Hi,
I'm having a problem with authentication to my webapp when accessing it
through Apache. I have my realm setup in server.xml to use JDBC
(accessing a PostgreSQL database), and based the security constraints in
my web.xml from the security example provided with Tomcat.
- Apache is running on one machine (nova), and Tomcat on another
(setsuna)
- My webapp is at /opnexus under Tomcat, and my httpd.conf is set to
redirect this same path to Tomcat (this all works fine)
- Authentication works just fine when I access it directly through
Tomcat
- If I try to go to a protected page through Apache, authentication
always fails, even if the username and password are correct.
- The security example provided with Tomcat works fine when accessed
through either Apache or Tomcat.
I've looked through the list archives and seen this problem posted a
couple times, but never any solution. If anyone has any suggestions
that might help, I'd appreciate it. Thanks in advance.
The context entry in server.xml looks like this:
<Context path="/opnexus" docBase="opnexus" debug="99" reloadable="true">
<!-- <Realm className="org.apache.catalina.realm.MemoryRealm" /> -->
<Realm className="org.apache.catalina.realm.JDBCRealm" debug="99"
connectionName="opnexus" connectionPassword="password"
driverName="org.postgresql.Driver"
connectionURL="jdbc:postgresql://setsuna/opnexus2"
userTable="account" userNameCol="username"
userCredCol="password"
userRoleTable="account_role" roleNameCol="role_name" />
<Logger className="org.apache.catalina.logger.FileLogger"
prefix="localhost_opnexus_log." suffix=".txt"
timestamp="true"/>
</Context>
And my web.xml is as follows (much of it is unchanged from the example):
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd";>
<web-app>
<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<!-- Define the context-relative URL(s) to be protected -->
<url-pattern>/crms/*</url-pattern>
<!-- If you list http methods, only those methods are protected
-->
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<!-- Anyone with one of the listed roles may access this area
-->
<role-name>tomcat</role-name>
<role-name>role1</role-name>
</auth-constraint>
</security-constraint>
<!-- Default login configuration uses form-based authentication -->
<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>/crms/login.jsp</form-login-page>
<form-error-page>/crms/error.jsp</form-error-page>
</form-login-config>
</login-config>
</web-app>
--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
