Search code examples
tomcatlockedunlockrealm

How to unlock a tomcat user?

I am using Tomcat 7.0 and a user i defined at tomcat-users.xml is locked. I saw warnings at catalina.out that the user is locked. How can i unlock it without restarting tomcat? I searched a lot but could not find any solution.

Thanks a lot,

Solution

  • With Tomcat's default CMS settings, it doesn't implement any user account locking. If you've nested the user's realm in the LockOutRealm, then the user will be locked out for 300 seconds after 5 unsuccessful attempts:

    http://tomcat.apache.org/tomcat-6.0-doc/config/realm.html#LockOut_Realm_-_org.apache.catalina.realm.LockOutRealm

    This is designed to protect Tomcat against DOS attacks etc. The values quoted above are the default settings, you can edit them as you wish.

    If you really need to unlock a user quicker than that, have a look at the implementation of this class:

    org.apache.catalina.realm.LockOutRealm