tomcat6 how can I restrict users to acces ONLY their own manager?

Question

The users are having access to all tomcat manager, and this cannot happen.

I have roles and users defined in tomcat-users.xml that I'm intending to relate to their individual virtual hosts (defined in server.xml). What I want is: login1 can login into http://vhost1/manager/html and cannot login to http://vhost2/manager/html with the same user, they need to login with specific users.

Can anyone help me?

Answer 1

First of all, you need two distinct copy of the tomcat-users.xml, for example tomcat-v1.xml for virtual host localhost1 and tomcat-v2.xml for virtual host localhost2.

tomcat-v1.xml snippet:

<user username="tomcat1" password="tomcat1" 
    roles="tomcat,manager,manager-gui"/>

tomcat-v2.xml snippet:

<user username="tomcat2" password="tomcat2" 
    roles="tomcat,manager,manager-gui"/>

After that duplicate the UserDatabase resource with name UserDatabase-V1 for localhost1 and UserDatabase-V2 for localhost2 in the server.xml:

<GlobalNamingResources>

    <Resource name="UserDatabase-V1" auth="Container"
        type="org.apache.catalina.UserDatabase"
        description="User database that can be updated and saved"
        factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
        pathname="conf/tomcat-v1.xml" />

    <Resource name="UserDatabase-V2" auth="Container"
        type="org.apache.catalina.UserDatabase"
        description="User database that can be updated and saved"
        factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
        pathname="conf/tomcat-v2.xml" />

</GlobalNamingResources>

Note the different name and pathname attributes. Finally, the Hosts for localhost1 and localhost2 with the configured UserDatabase-V1 and UserDatabase-V1 resources:

<Engine name="Catalina" defaultHost="localhost1">

    <Host name="localhost1" appBase="webapps-v1"
            unpackWARs="true" autoDeploy="true">
        <Realm className="org.apache.catalina.realm.LockOutRealm" >
            <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                resourceName="UserDatabase-V1"
            />
        </Realm>

        <Valve className="org.apache.catalina.valves.AccessLogValve" 
            directory="logs"
            prefix="localhost_access_log." suffix=".txt"
            pattern="%h %l %u %t &quot;%r&quot; %s %b" />

    </Host>

    <Host name="localhost2" appBase="webapps-v2"
            unpackWARs="true" autoDeploy="true">

        <Realm className="org.apache.catalina.realm.LockOutRealm" >
            <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
            resourceName="UserDatabase-V2"
            />
        </Realm>
        <Valve className="org.apache.catalina.valves.AccessLogValve" 
            directory="logs"
            prefix="localhost_access_log." suffix=".txt"
            pattern="%h %l %u %t &quot;%r&quot; %s %b" />
    </Host>
</Engine>

Note the different appBase and resourceName attributes. You have to have a copy of the manager application (webapps/manager) in both webapp-v1 and webapp-v2 folders (or just hard link it).