title: Error 403 when using Basic Authentication with Tomcat 8
body: <p>
  Hi Everyone,</p>
  
  <p>I followed the steps in the below link to accomplish Basic Authentication with Tomcat and I was successfully able to achieve the result:</p>
  
  <p><a href="http://www.avajava.com/tutorials/lessons/how-do-i-use-basic-authentication-with-tomcat.html?page=1" rel="nofollow noreferrer">http://www.avajava.com/tutorials/lessons/how-do-i-use-basic-authentication-with-tomcat.html?page=1</a></p>
  
  <p>I went then afterward to accomplish the same on an existing project I'm working on but I'm unfortunately getting error 403 ( Access to the specified resource has been forbidden) when trying to access the servlet either from the browser or through a java program. Error 403 means the user was authenticated but not authorized.</p>
  
  <p>I did an in depth research on that issue but still I'm stuck there, so appreciate your help here.</p>
  
  <p>Here is the tomcat-user.xml:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;role rolename="tomee-admin"/&gt;
  &lt;role rolename="adapter-role"/&gt;
  &lt;user password="tomee" roles="tomee-admin,manager-gui" username="tomee"/&gt;
  &lt;user username="adapter" password="adapterpwd" role="adapter-role"/&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>Her is my web.xml:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5"&gt;
    &lt;display-name&gt;sbee-adapter&lt;/display-name&gt;
    &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;OZZ-Adapter&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
        &lt;/web-resource-collection&gt;
        &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
        &lt;/user-data-constraint&gt;
    &lt;/security-constraint&gt;  
    &lt;security-constraint&gt;
   &lt;web-resource-collection&gt;
    &lt;web-resource-name&gt;OZZ-Adapter&lt;/web-resource-name&gt;
    &lt;url-pattern&gt;/API&lt;/url-pattern&gt;
   &lt;/web-resource-collection&gt;
   &lt;auth-constraint&gt;
    &lt;role-name&gt;adapter-role&lt;/role-name&gt;
   &lt;/auth-constraint&gt;
   &lt;/security-constraint&gt;
    &lt;servlet&gt;
      &lt;description&gt;&lt;/description&gt;
      &lt;servlet-name&gt;IDP&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.xxxx.ozz.adapter.ztee.IDP&lt;/servlet-class&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;IDP&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/IDP&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
    &lt;servlet&gt;
      &lt;description&gt;&lt;/description&gt;
      &lt;display-name&gt;API&lt;/display-name&gt;
      &lt;servlet-name&gt;API&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.xxxx.ozz.adapter.ztee.API&lt;/servlet-class&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;API&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/API&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
    &lt;login-config&gt;
    &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;/login-config&gt;
  &lt;/web-app&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>My java code:</p>
  
  <pre><code>HttpURLConnection con1 = (HttpURLConnection) urlSBEE_API.openConnection();
                  con1.setRequestMethod("POST");
                  String basis_encode = Base64.getEncoder().encodeToString(("adapter" + ":" + "adapterpwd").getBytes("UTF-8"));
                  con1.setRequestProperty("Authorization", "Basic " + basis_encode);
      responseCode = con1.getResponseCode();
      System.out.println("Response code====== "+responseCode);
  </code></pre>
  
  <p>the responseCode value is being 403.</p>
  
  <p>I made sure to include in the web.xml the</p>
  
  <pre><code>&lt;auth-method&gt;BASIC&lt;/auth-method&gt;
  </code></pre>
  
  <p>as I saw on the net many suggestions to do that.</p>
  
  <p>On the other hand if in the java code I enter a wrong username and pwd then I get error 401 which is correct since it means user not authenticated.</p>
  
  <p>I cleared browser cache and retired. still same issue.</p>
  
  <p>Could the issue be related to Proxy setting???</p>
  
  <p>My windows proxy settings are as follow:
  Use Automatic Configuration script, Address: <a href="http://proxy:8083/" rel="nofollow noreferrer">http://proxy:8083/</a></p>
  
  <p>I tried the following code as well:</p>
  
  <pre><code>     Proxy proxy = new Proxy(Proxy.Type.HTTP,
                              new InetSocketAddress("Proxy"),
                                      Integer.parseInt("8083"));
          HttpURLConnection con1 = (HttpURLConnection) urlDistribution.openConnection(proxy);
      con1.setRequestMethod("POST");
      String basis_encode = Base64.getEncoder().encodeToString(("adapter" + ":" + "adapterpwd").getBytes("UTF-8"));
      con1.setRequestProperty("Authorization", "Basic " + basis_encode);
      responseCode = con1.getResponseCode();
     System.out.println("Response code====== "+responseCode);
  </code></pre>
  
  <p>I tried including the following before HttpURLConnection con1 :</p>
  
  <pre><code>System.setProperty("http.nonProxyHosts", "&lt;MY_LOCAL_HOST&gt;");
  </code></pre>
  
  <p>but still no luck.</p>
  
  <p>Thank you!</p>