#APACHE TOMCAT DEFAULT CREDENTIALS CODE#
#APACHE TOMCAT DEFAULT CREDENTIALS PASSWORD#

I think this is all pretty standard and Tomcat provides CredentialHandler ch = (CredentialHandler) application.getAttribute(Globals.CREDENTIAL_HANDLER) for this purpose. This is all described in Christopher Schultz's link at the start of my question. The alternative would be for every application to provide their own corresponding libraries, which seems wasteful and error-prone given that tomcat already has them.

#APACHE TOMCAT DEFAULT CREDENTIALS PASSWORD#

Using the credential handler defined in the context is important to ensure the password is mutated in the exact way that tomcat requires. matches() is used to confirm that the 'current' password matches their existing password before changing it to the new password (which again must be mutated). Every time a new user account is created, the user's password must be mutated and saved to the database.Īdditionally, when a user wants to change their password, a form would ask for the current and new passwords. This use-case is a common one: The application must be able to save the mutated password to the database so that tomcat can do form-based authentication against it when users log in. I would rather not remove the Lockout Realm because that would compromise security.

How can I get the configured credential handler in my app so that I can call the.

#APACHE TOMCAT DEFAULT CREDENTIALS CODE#

Looking through the Tomcat code, it seems that the code that calls setAttribute(Globals.CREDENTIAL_HANDLER) doesn't take CombinedRealm into account. If I remove the LockoutRealm definition, it works fine, so it seems that having a nested realm (LockoutRealm, DataSourceRealm), causes it to fail. The problem is that it returns a blank/default credential handler, not the one I have configured. As per Christopher Schultz's presentation at I get it like this: CredentialHandler ch = (CredentialHandler) application.getAttribute(Globals.CREDENTIAL_HANDLER) I would like to get the CredentialHandler in my Java app to hash and store passwords. I'm using Tomcat 8.5.59 and have the following Realm in my context.xml:

Apache tomcat default credentials