401 Unauthorized error while logging in Manager-Ap

Question

I am trying to log in to the Manager App in Tomcat 7.0.22 for Mac OS X 10.7. Here is the error I am getting: http://f.cl.ly/items/421q1K3f1i0X1H1M181v/so.tiff

401 Unauthorized

You are not authorized to view this page. If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation. That file must contain the credentials to let you use this webapp.

For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above.

<role rolename="manager-gui"/>
<user username="tomcat" password="s3cret" roles="manager-gui"/>

I have added this in my tomcat-users.xml, still its not taking the same username/password.

<tomcat-users>
<role rolename="manager-gui"/>
<user name="tomcat" password="s3cret" roles="standard,manager-gui"/>
</tomcat-users>

Answer 1

Changing the port from 8080 to 8088 in server.xml worked for me.Refer the code below

<Connector port="8088" protocol="HTTP/1.1" 
connectionTimeout="20000"
redirectPort="8443" />

Answer 2

I also encountered this problem. The content of my tomcat-users.xml was correct, but the file was not readable by Tomcat. I changed the file's group to tomcat7, restarted Tomcat, and voilà!

Here's the content of my tomcat-users.xml:

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <user username="admin" password="admin" roles="manager-gui, admin-gui" />
</tomcat-users>

Answer 3

Check the exact lines in server.xml

  <Realm className="org.apache.catalina.realm.LockOutRealm">
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>
  </Realm>

Navdeep

Answer 4

In my case, I had multiple <Engine><Host>...</Host></Engine> sections in my context.xml and I had to copy and paste the <Realm className="org.apache.catalina.realm.LockOutRealm">...</Realm> into each <Engine>...</Engine> section because I had the manager app deployed in each one of these hosts that were part of a separate Engine.

The answer from @swapnil chaudhari about the IP address restriction in the app's META-INF/context.xml is also helpful, however I found it more beneficial to override the Context in my server's server.xml.

In the end, I have something like this for each one of my Engines:

    <Engine name="CatalinaMyUniqueEngine"
            defaultHost="MyUniqueHost">
      <Realm className="org.apache.catalina.realm.LockOutRealm">
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase"/>
      </Realm>
      <Host name="MyUniqueHost"
            appBase="/opt/tomcat/webapps/MyUniqueHost"
            unpackWARs="true" autoDeploy="true">
        <Context path="/manager" privileged="true" antiResourceLocking="false"
                 docBase="manager">
          <!-- Wider allowance than the default.
               Or you can remove to allow all IPs, which probably isn't
               a good idea. -->
          <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                 allow="127\.0\.0\.1|10\.244\.\d+.\d+" />
      </Host>
    </Engine>

docBase is relative to appBase. In /opt/tomcat/webapps/MyUniqueHost, I have a symbolic link to the manager application installed by my system's package manager (Debian-based), which placed it at /usr/share/tomcat8-admin/manager. These symbolic links allow me to use the manager app in all my Hosts without copying the manager application.

Answer 5

I tried to add username as tomcat in tomcat-users.xml which was already a role and it was not working. Then I given username as admin for and It worked fine..:)

Answer 6

Sorry, I have to ask the obvious: Did you restart Tomcat?

If that doesn't work, try adding "admin-gui" to your roles:

<user name="tomcat" password="s3cret" roles="admin-gui,standard,manager-gui"/>