Programming Tutorials

Creating Users and Passwords with Tomcat using tomcat-users.xml

By: Emiley J.  

A very easy method of authenticating users with Tomcat involves creating usernames, passwords, and roles in the tomcat-users.xml file. This file is stored in <Tomcat-installation-directory>/conf.

Everyone is familiar with usernames and passwords, but what are roles? Roles are logical ways to describe groups of users who have similar responsibilities, such as manager or databaseAdmin. Example below shows a tomcat-users.xml file that creates two roles and two users with two aptly named XML elements: role and user.

The tomcat-users XML file

<?xml version='1.0' encoding='utf-8'?>

<tomcat-users>
  <role rolename="dbadmin"/>
  <role rolename="manager"/>
  <user username="BruceP" password="bwperry" roles="dbadmin,manager"/>
  <user username="JillH" password="jhayward" roles="manager"/>
</tomcat-users>

In above example, the user BruceP is associated with two roles (dbadmin and manager), while user JillH is associated only with the manager role. Tomcat uses this file when authenticating users with BASIC and form-based authentication