealm where it validates users against tables in an Oracle DB. At the moment; however, I'm not at the deployment phase. I simply want to see what the Tomcat manager GUI has within so that I can start playing with it in order to setup the JDBCRealm and what not.

I'm a complete newbie at this stuff so please assume that I know absolutely nothing with respect to Tomcat and using the management console. All that I want to do it get into it and do some hands on experimenting to setup my web service application. This is a sandbox server that I'm getting my feet wet in.

Thanks,
Michael

[Tim Holloway]

OK. Makes sense.

The TOMCAT_HOME/con/web.xml file is something that you shouldn't touch. It's the background definitions for all J2EE apps. The security roles for specific webapps such as the tomcat Manager are defined in the WEB-INF/web.xml of that app.

The tomcat-users.xml file supplied with Tomcat doesn't have any admin stuff set up, and as far as I can remember, that includes the role names, so yes, you'd have to add the ones that people will be using. And in case you were wondering, the role namespace covers all deployed webapps, so the total set of role names in tomcat-users,xml is the union of the sets of the role names of all the deployed apps with roles that you will use.

I suspect that you may need to define and assign the manager-status role as well as the manager-ui role before you can effectively use the manager app. If you can login but you get "forbidden" pages, then your role assignments aren't all set up the way you need them to be - your role set doesn't include the URL of the page you're trying to access. If you can't login at all, then the user ID and password are at fault. They're both case-sensitive, incidentally.

[Michael Staszewski]

Thanks for the reply.

The tomcat-users.xml file supplied with Tomcat doesn't have any admin stuff set up, and as far as I can remember, that includes the role names, so yes, you'd have to add the ones that people will be using.

This is correct, there is nothing in the XML file by default other than comments including a template for specifying roles and users which I've followed.

I suspect that you may need to define and assign the manager-status role as well as the manager-ui role before you can effectively use the manager app.

Perhaps, but I have tried that as well with no success. One of the permutations I attempted was giving my user all available roles (even though Tomcat advises to not do so as it violates some security protocol or something) and that too failed. The XML for that attempt is...

<?xml version='1.0' encoding='utf-8'?> <tomcat-users> <role rolename="manager-gui"/> <role rolename="manager-script"/> <role rolename="manager-jmx"/> <role rolename="manager-status"/> <user username="tomcat" password="password" roles="manager-gui,manager-script,manager-jmx,manager-status"/> </tomcat-users>

If you can login but you get "forbidden" pages, then your role assignments aren't all set up the way you need them to be

I cannot login. I enter my username and password correctly, in the exact case (all lower) as specified in the tomcat-users.xml file and every time I click OK at the login dialog, it does not load. It only shows the login dialog again, and again, and again, ... until I get fed up and click Cancel. At this point I am shown the error page showing HTTP 401 with the text I included in my previous reply.

your role set doesn't include the URL of the page you're trying to access.

I do not understand what you mean here. Can you expand on this? At no point have I specified a URL in the role definitions or in my user/role mapping. Perhaps this is an issue? The web.xml file that does contain role names is located at this location, C:\Program Files\Apache Software Foundation\Apache Tomcat 7.0.14\webapps\manager\WEB-INF\web.xml and the URL I am attempting to access is located at http://localhost:8084/manager/html. This URL is for the Tomcat manager page from what I can tell, but it's a dark and mysterious place that I cannot access.

The entire contents of that web.xml file is...

<?xml version="1.0" encoding="ISO-8859-1"?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0" metadata-complete="true"> <display-name>Tomcat Manager Application</display-name> <description> A scriptable management web application for the Tomcat Web Server; Manager lets you view, load/unload/etc particular web applications. </description> <servlet> <servlet-name>Manager</servlet-name> <servlet-class>org.apache.catalina.manager.ManagerServlet</servlet-class> <init-param> <param-name>debug</param-name> <param-value>2</param-value> </init-param> </servlet> <servlet> <servlet-name>HTMLManager</servlet-name> <servlet-class>org.apache.catalina.manager.HTMLManagerServlet</servlet-class> <init-param> <param-name>debug</param-name> <param-value>2</param-value> </init-param> <!-- Uncomment this to show proxy sessions from the Backup manager in the sessions list for an application <init-param> <param-name>showProxySessions</param-name> <param-value>true</param-value> </init-param> --> <multipart-config> <!-- 50MB max --> <max-file-size>52428800</max-file-size> <max-request-size>52428800</max-request-size> <file-size-threshold>0</file-size-threshold> </multipart-config> </servlet> <servlet> <servlet-name>Status</servlet-name> <servlet-class>org.apache.catalina.manager.StatusManagerServlet</servlet-class> <init-param> <param-name>debug</param-name> <param-value>0</param-value> </init-param> </servlet> <servlet> <servlet-name>JMXProxy</servlet-name> <servlet-class>org.apache.catalina.manager.JMXProxyServlet</servlet-class> </servlet> <!-- Define the Manager Servlet Mapping --> <servlet-mapping> <servlet-name>Manager</servlet-name> <url-pattern>/text/*</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>Status</servlet-name> <url-pattern>/status/*</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>JMXProxy</servlet-name> <url-pattern>/jmxproxy/*</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>HTMLManager</servlet-name> <url-pattern>/html/*</url-pattern> </servlet-mapping> <filter> <filter-name>CSRF</filter-name> <filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class> <init-param> <param-name>entryPoints</param-name> <param-value>/html,/html/,/html/list,/index.jsp</param-value> </init-param> </filter> <filter-mapping> <filter-name>CSRF</filter-name> <servlet-name>HTMLManager</servlet-name> <servlet-name>jsp</servlet-name> </filter-mapping> <!-- Define a Security Constraint on this Application --> <!-- NOTE: None of these roles are present in the default users file --> <security-constraint> <web-resource-collection> <web-resource-name>HTML Manager interface (for humans)</web-resource-name> <url-pattern>/html/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>manager-gui</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Text Manager interface (for scripts)</web-resource-name> <url-pattern>/text/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>manager-script</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>JMX Proxy interface</web-resource-name> <url-pattern>/jmxproxy/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>manager-jmx</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Status interface</web-resource-name> <url-pattern>/status/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>manager-gui</role-name> <role-name>manager-script</role-name> <role-name>manager-jmx</role-name> <role-name>manager-status</role-name> </auth-constraint> </security-constraint> <!-- Define the Login Configuration for this Application --> <login-config> <auth-method>BASIC</auth-method> <realm-name>Tomcat Manager Application</realm-name> </login-config> <!-- Security roles referenced by this web application --> <security-role> <description> The role that is required to access the HTML Manager pages </description> <role-name>manager-gui</role-name> </security-role> <security-role> <description> The role that is required to access the text Manager pages </description> <role-name>manager-script</role-name> </security-role> <security-role> <description> The role that is required to access the HTML JMX Proxy </description> <role-name>manager-jmx</role-name> </security-role> <security-role> <description> The role that is required to access to the Manager Status pages </description> <role-name>manager-status</role-name> </security-role> <error-page> <error-code>401</error-code> <location>/WEB-INF/jsp/401.jsp</location> </error-page> <error-page> <error-code>403</error-code> <location>/WEB-INF/jsp/403.jsp</location> </error-page> <error-page> <error-code>404</error-code> <location>/WEB-INF/jsp/404.jsp</location> </error-page> </web-app>

Thanks,
Michael

[Tim Holloway]

Aha. If you cannot login, you probably don't have the Realm defined in TOMCAT_HOME/conf/server.xml. As shipped, the Realm is commented out, so there's no Realm to process logins.

[Michael Staszewski]

Thanks, getting closer hopefully. I appreciate your time as even though I can't get in, I'm learning more about the Tomcat setup. Here is my server.xml. It appears as though the Realm is available and is defined as a child element of the LockOutRealm. It points to the UserDatabase resource which is also specified and indicates the tomcat-users.xml file as the source.

<?xml version='1.0' encoding='utf-8'?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <!-- Note: A "Server" is not itself a "Container", so you may not define subcomponents such as "Valves" at this level. Documentation at /docs/config/server.html --> <Server port="8005" shutdown="SHUTDOWN"> <!-- Security listener. Documentation at /docs/config/listeners.html <Listener className="org.apache.catalina.security.SecurityListener" /> --> <!--APR library loader. Documentation at /docs/apr.html --> <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --> <Listener className="org.apache.catalina.core.JasperListener" /> <!-- Prevent memory leaks due to use of particular java/javax APIs--> <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /> <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /> <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /> <!-- Global JNDI resources Documentation at /docs/jndi-resources-howto.html --> <GlobalNamingResources> <!-- Editable user database that can also be used by UserDatabaseRealm to authenticate users --> <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" pathname="conf/tomcat-users.xml" /> </GlobalNamingResources> <!-- A "Service" is a collection of one or more "Connectors" that share a single "Container" Note: A "Service" is not itself a "Container", so you may not define subcomponents such as "Valves" at this level. Documentation at /docs/config/service.html --> <Service name="Catalina"> <!--The connectors can use a shared executor, you can define one or more named thread pools--> <!-- <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" maxThreads="150" minSpareThreads="4"/> --> <!-- A "Connector" represents an endpoint by which requests are received and responses are returned. Documentation at : Java HTTP Connector: /docs/config/http.html (blocking & non-blocking) Java AJP Connector: /docs/config/ajp.html APR (HTTP/AJP) Connector: /docs/apr.html Define a non-SSL HTTP/1.1 Connector on port 8080 --> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatThreadPool" port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> --> <!-- Define a SSL HTTP/1.1 Connector on port 8443 This connector uses the JSSE configuration, when using APR, the connector should be using the OpenSSL style configuration described in the APR documentation --> <!-- <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" /> --> <!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> <!-- An Engine represents the entry point (within Catalina) that processes every request. The Engine implementation for Tomcat stand alone analyzes the HTTP headers included with the request, and passes them on to the appropriate Host (virtual host). Documentation at /docs/config/engine.html --> <!-- You should set jvmRoute to support load-balancing via AJP ie : <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"> --> <Engine name="Catalina" defaultHost="localhost"> <!--For clustering, please take a look at documentation at: /docs/cluster-howto.html (simple how to) /docs/config/cluster.html (reference documentation) --> <!-- <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/> --> <!-- Use the LockOutRealm to prevent attempts to guess user passwords via a brute-force attack --> <Realm className="org.apache.catalina.realm.LockOutRealm"> <!-- This Realm uses the UserDatabase configured in the global JNDI resources under the key "UserDatabase". Any edits that are performed against this UserDatabase are immediately available for use by the Realm. --> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/> </Realm> <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true"> <!-- SingleSignOn valve, share authentication between web applications Documentation at: /docs/config/valve.html --> <!-- <Valve className="org.apache.catalina.authenticator.SingleSignOn" /> --> <!-- Access log processes all example. Documentation at: /docs/config/valve.html Note: The pattern used is equivalent to using pattern="common" --> <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log." suffix=".txt" pattern="%h %l %u %t "%r" %s %b" resolveHosts="false"/> </Host> </Engine> </Service> </Server>

Thanks,
Michael

[Tim Holloway]

Hmmm. I wonder when they put THAT in?

Try removing the LockoutRealm outer Realm definition from server.xml. That will eliminate one of the ways that logins could fail. Also, make sure that the tomcat-users.xml file hasn't accidentally been given file access rights that keep it from being readable by Tomcat.

You might also find useful messages in the logs/localhost log file or logs/catalina.out file.

[Michael Staszewski]

Try removing the LockoutRealm outer Realm definition from server.xml.

I tried the following, no luck.

<!-- Use the LockOutRealm to prevent attempts to guess user passwords via a brute-force attack --> <!-- <Realm className="org.apache.catalina.realm.LockOutRealm"> --> <!-- This Realm uses the UserDatabase configured in the global JNDI resources under the key "UserDatabase". Any edits that are performed against this UserDatabase are immediately available for use by the Realm. --> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/> <!-- </Realm> -->

Also, make sure that the tomcat-users.xml file hasn't accidentally been given file access rights that keep it from being readable by Tomcat.

Everything should be OK here. It's read-write and I've closed the file from my text editor to release any lock the editor may have placed on it that prevents it from being opened. I still see the same behavior.

You might also find useful messages in the logs/localhost log file or logs/catalina.out file.

My logs directory is empty.

I've viewed some other tutorials online and this should really be somewhat simple. Seeing that it is not, I'm going to uninstall it and reinstall it. Tomcat was bundled with NetBeans 7 installer and although I should have no reason to doubt the success of the installation, it appears that some links are broken in my Tomcat installation which raises doubt. For example, when I navigate to the Tomcat admin homepage I see the message that the installation was successful. I also see various links to how-to pages and the like. Those links are all broken. I get 404 errors. I'll go down this road a bit and see where it leads.

Thanks,
Michael

[Tim Holloway]

OK. I don't know about NetBeans, but the Eclipse WTP plugin does nasty things to the Tomcat configuration including making a copy of it and using the copy instead of the "real" server.xml. Which is why I use an alternate plugin (sysdeo) to run Tomcat in Eclipse. It's possible that NetBeans is also pulling stunts like that, meaning that your changes are being made to the wrong config file.

Good luck! I gotta earn my keep, so I probably won't be back until tomorrow morning!

[Michael Staszewski]

Thanks for the help. I'll post back here if I get somewhere or send pics of my broken laptop if I toss it out of the window.

[Michael Staszewski]

Ding, ding, ding. Downloading the official Tomcat distribution and setting it up manually by editing server.xml to resolve a port conflict and setting up tomcat-users.xml works likes a champ. Arghh. Thanks for the help.

[Dhaval J. Patel]

Michael Staszewski wrote:Ding, ding, ding. Downloading the official Tomcat distribution and setting it up manually by editing server.xml to resolve a port conflict and setting up tomcat-users.xml works likes a champ.

Hey Michael .. I have the exact same problem and it is driving me nuts .. Can you please elaborate on you solved this ??
I have followed all the steps that Tim suggested .. No luck

[Michael Staszewski]

I just did as I mentioned in my last post. I downloaded the official Tomcat installation from the web and stopped using the one installed by NetBeans. That resolved all of my issues. It's been several weeks and I'm using Glassfish so I don't really have anything else to offer other than the official installation allowed me to login.

[Dhaval J. Patel]

Okay .. I think I should try downloading a fresh copy of tomcat ..
I am using eclipse and I have linked to it the tomcat copy that I already had before installing eclipse. Doesnt work.
I will try reintalling tomcat and will post again.

Thanks for your reply

[Michael Staszewski]

Sorry that I can't be of more help. I'm a Delphi developer and have just been exploring this hell called Java. :-) I don't really know much at all as far as application servers and the like are concerned and what I do know has been from trial and error and this forum, but I've been using NetBeans as I find it more intuitive than Eclipse.

[Dhaval J. Patel]

Hey Michael,
Its fine. Thanks for the wonderful thread though. I got to learn a lot. I tried reinstalling tomcat. Still doesnt work .. I hope Tim can give me some suggestions

Thanks.

[JosephBeatricSelvam Jn]

Hi,

Try this,

In NetBean IDE-7,
1. right click the Apache tomcat->properties.
2. the server window opens up
3. In that, select Connection tab and see the credentials...mention this credentails in tomcat-user.xml for username/password.
4. restart server

-Joseph