|
<RequestInterceptor className="org.apache.tomcat.request.AccessInterceptor"
debug="0" />
From
that class' javadoc:
* Access control - find
if a request matches any web-resource-collection
* and set the "required" attributes. * * The spec requires additive checking ( i.e. there is no "best match" * defined, but "all requests that contain a request path that mathces the * URL pattern in the resource collection are subject to the constraing" ). * * In "integrated" mode this interceptor will be no-op, we'll use the * web server ( assuming we can map the security to web-server equivalent * concepts - I think we can do that, but need to experiment with that) <RequestInterceptor
className="org.apache.tomcat.request.SimpleRealm" debug="0" /> From
that class' javadoc: * Memory based realm - will authenticate and check the
permissions
* for a request using a simple, in-memory list of users. * This is for "demo" purpose only, to allow auth in standalone tomcat * for developers. * * There are no restrictions or rules on how to authenticate - you have * full control over the process. I
don't seem to have a simple xml file, should I?
You
do: it's named $TOMCAT_HOME/conf/tomcat-users.xml
.
-- Bill K.
|
- Security Questions Gerry Duhig
- Security questions William Kaufman
- Security questions Dave Finch
- RE: Security questions William Kaufman
- RE: Security questions Dave Finch
