How do I provide basic http authentication for static tomcat webapps without changing tomcat-users.xml?

Question

I have access to the tomcat manager and can upload war-files. One of these wars is a static web project (zipped html + media files, renamed to *.war). I want add a Web-INF/w

Answer 1

If you know the directory where tomcat puts all deployed apps you can use relative paths (because they are resolved in relation to catalina.base env.variable, i.e. tomcat home).

For example, if you are deploying using eclipse IDE, usually apps are deployed in wtpwebapps, so you can use:

<Realm className="org.apache.catalina.realm.MemoryRealm"
pathname="wtpwebapps/YOUR_APP_NAME/WEB-INF/users.xml"/>

Not perfect yet, but at least you are not using full paths.

An alternative, would be to implement your own Realm that extends MemoryRealm and pre-processes the pathname before calling super.setPathname();

You can also go for a DataSourceRealm, which does not have this problem and its suitable for production.

For servlet container independent approach you can use a security framework based on filters (e.g. Spring security, ...)

Answer 2

I found a solution here: http://wiki.metawerx.net/wiki/SecuringYourSiteWithContainerManagedSecurity

The page describes how to define your own META-INF/context.xml pointing to your own WEB-INF/users.xml. Unfortunately, the link to the users.xml file has to be absolute, and I do not want to make any assumptions on the OS/filesystem paths in my config files.

Here is my current WEB-INF/web.xml:

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app
    xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_5.xsd"
    version="2.5">

    <display-name>SuperCoolTool</display-name>
    <description>What an awesome app!</description>

    <security-role>
        <role-name>manager</role-name>
    </security-role>
    <security-role>
        <role-name>keyuser</role-name>
    </security-role>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>
                Entire Application
            </web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>keyuser</role-name>
            <role-name>manager</role-name>
        </auth-constraint>
    </security-constraint>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Evaluation Area</realm-name>
    </login-config>

</web-app> 

An matching META-INF/context.xml would look like this:

<?xml version="1.0" encoding="UTF-8"?>
<Context>
    <Realm className="org.apache.catalina.realm.MemoryRealm"
           pathname="[PATH-TO-YOUR-WEBAPP]/WEB-INF/users.xml"/>
</Context>