tomcat - j-security-check tomcat安全检查没问题但是jsp 403错误

Question

tomcat7:服务器.xml

<Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI
             resources under the key "UserDatabase".  Any edits
             that are performed against this UserDatabase are immediately
             available for use by the Realm.  -->
        <!--<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase"/>-->
            <Realm 
            className="org.apache.catalina.realm.JDBCRealm"
            debug="99"
            driverName="oracle.jdbc.driver.OracleDriver" 
            connectionURL="jdbc:oracle:thin:@localhost:1521:orcl"
            connectionName="usertemp"
         connectionPassword="usertemp"
         userTable="users" 
         userNameCol="username" 
         userCredCol="password"
         userRoleTable="user_roles" 
         roleNameCol="rolename" />
      </Realm>

tomcat-用户.xml:

<tomcat-users>

  <role rolename="manager"/>
  <user username="user1" password="password" roles="manager"/>
</tomcat-users>

web.xml:

<web-app>
    <security-constraint>
      <display-name>Example Security Constraint</display-name>
      <web-resource-collection>
         <web-resource-name>Protected Area</web-resource-name>
         <url-pattern>/protected/*</url-pattern>
         <url-pattern>/1/*</url-pattern>
       <http-method>DELETE</http-method>
         <http-method>GET</http-method>
         <http-method>POST</http-method>
       <http-method>PUT</http-method>
      </web-resource-collection>
      <auth-constraint>
           <role-name>manager</role-name>
      </auth-constraint>
      <user-data-constraint><transport-guarantee>NONE</transport-guarantee></user-data-constraint>
    </security-constraint>


    <!-- Default login configuration uses form-based authentication -->
    <login-config>
      <auth-method>FORM</auth-method>
      <realm-name>Example Form-Based Authentication Area</realm-name>
      <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
      </form-login-config>
    </login-config>
    <security-role>
        <description> An administrator </description>
        <role-name>manager</role-name>
    </security-role>
</web-app>

1) 当我在 ie 中输入 url[http://localhost:8080/security-form-b​​ased/protected/index.jsp] 时，2)返回登录，然后转到login.jsp，输入用户名和密码，3) 但返回错误页面，我无法访问 index.jsp :

HTTP Status 403 - Access to the requested resource has been denied

所以，我不知道为什么？谁能帮我 ？谢谢。

Answer 1

你已经配置了JDBCRealm，但是附上了tomcat-users.xml的例子，用于注释掉的UserDatabaseRealm。您的 JDBCRealm 没有为您的用户返回角色 manager 的问题(可能)。确保切换到 UserDatabaseRealm。