title: Tomcat 8.5 JDBC Realm with digested salted password: authentication fails
body: <p>I'm trying to get authentication running with a digested password. Unfortunately, authentication fails with 401 error.</p>
  
  <p>server.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;Server port="8005" shutdown="SHUTDOWN"&gt;
    &lt;Listener className="org.apache.catalina.startup.VersionLoggerListener" /&gt;
    &lt;Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /&gt;
    &lt;Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /&gt;
    &lt;Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /&gt;
    &lt;Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /&gt;
  
    &lt;GlobalNamingResources&gt;
      &lt;Resource name="UserDatabase" auth="Container"
                type="org.apache.catalina.UserDatabase"
                description="User database that can be updated and saved"
                factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
                pathname="conf/tomcat-users.xml" /&gt;
    &lt;/GlobalNamingResources&gt;
  
    &lt;Service name="Catalina"&gt;
  
      &lt;Connector port="8080" protocol="HTTP/1.1"
                 connectionTimeout="20000"
                 redirectPort="8443" /&gt;
  
      &lt;Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /&gt;
  
      &lt;Engine name="Catalina" defaultHost="localhost"&gt;
  
        &lt;Realm className="org.apache.catalina.realm.LockOutRealm"&gt;
          &lt;!-- This Realm uses the UserDatabase configured in the global JNDI
               resources under the key "UserDatabase".  Any edits
               that are performed against this UserDatabase are immediately
               available for use by the Realm.  --&gt;
          &lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"&gt;
              &lt;CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="SHA-512" /&gt;
          &lt;/Realm&gt;
        &lt;/Realm&gt;
  
        &lt;Host name="localhost"  appBase="webapps"
              unpackWARs="true" autoDeploy="true"&gt;
  
              &lt;Realm className="org.apache.catalina.realm.JDBCRealm" 
                  driverName="com.mysql.jdbc.Driver"
                  connectionURL="jdbc:mysql://localhost:3306/usersdb?user=root&amp;amp;password=MySQL_Password"
                  userTable="users"
                  userNameCol="user_name" 
                  userCredCol="user_pass"
                  userRoleTable="user_roles" 
                  roleNameCol="role_name"&gt;
  
                  &lt;CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler"
                      algorithm="SHA-512"
                      iterations="3"
                      saltLength="8"
                  /&gt;
              &lt;/Realm&gt;
  
          &lt;Valve className="org.apache.catalina.authenticator.SingleSignOn" /&gt;
  
          &lt;Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                 prefix="localhost_access_log" suffix=".txt"
                 pattern="%h %l %u %t &amp;quot;%r&amp;quot; %s %b" /&gt;
  
        &lt;/Host&gt;
      &lt;/Engine&gt;
    &lt;/Service&gt;
  &lt;/Server&gt;
  
  </code></pre>
  
  <p>In my database <code>usersdb</code>, there is a table called <code>users</code>, with the columns <code>user_name</code> and <code>user_pass</code>. Also, there is a table <code>user_roles</code> with <code>user_name</code> and <code>role_name</code>.</p>
  
  <p>My user is called <code>syncuser</code> and it has the role <code>users.sync</code>.</p>
  
  <p>I digest the password by</p>
  
  <pre><code>digest.bat -a sha-512 -i 3 -s 8 -h org.apache.catalina.realm.MessageDigestCredentialHandler MySyncPassword
  MySyncPassword:5800a4431c85d7a2$3$81a3cbfe53c94b128c1a37e5101cc7d5c5c69f4b4d4262113247a6db79bb5f8bcdcf57df8b2e1980d954be4ece50c40d862c866d3c44e2fc02cd6ecebcc4a830
  </code></pre>
  
  <p>I put the whole string <code>5800a4431c85d7a2$3$81a3cbfe53c94b128c1a37e5101cc7d5c5c69f4b4d4262113247a6db79bb5f8bcdcf57df8b2e1980d954be4ece50c40d862c866d3c44e2fc02cd6ecebcc4a830</code> into my <code>user_pass</code> column.</p>
  
  <p>On the bottom of the web.xml inside my project, I have</p>
  
  <pre><code>  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;/login-config&gt;
    &lt;security-constraint&gt;
      &lt;display-name&gt;My Magical Project Security Constraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;ServerBackend&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/SyncServlet&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;users.sync&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
    &lt;security-role&gt;
      &lt;role-name&gt;users.sync&lt;/role-name&gt;
    &lt;/security-role&gt;
    &lt;security-role&gt;
      &lt;role-name&gt;*&lt;/role-name&gt;
    &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>I already tried it all in the simple way with MD5 encryption, 1 iteration and 0 salt. The problem persists.</p>