Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The users are having access to all tomcat manager, and this cannot happen.

I have roles and users defined in tomcat-users.xml that I'm intending to relate to their individual virtual hosts (defined in server.xml). What I want is: login1 can login into http://vhost1/manager/html and cannot login to http://vhost2/manager/html with the same user, they need to login with specific users.

Can anyone help me?

share|improve this question
add comment

1 Answer

First of all, you need two distinct copy of the tomcat-users.xml, for example tomcat-v1.xml for virtual host localhost1 and tomcat-v2.xml for virtual host localhost2.

tomcat-v1.xml snippet:

<user username="tomcat1" password="tomcat1" 
    roles="tomcat,manager,manager-gui"/>

tomcat-v2.xml snippet:

<user username="tomcat2" password="tomcat2" 
    roles="tomcat,manager,manager-gui"/>

After that duplicate the UserDatabase resource with name UserDatabase-V1 for localhost1 and UserDatabase-V2 for localhost2 in the server.xml:

<GlobalNamingResources>

    <Resource name="UserDatabase-V1" auth="Container"
        type="org.apache.catalina.UserDatabase"
        description="User database that can be updated and saved"
        factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
        pathname="conf/tomcat-v1.xml" />

    <Resource name="UserDatabase-V2" auth="Container"
        type="org.apache.catalina.UserDatabase"
        description="User database that can be updated and saved"
        factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
        pathname="conf/tomcat-v2.xml" />

</GlobalNamingResources>

Note the different name and pathname attributes. Finally, the Hosts for localhost1 and localhost2 with the configured UserDatabase-V1 and UserDatabase-V1 resources:

<Engine name="Catalina" defaultHost="localhost1">

    <Host name="localhost1" appBase="webapps-v1"
            unpackWARs="true" autoDeploy="true">
        <Realm className="org.apache.catalina.realm.LockOutRealm" >
            <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                resourceName="UserDatabase-V1"
            />
        </Realm>

        <Valve className="org.apache.catalina.valves.AccessLogValve" 
            directory="logs"
            prefix="localhost_access_log." suffix=".txt"
            pattern="%h %l %u %t &quot;%r&quot; %s %b" />

    </Host>

    <Host name="localhost2" appBase="webapps-v2"
            unpackWARs="true" autoDeploy="true">

        <Realm className="org.apache.catalina.realm.LockOutRealm" >
            <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
            resourceName="UserDatabase-V2"
            />
        </Realm>
        <Valve className="org.apache.catalina.valves.AccessLogValve" 
            directory="logs"
            prefix="localhost_access_log." suffix=".txt"
            pattern="%h %l %u %t &quot;%r&quot; %s %b" />
    </Host>
</Engine>

Note the different appBase and resourceName attributes. You have to have a copy of the manager application (webapps/manager) in both webapp-v1 and webapp-v2 folders (or just hard link it).

share|improve this answer
    
Wonderful explanation palacsint! It worked like a charm! Thank you!! –  twisterbr Dec 6 '11 at 16:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.