Adding default manager roles in tomcat users config.

[dagnelies]

Every time I install a tomcat, I first add the tomcat manager users, and I think a lot of people do this as well. However, currently, it's kind of a pain because you have to look it up first what exactly should be written and create the roles/users manually. This here makes it trivial.

[dagnelies]

...I guess the travis CI is currently broken

[martin-g]

For some reason getParentStream() returns null on s390x (JDK11).

tomcat/java/org/apache/coyote/http2/AbstractNonZeroStream.java

Line 125 in efe0fe8

getParentStream().addChild(replacement);

[ChristopherSchultz]

For some reason getParentStream() returns null on s390x (JDK11).

tomcat/java/org/apache/coyote/http2/AbstractNonZeroStream.java

Line 125 in efe0fe8

getParentStream().addChild(replacement);

🤔

[dagnelies]

Hi, since the Travis CI possibly failed due to some unrelated instability, can we perhaps simply try to re-run it?

[martin-g]

can we perhaps simply try to re-run it?

Re-scheduled it!

[kkolinko]

<user username="admin" password="<must-be-changed>" roles="manager-gui,manager-jmx"/>

-1 for the above line. The "manager-jmx" role is not intended to be used by human users: it does not have CSRF protection.

See
https://tomcat.apache.org/tomcat-9.0-doc/manager-howto.html#Configuring_Manager_Application_Access

<role rolename="manager-gui"/> etc.

There rarely is a need to explicitly create roles like the above. When parsing the tomcat-users.xml file, all roles mentioned in users are created automatically.

[kkolinko]

The "manager-jmx" role and "manager-gui" roles should not be used together. (As I wrote is a comment earlier. Resubmitting via "Code review" panel.)

[dagnelies]

@kkolinko Regarding:

There rarely is a need to explicitly create roles like the above. When parsing the tomcat-users.xml file, all roles mentioned in users are created automatically.

I wasn't aware of that. If roles are automatically generated, what's the use of the role tag at all? I just assumed it was required since it's present in all examples.

I'll remove the JMX part.

[kkolinko]

@kkolinko Regarding:

There rarely is a need to explicitly create roles like the above. When parsing the tomcat-users.xml file, all roles mentioned in users are created automatically.

I wasn't aware of that. If roles are automatically generated, what's the use of the role tag at all? I just assumed it was required since it's present in all examples.

• If you need to declare a role that has no users assigned to it, the role can be declared with a "role" element. Such use case is rare (e.g. if users are managed via some GUI and you want to be able to list all available roles).
• When a user database is saved (written out), "role" elements are written as well, for completeness. This operation can be triggered via JMX.