Question

After my unsuccessful attempt with:
Tomcat secure access

Does anyone know how I can run a single Tomcat instance serving one WAR (or specific servlet) over one port and another WAR (or specific servlet) under another?

(My objective is to have one servlet/app with client authentication and another one with no authentication at all. It seems rather strange to me that Tomcat is white or black: or everything is secured or nothing is).

Thanks.

Answer 1

You can set up as many connectors as you wish within the server.xml:

<Connector port="80" redirectPort="8443"/>    
<Connector port="8080" redirectPort="8443"/>    
<Connector port="999" redirectPort="8443"/>
<Connector port="8443" maxHttpHeaderSize="8192"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />

You can also set up secure / HTTPS ports. Then you can instruct you app to only allow secure connections(hence the purpose of the redirect port) or add code to find out which port is being used by the connection (a bit hacky).

However, an easier approach would just be to have multiple Tomcat installations – one setup and running your secure app, the other doing the non-secure apps – each running on their own ports.