The problem
A tomcat manager page can not be accessed by a user granted a manager role.
The things I tryed to do
I added a user with a manager role into tomcat-users.xml:
<role rolename="manager"/>
<user username="emanemos" password="password" roles="manager"/>
I also looked up the $CATALINA_HOME/webapps/manager/WEB-INF/web.xml to be sure that manager role is really used to access the application:
<auth-constraint>
<!-- NOTE: This role is not present in the default users file -->
<role-name>manager</role-name>
</auth-constraint>
<!-- Define the Login Configuration for this Application -->
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Tomcat Manager Application</realm-name>
</login-config>
<!-- Security roles referenced by this web application -->
<security-role>
<description>
The role that is required to log in to the Manager Application
</description>
<role-name>manager</role-name>
</security-role>
However, the manager application still asks for a login-password pair in an endless loop ignoring my input.
Does anybody have any ideas?
Did you restart Tomcat after making the changes to tomcat-users.xml?
Related
I'm trying to get familiar with TomEE, or at least TomCat 7 that is used in an older application I'm currently working.
In the tomcat location there is a web.xml. As far as I understood this is used for all servlets that have no own web.xml, right? Or will this be also used for those servlets that have an own one?
Not sure about the hierachy of this configuration files.
Tried to get a basic authentication working for a module that can be assigned by a url like \localhost:8080\AB
The tomcat-users for \localhost:8080\manager is working fine.
But can't get an login for \localhost:8080\AB
I tried modify the web.xml like:
<security-role>
<role-name>users</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>basic demo resource</web-resource-name>
<url-pattern>\AB\*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>users</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
But still no login is required for accessing this servlet.
Than I found out, that there is another web.xml in this Java project, which I also tried to modify with the code above.
I know I'm doing something wrong, but don't get what it is right now.
The role "users" was created in tomcat-users.xml and a user is also assigned to that group.
You have define only security constraint not roles. You need to define tomcat user and crossponding roles like.
<tomcat-users>
<role rolename="AB"/> <!-- you have to define all roles -->
<user username="myname" password="mypassword" roles="AB"/>
<!-- you have to assign login and roles -->
</tomcat-users>
The web.xml in the tomcat directory contains the default settings. A webapp can override definitions in its own web.xml.
To access to /AB you need:
to use FORWARD slashes: <url-pattern>/AB/*</url-pattern>
to have a user with role users in your user database
to enter the username and password in the login popup dialog.
For Wildfly,any authenticated user can access to any protected resource by below change in web.xml
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
in security-constraint and defining security role as below
<security-role>
<role-name>*</role-name>
</security-role>
But the same is not working for Websphere, throwing authorisation failed exception, for making it work below change is required in Websphere Adminconsole.
WAS AdminConsole -> Applications > Enterprise Applications -> click .EAR
click the Security role to user/group mapping
Select the roles you wish to use for authentication.(in my case it is
*,defined in web.xml)
Map special subject to "All authenticated in Application Realm"
How can I skip the adminconsole change to make it work, or any other better approach.
What works for me is that I define the ff in my web.xml:
<security-role>
role1
</security-role>
<security-role>
role2
</security-role>
<security-constraint>
<display-name>All Authenticated</display-name>
<web-resource-collection>
<web-resource-name>
All Authenticated Pages
</web-resource-name>
<url-pattern>/webpage.xhtml</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>role1</role-name>
<role-name>role2</role-name>
</auth-constraint>
</security-constraint>
Essentially this defines the roles and then a separate definition for the pages and the roles that will be permitted to access it.
And then I also define an ibm-application-bnd.xml in my EAR File as follows:
<?xml version="1.0" encoding="UTF-8"?>
<application-bnd
xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-application-bnd_1_2.xsd"
version="1.2">
<security-role name="role1">
<group name="role1" />
</security-role>
<security-role name="role2">
<group name="role2" />
</security-role>
</application-bnd>
This one I think WebSphere uses to map to its grouping your defined roles.
Hope this helps or puts you forward.
For achieving the above goal i.e authorization for all authenticated users in WebSphere, create one logical Role[No need to create any physical group] say "AllAuthneticated" in web.xml and provide it as authorization constrain.
<auth-constraint>
<role-name>AllAuthneticated</role-name>
</auth-constraint>
<security-role>
<role-name>AllAuthneticated</role-name>
</security-role>
And then define an ibm-application-bnd.xml in EAR File as follows:
<security-role name="AllAuthneticated">
<special-subject type="ALL_AUTHENTICATED_USERS" />
</security-role>
The above role mapping will allow all authenticated user to access protected resource.
I have defined LDAP user registry and made a custom form login page in my Dynamic Web Application which running at Websphere Liberty Profile 8.5.5
How can I bind my form from login page to LDAP user registry, so all user's credentials will be checked against this LDAP registry?
Thank you.
1) One way is to define mapping in server.xml - see Setting up BasicRegistry and role mapping on the Liberty profile, although it says about Basic registry, defining mapping is the same:
<application type="war" id="myWebApp" name="myWebApp"
location="${server.config.dir}/apps/myWebApp.war">
<application-bnd>
<security-role name="user">
<user name="Bob" />
<user name="user1" />
<group name="mygroup" />
</security-role>
</application-bnd>
</application>
2) If you don't want to change server.xml you can define these mappings in the application in the binding file - ibm-application-bnd.xml - like this:
<?xml version="1.0" encoding="UTF-8"?>
<application-bnd
xmlns="http://websphere.ibm.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-application-bnd_1_0.xsd"
version="1.0">
<security-role name="user">
<user name="user1" />
<group name="mygroup" />
</security-role>
</application-bnd>
If you are packaging app in the EAR, put that file in the META-INF folder.
If you are deploying war, create META-INF folder and put it there (this is currently undocumented feature, but is working at least in 8.5.5.6).
Here is the information to configure LDAP registry
https://www-01.ibm.com/support/knowledgecenter/SSD28V_8.5.5/com.ibm.websphere.wlp.core.doc/ae/twlp_sec_ldap.html
In addition to that, you may also need to set the realm-name in your form-login declaration. For example,
<login-config>
<auth-method>FORM</auth-method>
<realm-name>MyRegistryRealmName</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
I am trying the BASIC authentication mechanism. When i try to access the constrained resource second time the popup for username and password does not come up.
Following are the roles and users defined in my tomcat-users.xml
<role rolename="Admin"/>
<role rolename="Member"/>
<role rolename="Guest"/>
<user username="Annie" password="admin" roles="Admin, Member, Guest"/>
<user username="Diane" password="coder" roles="Member, Guest"/>
<user username="Ted" password="newbie" roles="Guest"/>
Following are the entries defined in my web.xml
<web-app>
<display-name>SecurityApp</display-name>
<servlet>
<servlet-name>BeerAppServlet</servlet-name>
<servlet-class>com.example.servlets.BeerAppServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>BeerAppServlet</servlet-name>
<url-pattern>/Beer/AddRecipe</url-pattern>
</servlet-mapping>
<security-role> <role-name>Admin</role-name> </security-role>
<security-role> <role-name>Member</role-name> </security-role>
<security-role> <role-name>Guest</role-name> </security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>Update</web-resource-name>
<url-pattern>/Beer/AddRecipe/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Admin</role-name>
<role-name>Member</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
</web-app>
My webapp name is SecurityApp.
For the first time when i access my app as follows
http://localhost:8083/SecurityApp/Beer/AppRecipe i get the popup for entering the user name and password and i enter the following credentials username=Diane password=coder. After entering the above credentials the authentication is success.
For the second time when i type this url http://localhost:8083/SecurityApp/Beer/AppRecipe.
I dont get the authentication popup for username and password. Why is it so. can anyone please explain
By using basic access authentication the credentials are stored at client side (your browser).
The web browser takes care of creating a BASE64-Encode of username and password and send it automatically each time you request to the same page. This means that you are "logged in" immediately without re-entering your credentials.
You can just close and open your browser, to show the username/password dialog again.
Because the browser caches your credentials (username, password) for the page and authentication realm and automatically sends them the next time you visit the page. This is how BASIC authentication works. If you close (all instances of) the browser, it will ask for credentials again, unless it is configured to store them permanently. You can check this related question.
does anyone knows if tomcat is able to password protect file (like apache .htaccess )?
i mean when user request a file from tomcat webapp its prompt a dialogue to enter user-name and password and made this using configuration.
or protect the file depend on its IP address .
hope someone can help me ?
regads
you can set basic authentication in tomcat.
Add your user to tomcat-users.xml. Something like :
<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<role rolename="tomcat"/>
<user username="tomcat" password="tomcat" roles="tomcat"/>
<user username="myname" password="mypassword" roles="tomcat"/>
<user username="test" password="test"/>
</tomcat-users>
And Add configuration to your apps web.xml. like:
<!-- Define a Security Constraint on this Application -->
<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/references/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>your-role</role-name>
</auth-constraint>
</security-constraint>
<!-- Define the Login Configuration for this Application -->
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Application</realm-name>
</login-config>
<!-- Security roles referenced by this web application -->
<security-role>
<description>
The role that is required to log in to the Manager Application
</description>
<role-name>your-role</role-name>
</security-role>
links to understand more:
http://www.avajava.com/tutorials/lessons/how-do-i-use-basic-authentication-with-tomcat.html