Question

I have a pom.xml given below.

When I run mvn tomcat:deploy, I get following error:

Uploading: http://AAA.BBB.CCC.DDD:8080/manager/text/deploy?path=%2Fmyapp
Uploaded: http://AAA.BBB.CCC.DDD:8080/manager/text/deploy?path=%2Fmyapp (9553 KB at
137.0 KB/sec)

[INFO] tomcatManager status code:403, ReasonPhrase:Forbidden
[INFO] <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/h
tml4/strict.dtd">
[INFO] <html>
[INFO]  <head>
[INFO]   <title>403 Access Denied</title>
[INFO]   <style type="text/css">
[INFO]     <!--
[INFO]     BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-colo
r:white;font-size:12px;}
[INFO]     H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:
#525D76;font-size:22px;}
[INFO]     PRE, TT {border: 1px dotted #525D76}
[INFO]     A {color : black;}A.name {color : black;}
[INFO]     -->
[INFO]   </style>
[INFO]  </head>
[INFO]  <body>
[INFO]    <h1>403 Access Denied</h1>
[INFO]    <p>
[INFO]     You are not authorized to view this page.
[INFO]    </p>
[INFO]    <p>
[INFO]     If you have already configured the Manager application to allow acces
s and
[INFO]     you have used your browsers back button, used a saved book-mark or si
milar
[INFO]     then you may have triggered the cross-site request forgery (CSRF) pro
tection
[INFO]     that has been enabled for the HTML interface of the Manager applicati
on. You
[INFO]     will need to reset this protection by returning to the
[INFO]     <a href="/manager/html">main Manager page</a>. Once you
[INFO]     return to this page, you will be able to continue using the Manager
[INFO]     appliction's HTML interface normally. If you continue to see this acc
ess
[INFO]     denied message, check that you have the necessary permissions to acce
ss this
[INFO]     application.
[INFO]    </p>
[INFO]    <p>
[INFO]     If you have not changed
[INFO]     any configuration files, please examine the file
[INFO]     <tt>conf/tomcat-users.xml</tt> in your installation. That
[INFO]     file must contain the credentials to let you use this webapp.
[INFO]    </p>
[INFO]    <p>
[INFO]     For example, to add the <tt>manager-gui</tt> role to a user named
[INFO]     <tt>tomcat</tt> with a password of <tt>s3cret</tt>, add the following
 to the
[INFO]     config file listed above.
[INFO]    </p>
[INFO] <pre>
[INFO] &lt;role rolename="manager-gui"/&gt;
[INFO] &lt;user username="tomcat" password="s3cret" roles="manager-gui"/&gt;
[INFO] </pre>
[INFO]    <p>
[INFO]     Note that for Tomcat 7 onwards, the roles required to use the manager

[INFO]     application were changed from the single <tt>manager</tt> role to the

[INFO]     following four roles. You will need to assign the role(s) required fo
r
[INFO]     the functionality you wish to access.
[INFO]    </p>
[INFO]     <ul>
[INFO]       <li><tt>manager-gui</tt> - allows access to the HTML GUI and the st
atus
[INFO]           pages</li>
[INFO]       <li><tt>manager-script</tt> - allows access to the text interface a
nd the
[INFO]           status pages</li>
[INFO]       <li><tt>manager-jmx</tt> - allows access to the JMX proxy and the s
tatus
[INFO]           pages</li>
[INFO]       <li><tt>manager-status</tt> - allows access to the status pages onl
y</li>
[INFO]     </ul>
[INFO]    <p>
[INFO]     The HTML interface is protected against CSRF but the text and JMX int
erfaces
[INFO]     are not. To maintain the CSRF protection:
[INFO]    </p>
[INFO]    <ul>
[INFO]     <li>Users with the <tt>manager-gui</tt> role should not be granted ei
ther
[INFO]         the <tt>manager-script</tt> or <tt>manager-jmx</tt> roles.</li>
[INFO]     <li>If the text or jmx interfaces are accessed through a browser (e.g
. for
[INFO]         testing since these interfaces are intended for tools not humans)
 then
[INFO]         the browser must be closed afterwards to terminate the session.</
li>
[INFO]    </ul>
[INFO]    <p>
[INFO]     For more information - please see the
[INFO]     <a href="/docs/manager-howto.html">Manager App HOW-TO</a>.
[INFO]    </p>
[INFO]  </body>
[INFO] </html>
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1:14.595s
[INFO] Finished at: Wed Apr 16 00:14:08 MSD 2014
[INFO] Final Memory: 7M/17M
[INFO] ------------------------------------------------------------------------

How can I fix it?

Here's the pom.xml:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>co.altruix</groupId>
  <artifactId>myapp</artifactId>
  <packaging>war</packaging>
  <version>1.0</version>
  <name>Vaadin Web Application</name>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <vaadin.version>6.8.2</vaadin.version>
    <gwt.version>2.3.0</gwt.version>
    <gwt.plugin.version>2.2.0</gwt.plugin.version>
  </properties>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>1.5</source>
          <target>1.5</target>
        </configuration>
      </plugin>
        <plugin>
            <groupId>org.apache.tomcat.maven</groupId>
            <artifactId>tomcat7-maven-plugin</artifactId>
            <version>2.1</version>
            <configuration>
                <url>http://AAA.BBB.CCC.DDD:8080/manager/text</url>
                <server>myapp-1</server>
                <path>/myapp</path>
                <username>admin</username>
                <password>...</password>

            </configuration>
        </plugin>

      <!-- Compile custom GWT components or widget dependencies with the GWT compiler -->
      <!--
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>gwt-maven-plugin</artifactId>
        <version>${gwt.plugin.version}</version>
        <configuration>
          <webappDirectory>${project.build.directory}/${project.build.finalName}/VAADIN/widgetsets</webappDirectory>
          <extraJvmArgs>-Xmx512M -Xss1024k</extraJvmArgs>
          <runTarget>myapp</runTarget>
          <hostedWebapp>${project.build.directory}/${project.build.finalName}</hostedWebapp>
          <noServer>true</noServer>
          <port>8080</port>
          <compileReport>false</compileReport>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>resources</goal>
              <goal>compile</goal>
            </goals>
          </execution>
        </executions>
        <dependencies>
          <dependency>
            <groupId>com.google.gwt</groupId>
            <artifactId>gwt-dev</artifactId>
            <version>${gwt.version}</version>
          </dependency>
          <dependency>
            <groupId>com.google.gwt</groupId>
            <artifactId>gwt-user</artifactId>
            <version>${gwt.version}</version>
          </dependency>
        </dependencies>
      </plugin>
      <plugin>
        <groupId>com.vaadin</groupId>
        <artifactId>vaadin-maven-plugin</artifactId>
        <version>1.0.2</version>
        <executions>
          <execution>
            <configuration>
            </configuration>
            <goals>
              <goal>update-widgetset</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      -->

      <!-- A simple Jetty test server at http://localhost:8080/myapp can be launched with the Maven goal jetty:run 
        and stopped with jetty:stop -->
      <plugin>
        <groupId>org.mortbay.jetty</groupId>
        <artifactId>maven-jetty-plugin</artifactId>
        <version>6.1.24</version>
        <configuration>
          <stopPort>9966</stopPort>
          <stopKey>myapp</stopKey>
          <!-- Redeploy every x seconds if changes are detected, 0 for no automatic redeployment -->
          <scanIntervalSeconds>0</scanIntervalSeconds>
          <!-- make sure Jetty also finds the widgetset -->
          <webAppConfig>
            <contextPath>/myapp</contextPath>
            <baseResource implementation="org.mortbay.resource.ResourceCollection">
              <!-- Workaround for Maven/Jetty issue http://jira.codehaus.org/browse/JETTY-680 -->
              <!-- <resources>src/main/webapp,${project.build.directory}/${project.build.finalName}</resources> -->
              <resourcesAsCSV>src/main/webapp,${project.build.directory}/${project.build.finalName}</resourcesAsCSV>
            </baseResource>
          </webAppConfig>
        </configuration>
      </plugin>
    </plugins>
  </build>

  <repositories>
    <repository>
      <id>vaadin-snapshots</id>
      <url>http://oss.sonatype.org/content/repositories/vaadin-snapshots/</url>
      <releases>
        <enabled>false</enabled>
      </releases>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
    </repository>
    <repository>
      <id>vaadin-addons</id>
      <url>http://maven.vaadin.com/vaadin-addons</url>
    </repository>
  </repositories>

  <!--
  <pluginRepositories>
    <pluginRepository>
      <id>codehaus-snapshots</id>
      <url>http://nexus.codehaus.org/snapshots</url>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
      <releases>
        <enabled>false</enabled>
      </releases>
    </pluginRepository>
    <pluginRepository>
      <id>vaadin-snapshots</id>
      <url>http://oss.sonatype.org/content/repositories/vaadin-snapshots/</url>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
      <releases>
        <enabled>false</enabled>
      </releases>
    </pluginRepository>
  </pluginRepositories>
  -->

  <dependencies>
    <dependency>
      <groupId>com.vaadin</groupId>
      <artifactId>vaadin</artifactId>
      <version>${vaadin.version}</version>
    </dependency>
      <dependency>
          <groupId>junit</groupId>
          <artifactId>junit</artifactId>
          <version>4.11</version>
          <scope>test</scope>
      </dependency>
      <dependency>
          <groupId>com.google.guava</groupId>
          <artifactId>guava</artifactId>
          <version>16.0.1</version>
      </dependency>
      <dependency>
          <groupId>ch.qos.logback</groupId>
          <artifactId>logback-core</artifactId>
          <version>0.9.26</version>
      </dependency>
      <dependency>
          <groupId>ch.qos.logback</groupId>
          <artifactId>logback-classic</artifactId>
          <version>0.9.26</version>
      </dependency>
      <dependency>
          <groupId>com.h2database</groupId>
          <artifactId>h2</artifactId>
          <version>1.3.173</version>
      </dependency>
      <dependency>
          <groupId>org.quartz-scheduler</groupId>
          <artifactId>quartz</artifactId>
          <version>2.2.1</version>
      </dependency>
      <dependency>
          <groupId>org.mockito</groupId>
          <artifactId>mockito-core</artifactId>
          <version>1.9.5</version>
          <scope>test</scope>
      </dependency>
      <dependency>
          <groupId>org.powermock</groupId>
          <artifactId>powermock-api-mockito</artifactId>
          <version>1.5.1</version>
          <scope>test</scope>
      </dependency>
      <dependency>
          <groupId>org.easytesting</groupId>
          <artifactId>fest-assert</artifactId>
          <version>1.4</version>
          <scope>test</scope>
      </dependency>

    <!--
    <dependency>
      <groupId>com.google.gwt</groupId>
      <artifactId>gwt-user</artifactId>
      <version>${gwt.version}</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>javax.validation</groupId>
      <artifactId>validation-api</artifactId>
      <version>1.0.0.GA</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>javax.validation</groupId>
      <artifactId>validation-api</artifactId>
      <version>1.0.0.GA</version>
      <classifier>sources</classifier>
      <scope>provided</scope>
    </dependency>
    -->
  </dependencies>

</project>

tomcat-users.xml:

<?xml version='1.0' encoding='utf-8'?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<tomcat-users>
<!--
  NOTE:  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.
-->
<!--
  NOTE:  The sample user and role entries below are wrapped in a comment
  and thus are ignored when reading this file. Do not forget to remove
  <!.. ..> that surrounds them.
-->
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->
  <role rolename="manager"/>
  <role rolename="manager-gui"/>
  <user username="admin" password="..." rol
es="manager-gui,manager"/>

</tomcat-users>

settings.xml:

<settings>
    <servers>
        <server>
            <id>myapp-1</id>
            <username>admin</username>
            <password>...</password>
        </server>
    </servers>
</settings>
Was it helpful?

Solution 2

I fixed the problem by

  1. using the Cargo plugin and
  2. changing the permissions on the Tomcat side.

Permissions (tomcat-users.xml)

  <role rolename="manager-gui"/>
  <role rolename="tomcat"/>
  <role rolename="manager-script"/>
  <role rolename="manager-status"/>
  <role rolename="manager-jmx"/>
  <user username="admin" password="..." roles="tomcat,manager-gui,manager-script,manager-jmx,manager-status"/>

Cargo plugin (pom.xml):

I added this code:

    <plugin>
        <groupId>org.codehaus.cargo</groupId>
        <artifactId>cargo-maven2-plugin</artifactId>
        <version>1.3.3</version>
        <configuration>
            <container>
                <containerId>tomcat7x</containerId>
                <type>remote</type>
            </container>
            <configuration>
                <type>runtime</type>
                <properties>
                    <cargo.remote.username>...</cargo.remote.username>
                    <cargo.remote.password>...</cargo.remote.password>
                    <cargo.hostname>...</cargo.hostname>
                    <cargo.protocol>http</cargo.protocol>
                    <cargo.servlet.port>8080</cargo.servlet.port>
                </properties>
            </configuration>

            <!-- Deployer configuration -->
            <deployer>
                <type>remote</type>
            </deployer>
            <deployables>
                <deployable>
                    <groupId>...</groupId>
                    <artifactId>...</artifactId>
                    <type>war</type>
                </deployable>
            </deployables>

        </configuration>
    </plugin>

then ran mvn cargo:deploy.

OTHER TIPS

You should use "tomcat7:deploy" instead of "tomcat:deploy". They aren't actually the same.

I encountered 403 forbidden when the <servers><server><username> provided in settings.xml had manager-gui role specified but not a manager-script role specified in conf/tomcat-users.xml

manager-gui role is enough to login to tomcat manager via browser. But manager-script role is needed to upload war programmatically

Please refer tomcat documentation

•manager-gui — Access to the HTML interface.

•manager-status — Access to the "Server Status" page only.

•manager-script — Access to the tools-friendly plain text interface that is described in this document, and to the "Server Status" page.

•manager-jmx — Access to JMX proxy interface and to the "Server Status" page.

Note that

•It is recommended to never grant the manager-script or manager-jmx roles to users that have the manager-gui role

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top