403 ошибка tomcat

В данном посте режим проблемы доступа в разделы менеджера и вообще, любого проекта, который мы ходим настроить на УДАЛЕННОМ СЕРВЕРЕ.

Почему именно на удаленном сервере? Потому что, работа Tomcat на локальном сервере и удаленном работает по дефолту по разному. На локальном не возникают проблемы с правами и безопасностью, а на удаленном можно встретиться со всем этим сюрпризом и можно на этом убить немало времени.

Нам нужно, сначала дать полные права под папку проектов на удаленном сервере

далее, создать пользователя в файле конфигурации Tomcat — conf/tomcat-users.xml в каждом разделе в папке META-INF отредактировать файл context.xml.

Проблема входа в разделы менеджера приложений Tomcat 8/9 связана с блокировкой текущего URL, по которому мы пытаемся открыть сайт. Данная проблема решается , в дополнении с прописью ролей в tomcat-users.xml

 <role rolename="manager-gui"/>
 <role rolename="manager-script"/>
 <role rolename="manager-jmx"/>
 <role rolename="manager-status"/>
 <role rolename="admin-gui"/>
 <role rolename="admin-script"/>
 <user username="username" password="password" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script"/>

Еще и редактированием, точнее, закоментированием тега Valve в файле context.xml в папке META-INF открываемого проекта

<?xml version="1.0" encoding="UTF-8"?>
...
<Context antiResourceLocking="false" privileged="true" >
...
<!--
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127.d+.d+.d+|::1|0:0:0:0:0:0:0:1" />
-->
...
</Context>

Файл context.xml может находится в любом проекте и отвечает за доступ к проекту из удаленного URL.

HTTP Status 403 (Access to the requested resource has been denied) can indicate that either you typed 3+ incorrect credentials (try another web-browser) or you’ve some problem with configuration.

If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation (locate tomcat-users.xml). That file must contain the credentials to let you use Tomcat webapp.

For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above:

<role rolename="manager-gui"/>
<user username="tomcat" password="s3cret" roles="manager-gui"/>

Then you can access your webapps manager from /manager/html (e.g. reloading after config changes).

Read more: Manager App HOW-TO

If you’re trying to implement your own security constraint (in web.xml), try the following example (before </web-app> ending):

<!-- This security constraint protects your webapp interface. -->
<login-config>
  <!-- Define the Login Configuration -->
  <auth-method>BASIC</auth-method>
  <realm-name>Webapp</realm-name>
</login-config>
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Admin</web-resource-name>
    <url-pattern>/*</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
    <role-name>*</role-name>
  </auth-constraint>
  <!-- Specifying a Secure Connection -->
  <user-data-constraint>
    <!-- transport-guarantee can be CONFIDENTIAL (forced SSL), INTEGRAL, or NONE -->
    <transport-guarantee>NONE</transport-guarantee>
  </user-data-constraint>
</security-constraint>
<!-- Authorization, see: tomcat-users.xml --> 
<security-role>
  <role-name>*</role-name>
</security-role>

If you still having the problem, try:

• check if you’re editing the right XML file,
• validate your XML files, e.g. catalina.sh configtest or xmlstarlet val /etc/tomcat?/*.xml /var/lib/tomcat7/webapps/*/WEB-INF/*.xml,
• your <url-pattern> matches in your <security-constraint> or set to /*,
• check your Tomcat logs (e.g. /var/log/tomcat7),
• increase logging level (INFO -> FINE/FINEST) in logging.properties or log4j.properties (INFO, SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST or ALL), restart Tomat and check the logs,
• if nothing in logs, check if you’re checking the right logs (sudo lsof | grep -E "java.*(out|txt|log)$", tail -f /var/log/tomcat7/*.log /var/log/tomcat7/*.txt /var/log/tomcat7/*.out),
• when using log4j logging system, make sure you initialized it properly by placing libs and log4j.properties into the right folder and configuring it,

• test BASIC authentication with cURL:

  • without credentials:

    $ curl -vv http://example.com:8983/solr/
    

    Normally request should return HTTP/1.1 401 Unauthorized and the «WWW-Authenticate» header should indicate Basic authentication is required.

  • with credentials:

    $ curl -vv -u tomcat:tomcat http://example.com:8983/solr/
    

    The request should be sent with an «Authorization» header and it should authenticate. If your credentials are invalid, you should get: HTTP/1.1 401 Unauthorized. If the user is authenticated, but does not have access to view the resource you should get: HTTP/1.1 403 Forbidden.

• maybe a user lock out mechanism has been activated for too many failed authentication attempts (LockOutRealm),

• stop and run Tomcat manually (in the same way as in: ps wuax | grep ^tomcat), e.g.:

  # ps wuax | grep ^tomcat
  tomcat7    884  /usr/lib/jvm/java-7-openjdk-amd64/bin/java -Djava.util.logging.config.file=/var/lib/tomcat7/conf/logging.properties ... org.apache.catalina.startup.Bootstrap start
  $ /etc/init.d/tomcat7 stop
  $ sudo sudo -u tomcat7 /usr/lib/jvm/java-7-openjdk-amd64/bin/java ...  -Dorg.apache.catalina.level=FINEST org.apache.catalina.startup.Bootstrap start
  

  Alternatively start using catalina.sh script like:

  $ . /etc/default/tomcat7
  $ export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64 CATALINA_HOME=/usr/share/tomcat7 CATALINA_BASE=/var/lib/tomcat7 CATALINA_PID=/var/run/tomcat7.pid CATALINA_TMPDIR=/tmp LOGGING_CONFIG="-Dorg.apache.catalina.level=FINEST"
  $ /usr/share/tomcat7/bin/catalina.sh run
  

  Or in debug mode:

  $ JPDA_SUSPEND=y catalina.sh jpda start
  

  and check your catalina.out log.

• last resort is to debug process by: sudo strace -fp PID.

I am trying deploy my project to tomcat7 using the Eclipse IDE, and I facing this error:

Uploading: http://localhost:8080/manager/html/deploy?path=%2Fexample
Uploaded: http://localhost:8080/manager/html/deploy?path=%2Fexample (13855 KB at 61573.5 KB/sec)

[ERROR] Tomcat return http status error: 403, Reason Phrase: Forbidden
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 6.259s
[INFO] Finished at: Sun Apr 20 09:44:18 GMT-03:00 2014
[INFO] Final Memory: 13M/223M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.tomcat.maven:tomcat7-maven-plugin:2.2:deploy (default-cli) on project example: Tomcat return http status error: 403, Reason Phrase: Forbidden: <html><head><title>Apache Tomcat/7.0.50 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 403 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>Access to the specified resource has been forbidden.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.50</h3></body></html> -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

My pom.xml have this configuration:

  <build>
  <plugins>
            <plugin>
              <groupId>org.apache.tomcat.maven</groupId>
              <artifactId>tomcat7-maven-plugin</artifactId>
              <version>2.2</version>
              <configuration>
                  <url>http://localhost:8080/manager/html</url>
                  <server>TomcatServer</server>
                  <path>/example</path>
                  <username>klebermo</username>
                  <password>[password]</password>
              </configuration>
            </plugin>
    </plugins>
    </build>

My tomcat-users.xml is that:

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="manager"/>
  <role rolename="admin"/>
  <user username="klebermo" password="[password]" roles="admin,manager"/>
</tomcat-users>

Anyone can point me what I doing wrong?

Error: Tomcat Manager App—403 Access Denied You are not authorized to view this page

Solution:

1. Close Tomcat (the shutdown batch file under the bin file in the installation directory)

2. Find the tomcat-users.xml file in the conf folder under the installation directory

3. Add the following configuration information in the <tomcat-users></tomcat-user> tag of the xml file

<role rolename=»manager»/>  
<role rolename=»manager-gui»/>  
<role rolename=»admin»/>  
<role rolename=»admin-gui»/>  
<role rolename=»manager-script»/>  
<role rolename=»manager-jmx»/>  
<role rolename=»manager-status»/>  
<user username=»admin» password=»123456″ roles=»admin-gui,admin,manager-gui,manager,manager-script,manager-jmx,manager-status»/> 

The username and password attributes can be modified by themselves

4. After the modification is completed, save the modification and restart tomcat.

Original: https://blog.csdn.net/zhiyuan_ma/article/details/54708667