Here are the basic steps required to setup HTTP Basic Authentication in Tomcat using the default realm (UserDatabaseRealm).
Note: I am using apache-tomcat-6.0.18
- Add the login configuration to your web application’s web.xml (anywhere under <web-app> element):
<login-config>
<!--BASIC for HTTP Basic authentication-->
<auth-method>BASIC</auth-method>
<!--Any name here, this is the string that will be displayed when the browser prompts the user for credentials-->
<realm-name>Admin</realm-name>
</login-config>
- Add the security constraint to your web application’s web.xml (anywhere under <web-app> element):
<security-constraint>
<web-resource-collection>
<web-resource-name>My Secure Area</web-resource-name>
<description>Security constraint /secure</description>
<!--Add the URI that you want to protect. The example below protects all resources starting from root -->
<url-pattern>/*</url-pattern>
<!--Add all the HTTP methods for which this security constraint should apply -->
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint><description>only let the admin users login</description>
<!--The authentication occurs via the role name. This has to be mapped to users in tomcat-user.xml-->
<role-name>admin</role-name>
</auth-constraint>
</security-constraint> - Associate the role to a user in tomcat-users.xml (anywhere under <tomcat-users> element):
<!-- You can add multiple role and user elements -->
<role rolename="admin"/>
<user password="password" roles="admin" username="username"/> - Add the default Realm in server.xml (inside the <Engine> element)
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>