title: Using Spring Security with a standalone Tomcat doing authentication
body: <p>I want Tomcat (or rather the admin) to handle the user management.
  In Spring I just want to secure some endpoints (index.html and two RESTful controllers) and bind it to either a user or, even better, a group/role.</p>
  
  <p>I want to avoid using xml config inside Spring and use just classes and annotations.
  Xml config in tomcat is ok :-)</p>
  
  <p>Booting up spring I see a log entry</p>
  
  <blockquote>
    <p>2014-06-04 11:37:31.676  INFO 27296 --- [on(2)-127.0.0.1] b.a.s.AuthenticationManagerConfiguration : </p>
    
    <p>Using default password for application endpoints: 543fbdb8-c5d0-4b1b-b7ce-cd6fd008520a</p>
    
    <p>2014-06-04 11:37:31.775  INFO 27296 --- [on(2)-127.0.0.1] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@5867ecdd, ...</p>
    
    <p>...</p>
    
    <p>2014-06-04 11:37:31.794  INFO 27296 --- [on(2)-127.0.0.1] o.s.b.c.embedded.FilterRegistrationBean  : Mapping filter: 'springSecurityFilterChain' to: [/*]</p>
    
    <p>... </p>
    
    <p>2014-06-04 11:37:31.907  INFO 27296 --- [on(2)-127.0.0.1] o.s.w.s.handler.SimpleUrlHandlerMapping  : Mapped URL path [/login] onto handler of type [class org.springframework.web.servlet.mvc.ParameterizableViewController]</p>
  </blockquote>
  
  <p>Trying to call upon the secured route I get a login form, yet using the information from the <em>tomcat-users.xml</em> I get an error <strong>Invalid username and password.</strong>.</p>
  
  <p>So what am I missing? </p>
  
  <h2>Setup</h2>
  
  <p>I have </p>
  
  <ul>
  <li>vanilla Apache Tomcat 8.0.8</li>
  <li>a modified <em>conf/tomcat-users.xml</em></li>
  <li>a modified <em>conf/server.xml</em></li>
  <li>a cloned deployable version of the <a href="https://spring.io/guides/gs/securing-web" rel="nofollow">Securing Spring Web Guide</a> in my local branch and in this folder (intellij module), see <a href="https://github.com/rbecher/gs-securing-web/tree/standalone/standalone" rel="nofollow">github repo</a></li>
  </ul>
  
  <h2>Configuration</h2>
  
  <h3>Spring</h3>
  
  <p>See the <em>WebSecurityConfig</em> class.</p>
  
  <h3>tomcat-users.xml</h3>
  
  <pre><code>&lt;!-- ... ---&gt;
  &lt;role rolename="manager-gui"/&gt;
  &lt;role rolename="manager-script"/&gt;
  &lt;role rolename="manager-jmx"/&gt;
  &lt;role rolename="manager-status"/&gt;
  &lt;role rolename="ROLE_stakeholder"/&gt;
  &lt;user username="stakeholder" password="Foobarbaz" roles="ROLE_stakeholder,manager-gui,manager-script,manager-jmx,manager-status"/&gt;
  &lt;!-- ... ---&gt;
  </code></pre>
  
  <h3>server.xml</h3>
  
  <pre><code>&lt;!-- ... ---&gt;
  &lt;Engine name="Catalina" defaultHost="localhost"&gt;
      &lt;!-- ... ---&gt;
      &lt;Realm className="org.apache.catalina.realm.MemoryRealm" /&gt;
  &lt;/Engine&gt;
  </code></pre>