Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a quick way to protect a Tomcat instance and all webapps running on it, so that accessing any page requires credentials (simple username/passwd).

I guess Realm is the "proper" way to do it, but that doesn't seem very simple to set up. We would prefer a way where you don't have to change the webapps themselves at all. Anyone know if there's a "quick and dirty" way to achive that?

share|improve this question
Thanks to all answerers, and sorry for the lack of any follow up. My need to do this passed, but hopefully this will be useful for future passers-by. – Jonik Dec 16 '11 at 19:53

A couple of ideas

(1) If you can modify the web.xml of your webapps, just put in a few lines into the web.xml to require basic authentication. The trick is to make sure that the user has been designated a role in the tomcat-users.xml that matches the role defined in the auth-constraint section of the web.xml:




  <user name="theuser" password="pas" roles="protected" />

(2) If your Tomcat server has an APache httpd server in front of it, it's pretty easy to do this in Apache. In your configuration file, you'll just need to set up something like this:

<Location /webappname>
        AuthType Basic
        AuthName "Protected site"
        AuthUserFile /etc/apache2/passwords
        Require user theuser
share|improve this answer

I'd put Apache in front of Tomcat and have that handle the Authentication

Here are some instructions on how to do that using mod_jk

Once you have that set up you can use basic Apache Auth or the auth module of your choosing.

share|improve this answer

Quick and dirty (not recommended for Production) would be a MemoryRealm

MemoryRealm loads information about all users, and their corresponding roles, from $CATALINA_BASE/conf/tomcat-users.xml

Define the Realm within the server.xml inside <Engine> or <Host> and it will apply to all web apps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.