Tomcat Manager

Nov 23, 2010 at 5:26 PM
Edited Nov 25, 2010 at 7:01 PM

Hi, I configure my Tomcat 6.0.29 with Waffle and it works fine with waffle-negotiate sample and with Solr.
But with own Tomcat Manager it does not work. Browser always show dialog asking username and password.

See below the log:

23/11/2010 14:05:22 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1623 ms
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: GET /manager/html, contentlength: -1
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: authorization: <none>, ntlm post: false
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: authorization required
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: GET /manager/html, contentlength: -1
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: authorization: Basic XyXyXyXyXyXyXyXyXyXyXy==, ntlm post: false
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: security package: Basic, connection id: 127.0.0.1:3211
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
BOM: token buffer: 19 byte(s)
23/11/2010 14:05:32 waffle.apache.NegotiateAuthenticator authenticate
AVISO: error logging in user: The requested security package does not exist

Thanks for a help.

Coordinator
Nov 23, 2010 at 6:03 PM

This log shows that the browser chose to do BASIC authentication, not SSO. A client-side HTTP trace could be useful.

Nov 23, 2010 at 6:20 PM

Sorry. See Fiddler sessions log below:

GET http://m4968:8080/ HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-shockwave-flash, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: m4968:8080


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"7777-1279558786000"
Last-Modified: Mon, 19 Jul 2010 16:59:46 GMT
Content-Type: text/html
Content-Length: 7777
Date: Tue, 23 Nov 2010 19:14:41 GMT

 

------------------------------------------------------------------

GET http://m4968:8080/tomcat.gif HTTP/1.1
Accept: */*
Referer: http://m4968:8080/
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m4968:8080
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"1934-1279558786000"
Last-Modified: Mon, 19 Jul 2010 16:59:46 GMT
Content-Type: image/gif
Content-Length: 1934
Date: Tue, 23 Nov 2010 19:14:41 GMT

 

------------------------------------------------------------------

GET http://m4968:8080/asf-logo-wide.gif HTTP/1.1
Accept: */*
Referer: http://m4968:8080/
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m4968:8080
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"5866-1279558786000"
Last-Modified: Mon, 19 Jul 2010 16:59:46 GMT
Content-Type: image/gif
Content-Length: 5866
Date: Tue, 23 Nov 2010 19:14:41 GMT

 

------------------------------------------------------------------

GET http://m4968:8080/tomcat-power.gif HTTP/1.1
Accept: */*
Referer: http://m4968:8080/
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m4968:8080
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"2324-1279558786000"
Last-Modified: Mon, 19 Jul 2010 16:59:46 GMT
Content-Type: image/gif
Content-Length: 2324
Date: Tue, 23 Nov 2010 19:14:41 GMT

 

------------------------------------------------------------------

GET http://m4968:8080/favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Host: m4968:8080
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"21630-1279558786000"
Last-Modified: Mon, 19 Jul 2010 16:59:46 GMT
Content-Length: 21630
Date: Tue, 23 Nov 2010 19:14:41 GMT

 

------------------------------------------------------------------

GET http://m4968:8080/manager/html HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-shockwave-flash, */*
Referer: http://m4968:8080/
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Host: m4968:8080
Connection: Keep-Alive


HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 19:00:00 AMT
WWW-Authenticate: Basic realm="Tomcat Manager Application"
Set-Cookie: JSESSIONID=3B1AF5E4F7308AE70423AB92B9530283; Path=/manager
Connection: close
Content-Type: text/html
Transfer-Encoding: chunked
Date: Tue, 23 Nov 2010 19:14:44 GMT

 

------------------------------------------------------------------

 

Coordinator
Nov 23, 2010 at 6:33 PM

As you can see by the last response, WWW-Authenticate: Basic realm="Tomcat Manager Application" means that this application is not configured with WAFFLE. Otherwise you'd get something else (Negotiate, NTLM, ...).

Nov 23, 2010 at 6:44 PM

But the same configuration that I made in the orthers applications I did in the manager.
See my "webapps\manager\WEB-INF\web.xml"

<?xml version="1.0" encoding="ISO-8859-1"?>
<!--
 Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->

<web-app xmlns="http://java.sun.com/xml/ns/javaee"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
   version="2.5">

  <display-name>Tomcat Manager Application</display-name>
  <description>
    A scriptable management web application for the Tomcat Web Server;
    Manager lets you view, load/unload/etc particular web applications.
  </description>

  <!-- Define the Manager Servlet
       Change servlet-class to: org.apache.catalina.servlets.HTMLManagerServlet
       to get a Servlet with a more intuitive HTML interface, don't change if you
       have software that is expected to parse the output from ManagerServlet
       since they're not compatible.
   -->
  <servlet>
    <servlet-name>Manager</servlet-name>
    <servlet-class>org.apache.catalina.manager.ManagerServlet</servlet-class>
    <init-param>
      <param-name>debug</param-name>
      <param-value>2</param-value>
    </init-param>
  </servlet>
  <servlet>
    <servlet-name>HTMLManager</servlet-name>
    <servlet-class>org.apache.catalina.manager.HTMLManagerServlet</servlet-class>
    <init-param>
      <param-name>debug</param-name>
      <param-value>2</param-value>
    </init-param>
  </servlet>
  <servlet>
    <servlet-name>Status</servlet-name>
    <servlet-class>org.apache.catalina.manager.StatusManagerServlet</servlet-class>
    <init-param>
      <param-name>debug</param-name>
      <param-value>0</param-value>
    </init-param>
  </servlet>

  <servlet>
    <servlet-name>JMXProxy</servlet-name>
    <servlet-class>org.apache.catalina.manager.JMXProxyServlet</servlet-class>
  </servlet>

  <!-- Define the Manager Servlet Mapping -->
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/list</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/expire</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/sessions</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/start</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/stop</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/install</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/remove</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/deploy</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/undeploy</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/reload</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/save</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/serverinfo</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/roles</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/resources</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Manager</servlet-name>
      <url-pattern>/findleaks</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>Status</servlet-name>
    <url-pattern>/status/*</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>JMXProxy</servlet-name>
      <url-pattern>/jmxproxy/*</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>HTMLManager</servlet-name>
    <url-pattern>/html/*</url-pattern>
  </servlet-mapping>

  <!-- Define reference to the user database for looking up roles -->
<!--
  <resource-env-ref>
    <description>
      Link to the UserDatabase instance from which we request lists of
      defined role names.  Typically, this will be connected to the global
      user database with a ResourceLink element in server.xml or the context
      configuration file for the Manager web application.
    </description>
    <resource-env-ref-name>users</resource-env-ref-name>
    <resource-env-ref-type>
      org.apache.catalina.UserDatabase
    </resource-env-ref-type>
  </resource-env-ref>
-->

  <!-- Define a Security Constraint on this Application -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>HTMLManager and Manager command</web-resource-name>
      <url-pattern>/jmxproxy/*</url-pattern>
      <url-pattern>/html/*</url-pattern>
      <url-pattern>/list</url-pattern>
      <url-pattern>/expire</url-pattern>
      <url-pattern>/sessions</url-pattern>
      <url-pattern>/start</url-pattern>
      <url-pattern>/stop</url-pattern>
      <url-pattern>/install</url-pattern>
      <url-pattern>/remove</url-pattern>
      <url-pattern>/deploy</url-pattern>
      <url-pattern>/undeploy</url-pattern>
      <url-pattern>/reload</url-pattern>
      <url-pattern>/save</url-pattern>
      <url-pattern>/serverinfo</url-pattern>
      <url-pattern>/status/*</url-pattern>
      <url-pattern>/roles</url-pattern>
      <url-pattern>/resources</url-pattern>
      <url-pattern>/findleaks</url-pattern>
    </web-resource-collection>
    <auth-constraint>
       <!-- NOTE:  This role is not present in the default users file -->
       <!-- <role-name>manager</role-name> -->
       <role-name>AD\GROUP_NAME</role-name>
    </auth-constraint>
  </security-constraint>

 

  <!-- Security roles referenced by this web application -->
  <security-role>
    <description>
      Common Methods Users
    </description>
    <role-name>AD\GROUP_NAME</role-name>
  </security-role>


  <error-page>
    <error-code>401</error-code>
    <location>/401.jsp</location>
  </error-page>

</web-app>

Coordinator
Nov 23, 2010 at 8:59 PM

Tomcat has a tendency to save/cache configurations. Did you get rid of the work or the local copy conf folder? Where/how do you declare the authenticator (I assume it's in the Tomcat's conf/...xml)?

Look around for a configuration that affects the manager web app, if everything else fails, I'll try to take a stock Tomcat 6 and set it up myself when I get a chance.

Nov 24, 2010 at 9:47 AM

I am a newbie with Tomcat, but I configured the manager app with the web.xml file posted in the previews message and context.xml, "...\webapps\manager\META-INF\context.xml" as below.

<?xml version='1.0' encoding='utf-8'?>
<Context antiResourceLocking="false" privileged="true">
  <Valve className="waffle.apache.NegotiateAuthenticator" principalFormat="fqn" roleFormat="both" />
  <Realm className="waffle.apache.WindowsRealm" />
</Context>

"...\conf\server.xml"

<?xml version='1.0' encoding='utf-8'?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!-- Note:  A "Server" is not itself a "Container", so you may not
     define subcomponents such as "Valves" at this level.
     Documentation at /docs/config/server.html
 -->
<Server port="8005" shutdown="SHUTDOWN">

  <!--APR library loader. Documentation at /docs/apr.html -->
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
  <Listener className="org.apache.catalina.core.JasperListener" />
  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html -->
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />

  <!-- Global JNDI resources
       Documentation at /docs/jndi-resources-howto.html
  -->
  <GlobalNamingResources>
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users
    -->
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

  <!-- A "Service" is a collection of one or more "Connectors" that share
       a single "Container" Note:  A "Service" is not itself a "Container",
       so you may not define subcomponents such as "Valves" at this level.
       Documentation at /docs/config/service.html
   -->
  <Service name="Catalina">
 
    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
    <!--
    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
        maxThreads="150" minSpareThreads="4"/>
    -->
   
   
    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
         Java AJP  Connector: /docs/config/ajp.html
         APR (HTTP/AJP) Connector: /docs/apr.html
         Define a non-SSL HTTP/1.1 Connector on port 8080
    -->
    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    <!-- A "Connector" using the shared thread pool-->
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    -->          
    <!-- Define a SSL HTTP/1.1 Connector on port 8443
         This connector uses the JSSE configuration, when using APR, the
         connector should be using the OpenSSL style configuration
         described in the APR documentation -->
    <!--
    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />


    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host).
         Documentation at /docs/config/engine.html -->

    <!-- You should set jvmRoute to support load-balancing via AJP ie :
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">        
    -->
    <Engine name="Catalina" defaultHost="localhost">

      <!--For clustering, please take a look at documentation at:
          /docs/cluster-howto.html  (simple how to)
          /docs/config/cluster.html (reference documentation) -->
      <!--
      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
      -->       

      <!-- The request dumper valve dumps useful debugging information about
           the request and response data received and sent by Tomcat.
           Documentation at: /docs/config/valve.html -->
      <!--
      <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
      -->

      <!-- This Realm uses the UserDatabase configured in the global JNDI
           resources under the key "UserDatabase".  Any edits
           that are performed against this UserDatabase are immediately
           available for use by the Realm.  -->
      <!--
      <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
             resourceName="UserDatabase"/>
       -->

      <!-- Define the default virtual host
           Note: XML Schema validation will not work with Xerces 2.2.
       -->
      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true"
            xmlValidation="false" xmlNamespaceAware="false">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->

        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />


        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" 
               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
        -->

      </Host>
    </Engine>
  </Service>
</Server>

I did not change any other file ...... maybe it is the problem.
If you want do see any other file, just tell me.

Thanks for you help.

Coordinator
Nov 30, 2010 at 3:28 PM

I figured it out. Read http://code.dblock.org/ShowPost.aspx?id=147. Let me know if it works.

Nov 30, 2010 at 4:02 PM

Thanks ....... you are the guy.

The 401.jsp file was killing me. rsrs

Just to undestand ... as I changed the files in "conf" directory, all applications will be authenticated by AD (Negotiate). Only users from group "BUILTIN\Users" will be allowed to access.
But if I want I can change the file "APPLICATION/WEB-INF/web.xml" to allow others users/groups to access this application. Is it right?

Thanks for your help.

Coordinator
Nov 30, 2010 at 4:49 PM

Just to undestand ... as I changed the files in "conf" directory, all applications will be authenticated by AD (Negotiate). Only users from group "BUILTIN\Users" will be allowed to access.
But if I want I can change the file "APPLICATION/WEB-INF/web.xml" to allow others users/groups to access this application. Is it right?

 Yes, that should work. Generally I don't recommend modifying any of Tomcat's global configurations and to modify application's configuration only (putting the valves in the app's context.xml), but that may not be what you're trying to achieve (a single application hosted on tomcat).