Return-Path: <jon.skeet@peramon.com>
Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Delivered-To: mailing list tomcat-user@jakarta.apache.org
Received: (qmail 79029 invoked from network); 11 Oct 2000 10:24:22 -0000
Received: from fw1.peramon.com (193.132.195.113)
  by locus.apache.org with SMTP; 11 Oct 2000 10:24:22 -0000
Received: from bluemail.peramon.com [10.1.1.26]
	by fw1.peramon.com (AltaVista Mail V2.0J/2.0J BL25J listener)
	id 0000_004b_39e4_3faf_b560;
	Wed, 11 Oct 2000 11:23:43 +0100
Received: from bluemail.peramon.com (Lexicos client)
	by bluemail.peramon.com (Lexicos V2.0/2.0-74 API)
	id 0000_042c_39e4_3fb5_00cd;
	Wed, 11 Oct 2000 11:23:49 +0100
To: tomcat-user@jakarta.apache.org
Subject: Is tomcat-users.xml still used under Tomcat 3.2?
From: "Jon Skeet" <jon.skeet@peramon.com>
Organization: Peramon Technology Ltd.
Message-ID: <0000_042c_39e4_3fb5_00cd@peramon.com>
Date: Wed, 11 Oct 2000 11:23:49 +0100
X-Mailer: Lexicos V2.0/2.0-74
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
X-Spam-Rating: locus.apache.org 1.6.2 0/1000/N

Under Tomcat 3.1 I certainly had *problems* with security constraints,
but at least it knew who the users were. I now have the following
tomcat-users.xml file in my conf directory:

<tomcat-users>
  <user name="tomcat" password="tomcat" roles="tomcat" />
  <user name="role1"  password="tomcat" roles="role1"  />
  <user name="both"   password="tomcat" roles="tomcat,role1" />
  <user name="admin" password="secret" roles="administrator" />
</tomcat-users>

(This is only for testing purposes, of course :)

In web.xml for a certain web-app I have:

    <security-constraint>
      <web-resource-collection>
        <web-resource-name>Configuration</web-resource-name>
        <url-pattern>/infconfig/*</url-pattern>
        <url-pattern>/appconfig/*</url-pattern>
      </web-resource-collection>
      <auth-constraint>
        <role-name>administrator</role-name>
      </auth-constraint>
    </security-constraint>

Sure enough, trying to access infconfig/index.html pops up a dialog box
- but entering user "admin" and password "secret" doesn't get me any further,
when it used to on Tomcat 3.1. Any ideas what's changed?

Jon, knowing he'll get at least *one* reply to this ;)