<tomcat-users xmlns="http://tomcat.apache.org/xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd" version="1.0"> <!-- NOTE: By default, no user is included in the "manager-gui" role required to operate the "/manager/html" web application. If you wish to use this app, you must define such a user - the username and password are arbitrary. It is strongly recommended that you do NOT use one of the users in the commented out section below since they are intended for use with the examples web application. --> <!-- NOTE: The sample user and role entries below are intended for use with the examples web application. They are wrapped in a comment and thus are ignored when reading this file. If you wish to configure these users for use with the examples web application, do not forget to remove the <!.. ..> that surrounds them. You will also need to set the passwords to something appropriate. --> <!-- <role rolename="tomcat"/> <role rolename="role1"/> <user username="tomcat" password="<must-be-changed>" roles="tomcat"/> <user username="both" password="<must-be-changed>" roles="tomcat,role1"/> <user username="role1" password="<must-be-changed>" roles="role1"/> --> </tomcat-users>
例如这个信息,可以把用户名密码放到数据库中吗?
这种明文密码未免有点太不安全了吧
不能,tomcat配置用户名密码只能通过配置文件的方式。
不过tomcat是开源的,也许可以通过修改源代码的方式,来满足自己的需求。
从来没考虑过这种事情,这就像是把钱放在桌子上还是桌子底下一样,没什么区别,毕竟能拿桌子上的钱的人自然也能手伸到桌子底下拿
细节上的区别吧
如果可以配置到数据库中,就可以做个UI界面维护了
@renguanyu: 题主说的是“不安全”,站在安全角度上来看:
如果放在数据库中,那必然需要存储数据库的密码放在某个tomcat能够访问到的地方。而能够访问到这个xml文件的用户当然也可以访问到数据库的密码(如果不能的话,那为什么不直接把这个xml和密码放在一起呢),并不能够起到增加安全性的作用,况且tomcat本身是一个轻量的服务器,其对数据库连接并没有硬性需求,如果把用户名密码放在数据库里,那么势必要在tomcat启动的同时(或者至少在用户进行登录操作之前),创建数据库连接,这显然不合适