I have a problem with web-security using tomcat. I have developed one web application and provide security for that.but it didn't work properly.
what i mean is i took 'manager' as one role and i declared username and password in tomcat-users.xml. but when access particular resource with in that application i is displaying one customized dialogue box(login.html) and asking userid and password for authentication.but when we enter valid credentials it still displaying "sorry , login failed" message.
I cannot see anything obviously wrong, although trying to read that much information onscreen is not easy for me. It would be a good idea if you made your login and fail webpages be complete well-formed html (with <html;>, <head> and <body>) tags, but I don't think that's the actual problem.
As far as I can tell, the files are all configured properly, otherwise the login screen would not be displayed when you requested the ManagerAddDailyStatus.do URL. So the most likely thing to check after that is to make sure that the userid that Tomcat runs under is permitted to read the TOMCAT_HOME/conf/tomcat-users.xml file.
If you get really desperate, you can enable Tomcat's logging and see what it's actually doing, but usually it's not necessary to do that.
When it comes to destroying a civilization, gas chambers cannot hold a candle to echo chambers.