title: Tomcat 7 Restricted (ContainerServlet) error
body: <p>I have been stuck on this one for a while.  I am trying to access the ContainerServlet I implemented using HttpClient with Tomcat 7.  I keep getting the error message "Restricted(ContainerServlet)".  I have added Basic Authentication and tried to set it up just like the built in Host-Manager application with no luck.</p>
  
  <p>My HostManagerServlet starts with:</p>
  
  <pre><code>public class HostManagerServlet
  extends HttpServlet implements ContainerServlet {...
  </code></pre>
  
  <p>My web.xml contains:</p>
  
  <pre><code>&lt;servlet&gt;
              &lt;servlet-name&gt;virtualHostCreator&lt;/servlet-name&gt;
              &lt;servlet-class&gt;com.eatmyfish.servlets.HostManagerServlet&lt;/servlet-class&gt;
            &lt;/servlet&gt;
            &lt;servlet-mapping&gt;
              &lt;servlet-name&gt;virtualHostCreator&lt;/servlet-name&gt;
              &lt;url-pattern&gt;/virtualhostcreator/*&lt;/url-pattern&gt;
            &lt;/servlet-mapping&gt;
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
            &lt;web-resource-name&gt;HostManager commands&lt;/web-resource-name&gt;
            &lt;url-pattern&gt;/virtualhostcreator/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
             &lt;!-- NOTE:  This role is not present in the default users file --&gt;
             &lt;role-name&gt;admin-script&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
        &lt;/security-constraint&gt;
        &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
            &lt;web-resource-name&gt;HTMLHostManager commands&lt;/web-resource-name&gt;
            &lt;url-pattern&gt;/virtualhostcreator/*&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
             &lt;!-- NOTE:  This role is not present in the default users file --&gt;
             &lt;role-name&gt;admin-gui&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
        &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;description&gt;
        The role that is required to log in to the Host Manager Application HTML
        interface
      &lt;/description&gt;
      &lt;role-name&gt;admin-gui&lt;/role-name&gt;
    &lt;/security-role&gt;
    &lt;security-role&gt;
      &lt;description&gt;
        The role that is required to log in to the Host Manager Application text
        interface
      &lt;/description&gt;
      &lt;role-name&gt;admin-script&lt;/role-name&gt;
    &lt;/security-role&gt;
  </code></pre>
  
  <p>My tomcat-users.xml contains:</p>
  
  <pre><code>.
  .
  .
  &lt;role rolename="admin-gui"/&gt;
    &lt;role rolename="admin-script"/&gt;
    &lt;role rolename="manager-gui"/&gt;
    &lt;role rolename="tomcat"/&gt;
    &lt;role rolename="role1"/&gt;
    &lt;user username="tomcat" password="tomcat" roles="tomcat,admin-gui,admin-script,manager-gui"/&gt;
  .
  .
  .
  </code></pre>
  
  <p>The code that makes the HttpClient call (I've tried a few different approaches):</p>
  
  <p>Approach One -</p>
  
  <pre><code>String url = environment.getProperty("baseurl");
          url += "virtualhostcreator/createVirualHost?name="+group.getGroupName();
          HttpClient httpclient = new DefaultHttpClient();
  
          HttpGet httpget = new HttpGet(url);
          httpget.addHeader(BasicScheme.authenticate(
                   new UsernamePasswordCredentials("tomcat", "tomcat"),
                   "UTF-8", false));
          HttpResponse response = httpclient.execute(httpget);
  </code></pre>
  
  <p>Approach Two - </p>
  
  <pre><code>String url = environment.getProperty("baseurl");
          url += "virtualhostcreator/createVirualHost?name="+group.getGroupName();
          DefaultHttpClient httpclient = new DefaultHttpClient();
          httpclient.getCredentialsProvider().setCredentials(
                  new AuthScope("localhost", 8080),
                  new UsernamePasswordCredentials("tomcat", "tomcat"));
          // Create AuthCache instance
          AuthCache authCache = new BasicAuthCache();
          // Generate BASIC scheme object and add it to the local
          // auth cache
          HttpHost targetHost = new HttpHost("localhost", 8080, "http");
          BasicScheme basicAuth = new BasicScheme();
          authCache.put(targetHost, basicAuth);
  
          // Add AuthCache to the execution context
          BasicHttpContext localcontext = new BasicHttpContext();
          localcontext.setAttribute("http.auth.auth-cache", authCache);
  
          HttpGet httpget = new HttpGet(url);
  
          HttpResponse response = httpclient.execute(targetHost, httpget,localcontext);
  </code></pre>
  
  <p>The error's stacktrace:</p>
  
  <pre><code>SEVERE: Allocate exception for servlet virtualHostCreator
  java.lang.SecurityException: Restricted (ContainerServlet) class com.eatmyfish.servlets.HostManagerServlet
      at org.apache.catalina.core.DefaultInstanceManager.checkAccess(DefaultInstanceManager.java:536)
      at org.apache.catalina.core.DefaultInstanceManager.loadClassMaybePrivileged(DefaultInstanceManager.java:509)
      at org.apache.catalina.core.DefaultInstanceManager.newInstance(DefaultInstanceManager.java:124)
      at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1136)
      at org.apache.catalina.core.StandardWrapper.allocate(StandardWrapper.java:857)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:135)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:581)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
      at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:987)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:579)
      at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
      at java.lang.Thread.run(Thread.java:722)
  </code></pre>
  
  <p>Any ideas what I am doing wrong?  I cannot get past the Restricted(ContainerServlet) error.</p>