How do I provide basic http authentication for static tomcat webapps without changing tomcat-users.xml?
I found a solution here: http://wiki.metawerx.net/wiki/SecuringYourSiteWithContainerManagedSecurity
The page describes how to define your own META-INF/context.xml
pointing to your own WEB-INF/users.xml
. Unfortunately, the link to the users.xml file has to be absolute, and I do not want to make any assumptions on the OS/filesystem paths in my config files.
Here is my current WEB-INF/web.xml
:
<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app
xmlns="http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_5.xsd"
version="2.5">
<display-name>SuperCoolTool</display-name>
<description>What an awesome app!</description>
<security-role>
<role-name>manager</role-name>
</security-role>
<security-role>
<role-name>keyuser</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>
Entire Application
</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>keyuser</role-name>
<role-name>manager</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Evaluation Area</realm-name>
</login-config>
</web-app>
An matching META-INF/context.xml
would look like this:
<?xml version="1.0" encoding="UTF-8"?>
<Context>
<Realm className="org.apache.catalina.realm.MemoryRealm"
pathname="[PATH-TO-YOUR-WEBAPP]/WEB-INF/users.xml"/>
</Context>