title: Cannot increase log level debugging in tomcat6 using jndi realm
body: <p>I am trying to configure tomcat to connect to an ldap database using JNDI Realm, in order to integrate with Active Directory.  However, I am getting the following error in my logs and cannot seem to increase the log level to see what is really going on.</p>
  
  <pre><code>Feb 19, 2014 10:10:41 AM org.apache.catalina.startup.Catalina load
  INFO: Initialization processed in 1048 ms
  Feb 19, 2014 10:10:42 AM org.apache.catalina.core.StandardService start
  INFO: Starting service Catalina
  Feb 19, 2014 10:10:42 AM org.apache.catalina.core.StandardEngine start
  INFO: Starting Servlet Engine: Apache Tomcat/6.0.36
  Feb 19, 2014 10:10:42 AM org.apache.catalina.realm.RealmBase init
  FINE: Register Realm Catalina:type=Realm,realmPath=/realm0
  Feb 19, 2014 10:10:42 AM org.apache.catalina.authenticator.AuthenticatorBase start
  FINE: No SingleSignOn Valve is present
  Feb 19, 2014 10:11:34 AM org.apache.catalina.authenticator.AuthenticatorBase start
  FINE: No SingleSignOn Valve is present
  Feb 19, 2014 10:11:44 AM org.apache.catalina.authenticator.AuthenticatorBase start
  FINE: No SingleSignOn Valve is present
  Feb 19, 2014 10:11:45 AM org.apache.catalina.startup.HostConfig deployDescriptor
  INFO: Deploying configuration descriptor host-manager.xml
  Feb 19, 2014 10:11:45 AM org.apache.catalina.authenticator.AuthenticatorBase start
  FINE: No SingleSignOn Valve is present
  Feb 19, 2014 10:11:45 AM org.apache.catalina.startup.HostConfig deployDescriptor
  INFO: Deploying configuration descriptor manager.xml
  Feb 19, 2014 10:11:45 AM org.apache.catalina.authenticator.AuthenticatorBase start
  FINE: No SingleSignOn Valve is present
  Feb 19, 2014 10:11:45 AM org.apache.coyote.http11.Http11Protocol start
  INFO: Starting Coyote HTTP/1.1 on http-80
  Feb 19, 2014 10:11:45 AM org.apache.catalina.startup.Catalina start
  INFO: Server startup in 64228 ms
  Feb 19, 2014 10:11:54 AM org.apache.catalina.authenticator.AuthenticatorBase invoke
  FINE: Security checking request GET /tip/
  Feb 19, 2014 10:11:54 AM org.apache.catalina.realm.RealmBase findSecurityConstraints
  FINE:   Checking constraint 'SecurityConstraint[Secure Area]' against GET /index.jsp --&gt; true
  Feb 19, 2014 10:11:54 AM org.apache.catalina.realm.RealmBase findSecurityConstraints
  FINE:   Checking constraint 'SecurityConstraint[Secure Area]' against GET /index.jsp --&gt; true
  Feb 19, 2014 10:11:54 AM org.apache.catalina.authenticator.AuthenticatorBase invoke
  FINE:  Calling hasUserDataPermission()
  Feb 19, 2014 10:11:54 AM org.apache.catalina.realm.RealmBase hasUserDataPermission
  FINE:   User data constraint has no restrictions
  Feb 19, 2014 10:11:54 AM org.apache.catalina.authenticator.AuthenticatorBase invoke
  FINE:  Calling authenticate()
  Feb 19, 2014 10:11:54 AM org.apache.catalina.authenticator.AuthenticatorBase invoke
  FINE:  Failed authenticate() test
  </code></pre>
  
  <p>My Realm configuration within tomcat's server.xml looks like this:  (I obviously remove sensitive information)</p>
  
  <pre><code>  &lt;!-- JNDI Realm authentication start --&gt;
      &lt;Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
          connectionURL="ldap://&lt;ldap server goes here&gt;:389"
          connectionName="cn=app,ou=service admin accounts,ou=users,o=iam"
          connectionPassword="password goes here"
          referrals="follow"
          userBase="ou=fil,ou=users,o=iam"
          userSearch="(AMAccountName={0})"
          userSubtree="true"
          roleBase="ou=groups,o=iam"
          roleName="cn"
          roleSubtree="true"
          roleSearch="(member={0})"
      /&gt; 
    &lt;!-- JNDI Realm authentication end --&gt;
  </code></pre>
  
  <p>My tomcat logging.properties look like this:</p>
  
  <pre><code># Licensed to the Apache Software Foundation (ASF) under one or more
  
  # contributor license agreements.  See the NOTICE file distributed with
  
  # this work for additional information regarding copyright ownership.
  
  # The ASF licenses this file to You under the Apache License, Version 2.0
  
  # (the "License"); you may not use this file except in compliance with
  
  # the License.  You may obtain a copy of the License at
  
  #
  
  #     http://www.apache.org/licenses/LICENSE-2.0
  
  #
  
  # Unless required by applicable law or agreed to in writing, software
  
  # distributed under the License is distributed on an "AS IS" BASIS,
  
  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  
  # See the License for the specific language governing permissions and
  
  # limitations under the License.
  
  
  
  handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
  
  .handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
  
  
  
  ############################################################
  
  # Handler specific properties.
  
  # Describes specific configuration info for Handlers.
  
  ############################################################
  
  
  
  1catalina.org.apache.juli.FileHandler.level = ALL
  
  1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
  
  1catalina.org.apache.juli.FileHandler.prefix = catalina.
  
  1catalina.org.apache.juli.FileHandler.bufferSize = -1
  
  
  
  2localhost.org.apache.juli.FileHandler.level = ALL
  
  2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
  
  2localhost.org.apache.juli.FileHandler.prefix = localhost.
  
  
  
  3manager.org.apache.juli.FileHandler.level = ALL
  
  3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
  
  3manager.org.apache.juli.FileHandler.prefix = manager.
  
  
  
  4host-manager.org.apache.juli.FileHandler.level = ALL
  
  4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
  
  4host-manager.org.apache.juli.FileHandler.prefix = host-manager.
  
  
  
  java.util.logging.ConsoleHandler.level = ALL
  
  java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
  
  
  
  ############################################################
  
  # Facility specific properties.
  
  # Provides extra control for each logger.
  
  ############################################################
  
  # Possible levels are: SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST or ALL
  
  
  
  org.apache.catalina.realm.level = ALL
  
  org.apache.catalina.realm.useParentHandlers = true
  
  org.apache.catalina.authenticator.level = ALL
  
  org.apache.catalina.authenticator.useParentHandlers = true
  
  
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = ALL
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler
  
  
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = ALL
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler
  
  
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = ALL
  
  org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler
  
  
  
  # For example, to log debug messages in ContextConfig and HostConfig
  
  # classes and to log only warnings and errors in other
  
  # org.apache.catalina.** classes, uncomment these lines:
  
  #org.apache.catalina.startup.ContextConfig.level = FINE
  
  #org.apache.catalina.startup.HostConfig.level = FINE
  
  #org.apache.catalina.level = WARNING
  </code></pre>
  
  <p>So, as you can see I have tried to increase the log level by adding the debug="99" to the server.xml and change the real and authenticator levels to ALL.  However, I am still not getting anything that looks useful except for the error <strong>Failed authenticate() test</strong></p>
  
  <p>Where is the rest of the log information? What I am expecting is to see the LDAP query going out.</p>