Apache Tomcat 9 unable to access manager webapp

Question

I successfully install Apache Tomcat 9 and I access at servername:8080.

I follow documentation in order to access the manager web app and :

• open $CATALINA_HOME/conf/tomcat-user.xml
• add <role rolename="manager-gui"/>
• add <user username="tomcat" password="s3cret" roles="manager-gui"/>
• $CATALINA_HOME/bin/catalina.sh stop
• check servername:8080 is down
• $CATALINA_HOME/bin/catalina.sh start
• check servername:8080 is up
• servername:8080/manager/html return HTTP Status 403 – Forbidden

I can't find what config I am missing and will be greateful for any kind of help or suggestion.

Answer 1

I wanto to share the solution I found here not in the marked answer but in the fade's answer.

Commenting the Valve attribute in CATALINA_HOME/webapps/manager/META-INF/context.xml and restarting Tomcat solve the problem and I can now assess the web manager

Answer 2

Please change the allow attribute value in the context.xml file, present in webapps/manager/META-INF folder.

Old configuration

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />

change to new Configuration

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="\d+\.\d+\.\d+\.\d+" />

This will allow access to manager remotely from all IP addresses for login. Further you won't get 403 access denied page

Answer 3

Even i had the same problem , with Tomcat 9.0.20

I commented the Valve tag completely (/tomcat/webapps/manager/META-INF). So my context.xml looked like below

<Context antiResourceLocking="false" privileged="true" >
  <!--
    Remove the comment markers from around the Valve below to limit access to
    the manager application to clients connecting from localhost
  -->
  <!--
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
  -->
  <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFil$
</Context>

Then in tomcat-users.xml (/tomcat/conf/)i did

<role rolename="tomcat"/>
<role rolename="manager-gui"/>
<user username="user" password="user@123" roles="manager-gui"/>
<user username="guest" password="guest123" roles="tomcat"/>

Now i could login using user and user@123 credentials.

Answer 4

quick and dirty to access all links in tomcat 9

in tomcat-users.xml add:

<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<role rolename="manager-status"/>
<role rolename="manager-script"/>
<role rolename="manager-gui"/>

<user username="admin" password="admin" roles="admin-script,admin-gui,manager-script,manager-gui,manager-status" />

then restart with catalina stop catalina start

(for me on macOS w/ homebrew, file located in /usr/local/Cellar/tomcat/9.0.43/libexec/conf/tomcat-users.xml)