source: http://notaboekje.blogspot.kr/2011/09/tomcat-7-manager-authentication-gives.html

source: http://notaboekje.blogspot.kr/2011/09/tomcat-7-manager-authentication-gives.html

Tomcat 7 manager authentication gives 403 Access Denied

Access to Tomcat manager has changed somewhat in version 7.
You can still use the classical tomcat-users.xml file, but it need to be configured differently than before.
I found the Tomcat7 documentation lacking and this is the reason for this blog post.

In Tomcat7 you have 4 manager roles:

* manager-gui : allows access to the HTML GUI and the status pages

* manager-jmx : allows access to the JMX proxy and the status pages

* manager-script : allows access to the text interface and the status pages

* manager-status : allows access to the status pages only

To access the HTML interface, you need to have the manager-gui role, but you must NOT have the manager-script or manager-jmx roles.

For example:

<tomcat-users>
  <role rolename="manager-script"/>
  <role rolename="manager-gui"/>
  <role rolename="manager-jmx"/>
  <role rolename="manager-status"/>
  <user username="tomcat" password="tomcat" roles="manager-gui,manager-status"/>
</tomcat-users>

Also note that the HTML interface is protected against CSRF, but the text and JMX interfaces are not. So, if you have already configured the Manager application to allow access and you have used your browsers back button, used a saved book-mark or similar then you may have triggered the cross-site request forgery (CSRF) protection that has been enabled for the HTML interface of the Manager application. You will need to reset this protection by returning to the main Manager page. Once you return to this page, you will be able to continue using the Manager application's HTML interface normally.

If the text or jmx interfaces are accessed through a browser (e.g. for testing since these interfaces are intended for tools not humans) then the browser must be closed afterwards to terminate the session.

Happy coding!