在 tomcat manager 中，如何限制用户只能部署/取消部署特定应用程序？

Question

could anyone please tell me if it is possible to define a role for tomcat user of the default app manager in a way, that he would be able to deploy only specific application? The situation is that developers can deploy only via console since the server itself is administered by third party. And dealing with it costs money (literally). The security requirement is that they should be able to deploy and undeploy just the application they are working on. The notion of multiple tomcat instances was refused. Is there any third party application which could do that? Any ideas are welcome.

Answer 1

Tomcat's built in Manager application does not support this. Assuming you trust your staff, I'd suggest a different approach. Use social controls rather than technical controls.

If anyone does something they shouldn't the access logs will tell you who did it and then you can take appropriate action.

Answer 2

Try this:

First of all, Create a new users xml database file inside [tomcat_home]/conf , lets call it tomcat-users-2.xml .

Add the following entry into the tomcat-users-2.xml file:

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <user username="[$yourUsername]" password="[$yourPassword]" roles="tomcat,manager-gui"/>
</tomcat-users>

Notice that you can add more than one user tags in the <tomcat-users>

Then in your [tomcat_home]/conf/server.xml file, find <GlobalNamingResources> tag and add (inside it):

<Resource name="UserDatabase2" auth="Container"
          type="org.apache.catalina.UserDatabase"
          description="User database that can be updated and saved"
          factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
          pathname="conf/tomcat-users-2.xml" />

Place the following code inside the <Host ...></Host> tags of the app you want to restrict the user to:

<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase2"/>

Finally you must Restart Tomcat for the changes to take effect.

For more information, check out this link