You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Charl Gerber <ch...@yahoo.com> on 2009/01/06 07:24:28 UTC
Configuring a Realm
Hi,
Using Tomcat 6.0.14, I need some help. I have left the default server.xml mostly unchanged, except for the configuration of a global datasource. For my application, I have created a Realm in its context.xml which is suppose to be used for authentication, but Tomcat continues to use the default Realm and ignores the extra one I have configured. I know I somehow have to configure the <login-config> to use my new Realm, but how? There is a tag <realm-name> which looked to be my answer, but I couldn't find an example anywhere of how to identify the Realm and the <realm-name> seems more like a comment than a meaningful parameter.
Can someone help please? Maybe post an working example of a configuration using more than one Realm?
Extract from my server.xml:
<GlobalNamingResources>
<Resource name="UserDatabase"
auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
<Resource name="jdbc/rankings"
auth="Container"
type="javax.sql.DataSource"
maxActive="16"
maxIdle="8"
maxWait="10000"
username="myUser"
password="myPass"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost/rankings?autoReconnect=true" />
</GlobalNamingResources>
The datasource works and can be tested from within the application, so it is set up correctly.
The application's context.xml:
<Context path="/rankings"
docBase="path.to.file/rankings.war"
debug="0"
reloadable="false"
antiJARLocking="true"
antiResourceLocking="true"
crossContext="true">
<ResourceLink name="jdbc/rankings"
global="jdbc/rankings"
type="javax.sql.DataSource" />
<Realm className="org.apache.catalina.realm.DataSourceRealm"
debug="99"
dataSourceName="jdbc/rankings"
userTable="users"
userNameCol="email"
userCredCol="password"
userRoleTable="user_roles"
roleNameCol="role_name" />
</Context>
Extract from the application's web.xml:
<resource-ref>
<description>DB Connection</description>
<res-ref-name>jdbc/rankings</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
<security-constraint>
<display-name>Default</display-name>
<web-resource-collection>
<web-resource-name>Default secured domain</web-resource-name>
<url-pattern>*.do</url-pattern>
<url-pattern>*.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Default</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<display-name>Public</display-name>
<web-resource-collection>
<web-resource-name>Public accessible</web-resource-name>
<url-pattern>/public/*</url-pattern>
</web-resource-collection>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Datasource Realm</realm-name>
</login-config>
<security-role>
<role-name>Default</role-name>
</security-role>
Thanks in advance!
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] Configuring a Realm
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Subject: Re: [OT] Configuring a Realm
>
> Why are you apprehensive about using the same database
> (Datasource?) for both authentication /and/ application use?
Because I like to keep distinct things separate. Coming from a large server, certified B1 security environment, we would never permit credentials to be stored in the same container as application data; the privacy and recoverability requirements are quite different.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] Configuring a Realm
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chuck,
Caldarale, Charles R wrote:
> Are you using the same database for both application usage and
> authentication? That's odd, but doable.
Why are you apprehensive about using the same database (Datasource?) for
both authentication /and/ application use?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAklue3gACgkQ9CaO5/Lv0PCsmgCaAnzLK2Z5+JXw+TLPAXBa1Mm2
kKUAn3qamEvEhucSX6wwx0ZwuzF3j0lB
=MtDF
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Configuring a Realm
Posted by Charl Gerber <ch...@yahoo.com>.
Never mind. I uninstalled all my apps, cleaned up the temp/work dirs and re-installed and now it goes well. Must have been an incorrect context.xml in one of those dirs that I've missed.
Charl
--- On Tue, 6/1/09, Caldarale, Charles R <Ch...@unisys.com> wrote:
> From: Caldarale, Charles R <Ch...@unisys.com>
> Subject: RE: Configuring a Realm
> To: "Tomcat Users List" <us...@tomcat.apache.org>
> Date: Tuesday, 6 January, 2009, 4:21 PM
> > From: Charl Gerber [mailto:charlgerber@yahoo.com]
> > Subject: Configuring a Realm
>
> > I know I somehow have to configure the
> <login-config>
> > to use my new Realm, but how?
>
> No, you don't, other than to indicate the
> authentication mechanism. The presence of the <Realm>
> element inside your webapp's <Context> should be
> sufficient to cause Tomcat to use it.
>
> > There is a tag <realm-name> which looked to be
> my answer
>
> The <realm-name> here is not related to the
> configured <Realm>, at least for BASIC authentication;
> as I recall it's used primarily for DIGEST
> authentication to construct the hash key.
>
> > The datasource works and can be tested from within the
> > application, so it is set up correctly.
>
> Are you using the same database for both application usage
> and authentication? That's odd, but doable.
>
> > The application's context.xml:
>
> Where is the context.xml file located?
>
> > <Context path="/rankings"
> > docBase="path.to.file/rankings.war"
>
> If the context.xml file is in the webapp's META-INF
> directory, the path and docBase attributes are not allowed -
> remove them.
>
> Is there a conf/Catalina/[host]/rankings.xml file present?
> If so, it will override the context.xml in META-INF, meaning
> your <Realm> element will be ignored.
>
> Is there anything in the Tomcat logs pertinent to the use
> of the <Realm>?
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR
> OTHERWISE PROPRIETARY MATERIAL and is thus for use only by
> the intended recipient. If you received this in error,
> please contact the sender and delete the e-mail and its
> attachments from all computers.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail:
> users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Configuring a Realm
Posted by Charl Gerber <ch...@yahoo.com>.
> No, you don't, other than to indicate the
> authentication mechanism. The presence of the <Realm>
> element inside your webapp's <Context> should be
> sufficient to cause Tomcat to use it.
That's what I thought, but my Realm is just ignored and the one that is present by default when installing Tomcat is used instead.
> Are you using the same database for both application usage
> and authentication? That's odd, but doable.
Yes, same datasource. Won't go into the details, but perfectly valid reason for doing so.
> If the context.xml file is in the webapp's META-INF
> directory, the path and docBase attributes are not allowed -
> remove them.
Yes, in the META-INF. I removed the path and docBase attributes, but still no joy.
> Is there a conf/Catalina/[host]/rankings.xml file present?
no.
> Is there anything in the Tomcat logs pertinent to the use
> of the <Realm>?
No, that was going to be my next question. I see no authentication logging whatsoever. Not even of the default Realm, which has debug="0".
I'm baffled.
Charl
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR
> OTHERWISE PROPRIETARY MATERIAL and is thus for use only by
> the intended recipient. If you received this in error,
> please contact the sender and delete the e-mail and its
> attachments from all computers.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail:
> users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Configuring a Realm
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Charl Gerber [mailto:charlgerber@yahoo.com]
> Subject: Configuring a Realm
> I know I somehow have to configure the <login-config>
> to use my new Realm, but how?
No, you don't, other than to indicate the authentication mechanism. The presence of the <Realm> element inside your webapp's <Context> should be sufficient to cause Tomcat to use it.
> There is a tag <realm-name> which looked to be my answer
The <realm-name> here is not related to the configured <Realm>, at least for BASIC authentication; as I recall it's used primarily for DIGEST authentication to construct the hash key.
> The datasource works and can be tested from within the
> application, so it is set up correctly.
Are you using the same database for both application usage and authentication? That's odd, but doable.
> The application's context.xml:
Where is the context.xml file located?
> <Context path="/rankings"
> docBase="path.to.file/rankings.war"
If the context.xml file is in the webapp's META-INF directory, the path and docBase attributes are not allowed - remove them.
Is there a conf/Catalina/[host]/rankings.xml file present? If so, it will override the context.xml in META-INF, meaning your <Realm> element will be ignored.
Is there anything in the Tomcat logs pertinent to the use of the <Realm>?
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org