1

Is there a way to configure Tomcat 8.5 or 9 to allow the user to log in with either their username or their email address?

I am willing to consider using a 3rd party security container if this solves the problem.

Currently using Tomcat JDBC Realm but only with username. Do not see ways to modify this Realm to allow either username or email address.

1 Answer 1

1

Have a look at the Combined Realm which allows several authentication mechanisms. In your case, you probably need 2 DataSourceRealm (rather than 2 JDBC Realms) accessing the same table but with different userNameCol parameters.

It's interesting to note that you can mix an authentication based on a tier (database, LDAP) and an authentication based on a local file (UserDatabaseRealm). Then you can still log in with an administrator user even when your database is down and all of the application seems dead to the other users. If there are things that don't need the database, you still can work.

7
  • Thank you Eugene. I finally had time to test this and it works. A few comments. It does work with two JDBCRealms (vs 2 DataSourceRealms). Was unsure why you suggested that, so I tried the JDBC since that is what I was using.
    – Ted Cahall
    Commented Feb 3, 2019 at 14:28
  • 1
    Also, as would be expected, I had to add the email column (and unique key) to the user_roles table so the role lookup would work. This required populating that new field from the email field in the users table. Greatly appreciate your help.
    – Ted Cahall
    Commented Feb 3, 2019 at 14:37
  • 1
    @TedCahall Here is one answer why DataSourceRealm performs better, or Tomcat 7 doc which says This could be a bottleneck for applications with high volumes of realm based authentications . The doc doesn't mention that anymore, maybe it should be asked on the users mailing list if it's still like that. Commented Feb 3, 2019 at 14:56
  • 1
    Thanks. That makes total sense. I looked in the Tomcat 8 and Tomcat 9 docs in the DataSourceRealm section and both versions sill mentioned the point you made: The JDBC Realm uses a single db connection. This requires that realm based authentication be synchronized, i.e. only one authentication can be done at a time. This could be a bottleneck for applications with high volumes of realm based authentications.
    – Ted Cahall
    Commented Feb 3, 2019 at 15:23
  • 1
    If your application can get brute-forced, don't forget to have a look at the LockOutRealm. The UserDatabaseRealm often considered as old-school can be useful when the DB would be unreachable if you may allow an (admin) account to be stored on a file. Commented Feb 3, 2019 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.