title: Tomcat JNDIRealm authenticate and ignore all roles
body: <p>Tomcat container use LDAP to authenticate user</p>
  
  <p>I am trying to replace Tomcat's inMemory user database with LDAP authentication. making changes in conf/server.xml</p>
  
  <p>When user login popus up i want to compare user credentials against ldap.</p>
  
  <pre><code> &lt;Realm className="org.apache.catalina.realm.JNDIRealm" 
   connectionName="abcusername" 
   connectionPassword="mypassword" 
   connectionURL="ldap://ada.cab.ast.com:389" 
   debug="10" userBase="DC=cab,DC=ast,DC=com" 
   userSearch="(cn={0})" 
   userSubtree="true"/&gt;  
  </code></pre>
  
  <p></p>
  
  <p>My web.xml, if user is authenticated all no role restriction</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;HTML Manager interface (for humans)&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;Tomcat Manager Application&lt;/realm-name&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>When i provide correct username and password i see in following log that user is authenticated but failed authorization i guess and failed.
  any help is appreciated.</p>
  
  <pre><code>AuthenticatorBase.register Authenticated 'fkhan002c' with type 'BASIC'
  AuthenticatorBase.invoke  Calling accessControl()
  hasResourcePermission   Checking roles GenericPrincipal[fkhan002c()]
  AuthenticatorBase.invoke  Failed accessControl() test
  </code></pre>