Lab 7: Create a Data Source Realm

Objective: In this lab, you will create and configure a database realm for administering usernames and passwords for Tomcat applications.

1. You are going to use a database named myrealm, and the SQL for creating that database and its tables is provided for you in the Lab_07 folder. From a command prompt, run the following command to create the database and tables in MySQL for this lab:

   mysql --user root -p < myrealm.txt

2. Login to MySQL and verify the myrealm database exists and has two tables: users and roles:

   $ mysql --user root -p
   Enter password:
   
   mysql> use myrealm;
   Reading table information for completion of table and column names
   You can turn off this feature to get a quicker startup with -A
   
   Database changed
   mysql> select * from users;
   +----------+------------+
   | Username | Password   |
   +----------+------------+
   | admin    | password   |
   | george   | washington |
   +----------+------------+
   2 rows in set (0.00 sec)
   
   mysql> select * from roles;
   +----------+----------+
   | Username | Role     |
   +----------+----------+
   | admin    | admin    |
   | admin    | manager  |
   | rich     | customer |
   +----------+----------+
   3 rows in set (0.00 sec)
   
   mysql> quit;

3. Configure your new realm in server.xml, assigning it the name "My Realm".
4. Using the example from this chapter, add a <securityconstraint> to the web.xml deployment descriptor of the /best application (deployed in the previous lab) so that only users in the "admin" role can access any resource of URL pattern /best/* for GET and POST requests.
5. Add a <Realm> to the <Engine> section of your server.xml config that connects to the myrealm database.
6. Restart Tomcat so that your changes take effect.
7. Try logging with "admin" as both the username and password. This user should be able to visit all pages in the /best web app.
8. Reload the /best app and try logging in as "george" with password "washington". This user is not in the "admin" role and should not be able to access the application.