title: Tomcat user auth-How to limit tomcat-user login attemps before getting HTTP/401?
body: <p>How to control on user auth' in tomcat7 for the following:</p>
  
  <ul>
  <li><p>Limit user login attemps, as example 5 times for a user?</p>
  
  <p>It looks that using the code below in server.xml it's done-at least according to the logs, but, the problem/question is that after exactly 3 failures anyway got HTTP error 401. </p>
  
  <p>(<em>I did failures for testing-there is no problem to login with the correct credentials</em>).</p></li>
  <li><p>What's the configuraion for login attemps before getting HTTP/401?</p></li>
  </ul>
  
  <p>Configurations:</p>
  
  <p>Tomcat 7.0.34, with simple JAVA Web-Application.</p>
  
  <p>Added this in server.xml:</p>
  
  <pre><code>&lt;Realm className="org.apache.catalina.realm.LockOutRealm"
    failureCount="5" lockOutTime="300" cacheSize="100" 
    cacheRemovalWarningTime="360"&gt; 
      &lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm"
        resourceName="UserDatabase" /&gt;
  &lt;/Realm&gt;
  </code></pre>
  
  <p>Added/allowed  in tomcat-users.xml</p>
  
  <p>web.xml:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Demo-Only-resource&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/DoSomething&lt;/url-pattern&gt;            
          &lt;url-pattern&gt;/hideme.html&lt;/url-pattern&gt;            
      &lt;/web-resource-collection&gt;
  
      &lt;auth-constraint&gt;
          &lt;role-name&gt;users&lt;/role-name&gt;
      &lt;/auth-constraint&gt;    
  &lt;/security-constraint&gt;
  
  &lt;security-role&gt;
      &lt;role-name&gt;users&lt;/role-name&gt;
  &lt;/security-role&gt;
  
  &lt;login-config&gt;
       &lt;auth-method&gt;FORM&lt;/auth-method&gt;
       &lt;form-login-config&gt;
              &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
              &lt;form-error-page&gt;/error.jsp&lt;/form-error-page&gt;
       &lt;/form-login-config&gt;
  &lt;/login-config&gt;    
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;DoSomething&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.flrdemo.DoSomething&lt;/servlet-class&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;DoSomething&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/DoSomething&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;DoSomething&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;   
  &lt;session-config&gt;
      &lt;session-timeout&gt;
          15
      &lt;/session-timeout&gt;
  &lt;/session-config&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <ul>
  <li>comment: code-all works except the option to control on login attemps (failures) before getting http error 401 Unauthorized error.</li>
  </ul>