tomcat-users.xml 配置不生效原因排查

目录

1、首先检查 conf/server.xml 文件

2、检查conf/tomcat-users.xml 权限内容

3、如果不是本机

---

1、首先检查 conf/server.xml 文件

<GlobalNamingResources>内容是否被注释

<GlobalNamingResources>
    <Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase" />
  </GlobalNamingResources>

2、检查conf/tomcat-users.xml 权限内容

是否添加类似下图：

<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<user username="admin" password="123456" roles="manager-script,manager-jmx,manager-status,admin-script,admin-gui,manager-gui"/>

• manager-gui 允许访问HTML GUI和状态页面
• manager-script 允许访问文本界面和状态页面
• manager-jmx 允许访问JMX代理和状态页面
• manager-status 仅允许访问状态页面

3、如果不是本机

检查 webapps/manager/META-INF/context.xml 文件

<Context antiResourceLocking="false" privileged="true" >
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1|192\.\d+\.\d+\.\d+" />
</Context>

说明：allow可以设置指定IP：allow="192\.168\.\d+\.\d+"  (多IP用 | 分隔)或者允许所有远程访问：allow="^.*$"

4、Description The server understood the request but refuses to authorize it.

HTTP Status 403 – Forbidden
Type Status Report

Description The server understood the request but refuses to authorize it.

Apache Tomcat/8.5.12

 创建文件/{tomcat_path}/conf/Catalina/localhost/manager.xml 

<?xml version="1.0" encoding="UTF-8"?>
<Context privileged="true" antiResourceLocking="false" 
     docBase="${catalina.home}/webapps/manager">
    <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="^.*$" />
</Context>