如何修复tomcat HTTP状态403：访问被拒绝

Question

I made a simple form athentification tomcat using eclipse in which a name and a password is required to access. However when i put the username and password in the file tomcat-users.xml i get an the error HTTP status 403 which mean the access is denied.

I guess that the problem is in either web.xml or in server.xml. I know that the error is not in tomcat-users.xml because i tried everything but i always get the same error.

the script in the file web.xml relative to my TestServlet is :

<servlet>
        <servlet-name>TestServlet</servlet-name>
        <servlet-class>test.TestServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>TestServlet</servlet-name>
        <url-pattern>/test</url-pattern>
    </servlet-mapping>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Wildcard means whole app requires authentication</web-resource-name>
            <url-pattern>/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>

        <auth-constraint>
            <role-name>tomcat</role-name>
        </auth-constraint>


    </security-constraint>

    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/login.html</form-login-page>
            <form-error-page>/login-failed.html</form-error-page>
        </form-login-config>
    </login-config>

PS : when i put wrong credentials i get the page login-failed.html, so everything works well when i put wrong credentials. PS : the code in the file tomcat-users.xml is :

<tomcat-users>
<role rolename="manager"/>
<user username="admin" password="admin" roles="manager"/>
</tomcat-users>

Could someone help me locate the problem please ?

Answer 1

U extract it and try to access it by calling localhost:8080 and give login credentials but can't login right. Means u have no access to that gui .so u must manually edit XML file and modify the scripts like this for access gui. After that I hope it will definitely works

Add following scripts

    <tomcat-users>
      <role rolename="manager-gui"/>
   <role rolename="manager-jmx"/>
   <role rolename="manager-status"/>
   <user username="admin" password="admin" 
     roles="manager-gui,manager-status"/>
    </tomcat-users>

    manager-gui — Access to the HTML interface.

Answer 2

In the auth-constraint, you have configured "tomcat" role. This role is missing in your tomcat-users.xml file.