How to disable or remove Tomcat authentication (Realm)

Question

I deployed my Spring application on my server for the first time via the Tomcat manager.

The application starts correctly, there are nothing in error in logs.

But when I try to access my application via the URL (http://www.myWebApp.com/webapp), a Tomcat authentication box always appears, with the message:

"The http://www.myWebApp.com site requires a user name and password. The site says: Realm".

Note there is a first Apache authentication, that I can validate with my username and my password without any problem. The Tomcat authentication box is display after validate the first Apache authentication box.

I have not yet set, and the "web.xml" file of my application is however relatively simple. I use Spring Based Configuration to simplify the dev.

web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" metadata-complete="true" version="3.0">
  <filter>
    <filter-name>CharacterEncodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
      <param-name>forceEncoding</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>CharacterEncodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/static/*</url-pattern>
  </servlet-mapping>
  <servlet>
    <servlet-name>403Jsp</servlet-name>
    <jsp-file>/403.jsp</jsp-file>
  </servlet>
  <servlet-mapping>
    <servlet-name>403Jsp</servlet-name>
    <url-pattern>/403</url-pattern>
  </servlet-mapping>
  <error-page>
    <error-code>403</error-code>
    <location>/403</location>
  </error-page>
</web-app>

catalina.2016-04-17.log:

17-Apr-2016 19:13:21.092 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/common/classes], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.108 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/common], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.113 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/server/classes], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.114 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/server], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.117 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/shared/classes], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.119 WARNING [main] org.apache.catalina.startup.ClassLoaderFactory.validateFile Problem with directory [/usr/share/tomcat8/shared], exists: [false], isDirectory: [false], canRead: [false]
17-Apr-2016 19:13:21.280 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server version: Apache Tomcat/8.0.14 (Debian)
17-Apr-2016 19:13:21.282 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server built:   Dec 18 2015 02:43:21
17-Apr-2016 19:13:21.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number:  8.0.14.0
17-Apr-2016 19:13:21.286 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name:        Linux
17-Apr-2016 19:13:21.290 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version:     3.16.0-4-amd64
17-Apr-2016 19:13:21.291 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture:   amd64
17-Apr-2016 19:13:21.291 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version:    1.8.0_72-internal-b15
17-Apr-2016 19:13:21.292 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor:     Oracle Corporation
17-Apr-2016 19:13:22.093 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]
17-Apr-2016 19:13:22.124 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
17-Apr-2016 19:13:22.132 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"]
17-Apr-2016 19:13:22.140 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
17-Apr-2016 19:13:22.149 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 983 ms
17-Apr-2016 19:13:22.197 INFO [main] org.apache.catalina.core.StandardService.startInternal Démarrage du service Catalina
17-Apr-2016 19:13:22.200 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.0.14 (Debian)
17-Apr-2016 19:13:22.244 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDescriptor Déploiement du descripteur de configuration /etc/tomcat8/Catalina/localhost/manager.xml
17-Apr-2016 19:13:23.360 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
17-Apr-2016 19:13:23.487 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDescriptor Deployment of configuration descriptor /etc/tomcat8/Catalina/localhost/manager.xml has finished in 1 242 ms
17-Apr-2016 19:13:23.489 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDescriptor Déploiement du descripteur de configuration /etc/tomcat8/Catalina/localhost/host-manager.xml
17-Apr-2016 19:13:23.990 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
17-Apr-2016 19:13:23.999 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDescriptor Deployment of configuration descriptor /etc/tomcat8/Catalina/localhost/host-manager.xml has finished in 510 ms
17-Apr-2016 19:13:24.000 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Déploiement de l'archive /var/lib/tomcat8/webapps/webapp.war de l'application web
17-Apr-2016 19:13:44.278 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Deployment of web application archive /var/lib/tomcat8/webapps/webapp.war has finished in 20 278 ms
17-Apr-2016 19:13:44.279 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Déploiement du répertoire /var/lib/tomcat8/webapps/ROOT de l'application web
17-Apr-2016 19:13:44.772 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
17-Apr-2016 19:13:44.775 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory /var/lib/tomcat8/webapps/ROOT has finished in 496 ms
17-Apr-2016 19:13:44.785 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
17-Apr-2016 19:13:44.800 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"]
17-Apr-2016 19:13:44.801 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in 22651 ms

catalina.out:

avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/common/classes], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/common], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/server/classes], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/server], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/shared/classes], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.ClassLoaderFactory validateFile
AVERTISSEMENT: Problem with directory [/usr/share/tomcat8/shared], exists: [false], isDirectory: [false], canRead: [false]
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: Server version: Apache Tomcat/8.0.14 (Debian)
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: Server built:   Dec 18 2015 02:43:21
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: Server number:  8.0.14.0
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: OS Name:        Linux
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: OS Version:     3.16.0-4-amd64
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: Architecture:   amd64
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: JVM Version:    1.8.0_72-internal-b15
avr. 17, 2016 7:13:21 PM org.apache.catalina.startup.VersionLoggerListener log
INFOS: JVM Vendor:     Oracle Corporation
avr. 17, 2016 7:13:22 PM org.apache.coyote.AbstractProtocol init
INFOS: Initializing ProtocolHandler ["http-nio-8080"]
avr. 17, 2016 7:13:22 PM org.apache.tomcat.util.net.NioSelectorPool getSharedSelector
INFOS: Using a shared selector for servlet write/read
avr. 17, 2016 7:13:22 PM org.apache.coyote.AbstractProtocol init
INFOS: Initializing ProtocolHandler ["ajp-nio-8009"]
avr. 17, 2016 7:13:22 PM org.apache.tomcat.util.net.NioSelectorPool getSharedSelector
INFOS: Using a shared selector for servlet write/read
avr. 17, 2016 7:13:22 PM org.apache.catalina.startup.Catalina load
INFOS: Initialization processed in 983 ms
avr. 17, 2016 7:13:22 PM org.apache.catalina.core.StandardService startInternal
INFOS: Démarrage du service Catalina
avr. 17, 2016 7:13:22 PM org.apache.catalina.core.StandardEngine startInternal
INFOS: Starting Servlet Engine: Apache Tomcat/8.0.14 (Debian)
avr. 17, 2016 7:13:22 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFOS: Déploiement du descripteur de configuration /etc/tomcat8/Catalina/localhost/manager.xml
avr. 17, 2016 7:13:23 PM org.apache.jasper.servlet.TldScanner scanJars
INFOS: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
avr. 17, 2016 7:13:23 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFOS: Deployment of configuration descriptor /etc/tomcat8/Catalina/localhost/manager.xml has finished in 1 242 ms
avr. 17, 2016 7:13:23 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFOS: Déploiement du descripteur de configuration /etc/tomcat8/Catalina/localhost/host-manager.xml
avr. 17, 2016 7:13:23 PM org.apache.jasper.servlet.TldScanner scanJars
INFOS: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
avr. 17, 2016 7:13:23 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFOS: Deployment of configuration descriptor /etc/tomcat8/Catalina/localhost/host-manager.xml has finished in 510 ms
avr. 17, 2016 7:13:24 PM org.apache.catalina.startup.HostConfig deployWAR
INFOS: Déploiement de l'archive /var/lib/tomcat8/webapps/webapp.war de l'application web
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
avr. 17, 2016 7:13:44 PM org.apache.catalina.startup.HostConfig deployWAR
INFOS: Deployment of web application archive /var/lib/tomcat8/webapps/webapp.war has finished in 20 278 ms
avr. 17, 2016 7:13:44 PM org.apache.catalina.startup.HostConfig deployDirectory
INFOS: Déploiement du répertoire /var/lib/tomcat8/webapps/ROOT de l'application web
avr. 17, 2016 7:13:44 PM org.apache.jasper.servlet.TldScanner scanJars
INFOS: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
avr. 17, 2016 7:13:44 PM org.apache.catalina.startup.HostConfig deployDirectory
INFOS: Deployment of web application directory /var/lib/tomcat8/webapps/ROOT has finished in 496 ms
avr. 17, 2016 7:13:44 PM org.apache.coyote.AbstractProtocol start
INFOS: Starting ProtocolHandler ["http-nio-8080"]
avr. 17, 2016 7:13:44 PM org.apache.coyote.AbstractProtocol start
INFOS: Starting ProtocolHandler ["ajp-nio-8009"]
avr. 17, 2016 7:13:44 PM org.apache.catalina.startup.Catalina start
INFOS: Server startup in 22651 ms

localhost.2016-04-17.log:

17-Apr-2016 19:13:27.821 INFO [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log Spring WebApplicationInitializers detected on classpath: [com.j2bb.labs.configuration.initializer.SpringSecurityInitializer@6a81961e, com.j2bb.labs.configuration.initializer.SpringConfigurationInitializer@42c443c6]
17-Apr-2016 19:13:28.043 INFO [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log Initializing Spring root WebApplicationContext
17-Apr-2016 19:13:44.181 INFO [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log Initializing Spring FrameworkServlet 'dispatcher'

can you provide the tomcat log for checking ? – WLiu Apr 17 '16 at 16:41 — WLiu, Apr 17 '16 at 16:41
I just updated the main post with log files ;) – j.2bb Apr 17 '16 at 17:39 — j.2bb, Apr 17 '16 at 17:39

score 1 · Answer 1 · edited May 23 '17 at 11:52

1

Finally, I a found the real problem !

In my Spring Security configuration, I have and ".httpBasic()" defined. So I disabled it and it works fine : .and.httpBasic().disable()

This topic help me : Disable Basic Authentication while using Spring Security Java configuration

Thanks for your help Kanchome99 !!

edited May 23 '17 at 11:52

Community

1
1

answered Apr 20 '16 at 10:04

j.2bb

881
3
10
17

Nice. Good to hear that you have found the solution – WLiu Apr 30 '16 at 14:42

score 0 · Answer 2 · answered Apr 17 '16 at 17:38

0

Tomcat service suppose will be used 8080 port as default , I believe the issue maybe related to Apache setting , would you please check the conf in httpd ?

answered Apr 17 '16 at 17:38

WLiu

426
4
10

In fact, I work on a distant server, not on my localhost. My configuration for testing my app in local is totally different. Do you want to see a particular file of Apache ? – j.2bb Apr 17 '16 at 17:56
for your distant server for tomcat, it should be recall the tomcat web service directly at your http://(distant server IP):8080, just want to confirm whether you got tomcat authentication box for it, normally, it should be shown -> If you're seeing this, you've successfully installed Tomcat. Congratulations! – WLiu Apr 18 '16 at 05:16
It seems Apache and Tomcat are well configured. I create a very simple web application, with an index.jsp only. Apache shows the authentication box and when I fill user and password, the content of the jsp is display. For my main web application, there is a Spring Security implementing, so I wonder if the problem come from that... – j.2bb Apr 19 '16 at 17:30
And note that if i removed Apache authentication, the main web application works ! So I wonder what is the relation between Apache, Tomcat and Spring Security. – j.2bb Apr 19 '16 at 20:07
please try to check the conf between Apache and Tomcat REFF: http://www.ntu.edu.sg/home/ehchua/programming/howto/ApachePlusTomcat_HowTo.html – WLiu Apr 20 '16 at 02:43

score 0 · Answer 3 · answered Jan 28 '18 at 22:43

Add this code auth.eraseCredentials(true); in your webscruty config class :

@EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter{

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
        .eraseCredentials(true);
}

How to disable or remove Tomcat authentication (Realm)

3 Answers3