问题描述
我正在使用(JSP + Servlet)开发一个Web应用程序,我使用 Tomcat 7.0.33
作为 web容器
。
I am developing a web application using(JSP + Servlet), and I have used Tomcat 7.0.33
as a web container
.
所以我的要求是tomcat中的每个应用程序都将密码
受保护,就像<$ tomcat中的c $ c> manager应用程序受到保护。
So my requirement is that each application in tomcat will be password
protected like the manager application
in tomcat is protected.
到目前为止,我已完成以下操作:
So far I have done following:
server.xml
<Realm className="org.apache.catalina.realm.MemoryRealm" />
tomcat-users.xml
<tomcat-users>
<role rolename="tomcat"/>
<role rolename="manager-gui"/>
<role rolename="role1" />
<user username="tomcat" password="tomcat" roles="role1,tomcat,manager-gui"/>
<user username="role1" password="tomcat" roles="role1"/>
</tomcat-users>
web.xml
<security-role>
<role-name>role1</role-name>
</security-role>
<security-role>
<role-name>tomcat</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>webappname</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>role1</role-name>
<role-name>tomcat</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>webappname</realm-name>
</login-config>
任何人按应用程序路径打开应用程序时都会正常工作(它要求输入用户名和密码,以及应用程序接受 role1
或 tomcat
进行身份验证。
It works fine when anyone opens the application by application path(it asks for username & password, and application accepts either of the role1
or tomcat
for authentication).
但问题是假设我以具有所有角色的用户 tomcat
登录,并且当显示管理器屏幕时列出了部署在其上的所有应用程序服务器,然后如果我尝试打开 mywebapplication
,那么它再次要求输入用户名和密码。
But the Issue is that suppose if I login as a user tomcat
who has got all roles, and when the manager screen is shown which lists all the application deployed on the server, then if I try to open mywebapplication
then it again asks for username and password.
我的问题是如果我已将所有角色分配给用户 tomcat
,那么为什么如果我以<$登录,它会要求输入密码C $ C> Tomcat的?有没有办法避免这种情况?
My question is that if I have assigned all the roles
to the user tomcat
then why it asks for password if I have login as tomcat
? is there any way to avoid this?
提前致谢。
推荐答案
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>webappname</realm-name>
</login-config>
基本身份验证凭据在安全领域中进行组织。如果您为所有应用程序提供不同的Realm-Names,浏览器将提示每个应用程序。尝试为所有这些使用相同的名称(如果这是你想要的)。
Basic Auth credentials are organized in "Security Realms". If you give all your apps different Realm-Names, the browser will prompt for each. Try using the same name for all of them (if that is what you want).
这篇关于tomcat中受密码保护的应用程序的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!