KB485112: Protect the Web and Library admin pages with a custom Tomcat role

Description

In Strategy 2021 Update 2 and later, you can protect the Web and Library admin pages with a custom Tomcat role. The admin pages are protected by the admin role by default.

Strategy Web

Although the following procedure refers to Strategy Web, the same information applies to Strategy Mobile.

1. Define the custom Tomcat role in

   tomcat-users.xml

   under the

   conf 

   directory and save it.
   

   
   <role rolename="customrolename" />
   <user password="password" roles="customrolename" username="username" />

   
   
2. Edit

   sys_defaults.properties

   under the

   Strategy/WEB-INF/xml

   directory.
3. Add the

   basicAuthAdminRole

   parameter with the value of the custom Tomcat role.
   

   
   basicAuthAdminRole=customrolename
   

   
   
4. Restart the Web server.

Strategy Library

1. Define the custom Tomcat role in

   tomcat-users.xml

   under the

   conf

   folder and save it.
   

   
   <role rolename="customrolename" />
   <user password="password" roles="customrolename" username="username" />    

   
   
2. Edit

   configOverride.properties

   under the

   StrategyLibrary/WEB-INF/classes/config

   directory.
3. Add the

   basic.auth.admin.role

   parameter with the value of the custom Tomcat role.
   

   
   basic.auth.admin.role=customrolename
   

   
   
4. Restart the Web server.