Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A Tomcat Manager 401 Unauthorized response means the Manager application did not accept an authenticated identity with the role required by the endpoint you opened. For the browser interface at /manager/html, create or update a user in Tomcat’s active Realm and grant manager-gui. If that does not resolve the response, check the Realm type, source-address valves, reverse-proxy handling, and cached browser credentials.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a Tomcat Manager 401 means
HTTP 401 is an authentication failure, not a deployment failure. Tomcat’s Manager web application challenges the client with BASIC authentication and asks the configured Realm to verify the username and password. The request then has to pass authorization: the authenticated account must hold the role required by the specific Manager endpoint.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe default Tomcat installation is intentionally closed. Its sample user entries are commented out, and no account is granted a Manager role. Apache’s Manager documentation explains the security reason: “It would be quite unsafe to ship Tomcat with default settings that allowed anyone on the Internet to execute the Manager application.” A fresh installation therefore commonly returns 401 until an administrator creates an account in the active identity store.
A valid username alone is not enough. A user with manager-status can view status pages but cannot automatically open the HTML management interface. Likewise, an account created in tomcat-users.xml has no effect when the running server uses LDAP, a database, or another external Realm.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Check the endpoint and its minimum role first
Before changing credentials, confirm the exact URL. Tomcat Manager exposes separate interfaces with separate role requirements:
| Endpoint | Typical use | Minimum role |
|---|---|---|
/manager/html |
Browser-based HTML Manager interface and its status pages | manager-gui |
/manager/status |
Status information | manager-gui, manager-status, manager-script, or manager-jmx, as supported by the installed version |
/manager/text |
Text commands and deployment automation | manager-script |
| JMX proxy endpoints | JMX-based management | manager-jmx |
Use the role that matches the job. A credential that works for the text API may still receive 401 at /manager/html, because manager-script does not substitute for manager-gui. Endpoint behavior and role details can vary between Tomcat major versions, so check the Manager documentation shipped for the version actually running.
Identify the Realm that authenticates Manager
The Realm is the authority Tomcat consults for usernames, passwords, and roles. Find the Realm configuration for the server instance hosting Manager before editing any account file. The most common first-installation setup is a UserDatabaseRealm backed by a MemoryUserDatabase. That configuration reads:
$CATALINA_BASE/conf/tomcat-users.xml
$CATALINA_BASE is the instance base directory, not necessarily the directory named by CATALINA_HOME. Multiple Tomcat instances on one machine can have different base directories and different user databases. Editing the file under the wrong installation leaves the running server unchanged.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Other common Realm types use an external identity store:
- JDBCRealm or DataSourceRealm: users and role memberships come from relational database tables or a configured data source.
- JNDIRealm: users and groups are looked up in LDAP or another directory service through JNDI.
- Custom or container-integrated Realm: authentication may be delegated to an application server, single sign-on system, or organization-specific provider.
When one of these Realms is active, adding a <user> element to tomcat-users.xml cannot create a usable Manager account. Add the user and the appropriate group or role in the configured database or directory instead, then verify that the Realm maps that group to the Tomcat role name.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Fix a file-backed Realm with tomcat-users.xml
Use this procedure only after confirming that the active Realm is the default file-backed UserDatabase.
- Locate the active base directory. Determine which Tomcat process is serving the Manager application and identify its
$CATALINA_BASE. Open that instance’sconf/tomcat-users.xml, not a similarly named file belonging to another installation. - Make a protected backup. Copy the file before editing it. The file contains credentials or password material and should be readable only by the account that needs to administer Tomcat.
- Inspect the sample entries. The distributed examples are normally enclosed in XML comments. A user line inside
<!--and-->is documentation, not an account. Remove the comment wrapper from the entry you intend to use, or create a new active entry. - Create a dedicated account. Add an active user with a unique, strong password and the narrowest role required. For the browser interface, the essential attribute is
roles="manager-gui". A representative entry is:
<user username="manager-admin" password="use-a-long-unique-password" roles="manager-gui"/>Use a real password-management practice rather than copying this example literally. Do not leave a sample password in production, and do not reuse an operating-system or database password. If automation needs the text API, create a separate account with manager-script instead of adding every role to the GUI account.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Validate the XML. Keep the document well formed: one root
<tomcat-users>element, properly quoted attributes, and no duplicate or malformed tags. A syntax error can prevent the user database from loading. - Save with appropriate permissions. Ensure the Tomcat service account can read the file and that ordinary users cannot. Password exposure in backups, source control, or world-readable configuration is a separate security problem from the 401 itself.
- Restart or reload Tomcat. Restart the instance, or use the supported configuration-reload mechanism for your version, so the user database and Manager application reread their configuration. A file edit that has not been loaded cannot affect authentication.
- Authenticate against the exact URL. Open
http://host:port/manager/htmlor the HTTPS equivalent and answer the BASIC-authentication prompt with the configured username and password. Use the same host and port that serve the running instance; a different connector or proxy may point to another Tomcat installation.
If the response changes from 401 to 403, authentication succeeded but another authorization or access rule is denying the request. Treat that as a different branch of the diagnosis rather than repeatedly changing the password.
When editing the XML does not work
The running server uses LDAP, JNDI, JDBC, or a data source
Confirm the Realm declaration in the active server or application configuration. For a directory-backed Realm, create or enable the account in the directory and add it to the group that Tomcat maps to manager-gui. For JDBC or DataSourceRealm, insert or update the account and role membership in the configured tables or service, following that system’s password-hashing and rotation policy. Then allow the Realm to refresh its cache, or restart Tomcat if the provider requires it.
Free tools Windows power users keep installed
One-click scans. No signup required.
You edited the wrong Tomcat instance
On hosts with several installations, compare the process’s base directory, connector port, service definition, and Manager response headers with the file you edited. Service managers often set CATALINA_BASE independently of your interactive shell. The only user file that matters is the one read by the process serving this request.
The user entry is still commented out
XML comments can span multiple lines. Check the complete surrounding block, not just the line containing the username. Also check for a second active entry with the same username or a typo in the role name. Tomcat role names are case-sensitive in practice because they must match the names recognized by the Manager application.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
The role does not match the endpoint
Granting manager-status or manager-script will not make a browser session authorized for /manager/html. Conversely, granting manager-gui to an automation account is unnecessary and increases exposure. Map the endpoint to its minimum role before changing the account.
Check network valves after credentials are correct
Manager can impose a second gate based on the client’s source address. A RemoteCIDRValve or RemoteHostValve in the Manager context can reject requests even when the username, password, and role are valid. Inspect the Manager context configuration for these valves and compare their allow or deny rules with the address Tomcat actually sees.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Reverse proxies and load balancers can change that address. A rule written for an internal proxy address may unintentionally allow every request from the proxy, while a rule written for the user’s public address may block all traffic because Tomcat never sees that address directly. Make network restrictions explicit and test from each supported administration network.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose reverse-proxy authentication failures
A proxy must forward the request to the correct Manager context and preserve the authentication exchange. Check these conditions in order:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Path forwarding: the proxy must send
/managerto the Tomcat instance that actually contains the Manager application. An incorrect prefix, rewrite, or trailing-slash rule can send the request to another application. - Authorization header: verify that the proxy does not remove or replace the
Authorizationheader on the request after the browser responds to the BASIC challenge. - Challenge propagation: the response reaching the browser should include the expected BASIC
WWW-Authenticatechallenge. A proxy-generated challenge can look like a Tomcat failure while never reaching Manager. - HTTPS boundaries: terminate TLS deliberately and ensure that the proxy-to-Tomcat hop follows the security policy for administrative credentials. Do not expose Manager over an untrusted network merely to simplify testing.
- Source address: compare the address visible in Tomcat logs with the address used by any RemoteCIDRValve or RemoteHostValve rule.
Use access logs at both layers for one request. If the proxy logs a 401 but Tomcat records no corresponding request, troubleshoot the proxy. If Tomcat records the request and returns 401, troubleshoot the Realm, role mapping, or credentials. If Tomcat returns success but the proxy changes it, troubleshoot proxy response handling.
Clear stale browser credentials
BASIC authentication is commonly cached per browser tab, host, and port. After changing a username or password, close the Manager tab or clear the browser’s saved credentials for that origin and retry. Test in a private window only as a diagnostic comparison; it is not a substitute for fixing the server configuration. Avoid repeatedly submitting an old password, because account lockout or directory-side throttling may be triggered by the external identity provider.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use least privilege for Manager roles
Tomcat defines separate roles so administration can be limited to the required function:
| Role | Intended capability | Deployment guidance |
|---|---|---|
manager-gui |
HTML Manager interface and status pages | Use for a human administrator who needs the browser UI. |
manager-status |
Status pages only | Use for monitoring or read-only operational checks. |
manager-script |
Text interface, deployment commands, and status pages | Use for automation with a dedicated noninteractive credential. |
manager-jmx |
JMX proxy and status pages | Use only for tooling that specifically requires JMX access. |
Tomcat recommends not combining the powerful script or JMX roles with manager-gui. Separate human and automation accounts, restrict the Manager application by network where possible, rotate credentials, and remove accounts when their task ends. A successful login is not evidence that the exposure is safe; Manager can deploy applications and control a running server.
A practical troubleshooting decision tree
- Is the URL
/manager/html? If not, identify the endpoint-specific role before changing anything. - Does the active Realm read
tomcat-users.xml? If yes, add an active user withmanager-gui. If no, update the configured directory or database. - Is the account entry active and correctly spelled? Remove XML comments, correct the role name, and verify the password.
- Was the configuration loaded? Restart or reload the correct Tomcat instance.
- Does Tomcat receive the request? Compare proxy and Tomcat access logs to separate proxy failures from Realm failures.
- Does a valve restrict the source address? Review
RemoteCIDRValveandRemoteHostValverules using the address Tomcat observes. - Could the browser be resending old credentials? Close the tab or clear cached BASIC credentials.
- Did the status change to 403? Authentication is now working; investigate authorization or network policy rather than passwords.
Version and change-management checks
Role names, endpoint behavior, Realm configuration syntax, and reload behavior should be verified against the Manager documentation for the installed Tomcat major version. Do not copy a configuration fragment from a different major release without checking its context and attributes. Record which $CATALINA_BASE, Realm, endpoint, account, and network policy were changed, and test the least-privileged path after every upgrade.
For a controlled fix, first reproduce the 401, make one configuration change, reload the intended instance, and test the same URL from the same network path. This preserves a clear audit trail and prevents a successful test against one Tomcat instance from being mistaken for a fix on another.
Final verification checklist
- The requested endpoint is identified and its minimum role is known.
- The account exists in the active Realm, not merely in an unused configuration file.
- The account has
manager-guifor/manager/html, or the narrower role required by another endpoint. - The user entry is active XML, the password is strong, and file permissions protect it.
- The correct Tomcat instance has reloaded the user and application configuration.
- Proxy path and
Authorizationhandling have been verified when a proxy is present. - Remote-address valves allow the actual client or proxy address.
- Old browser BASIC credentials have been discarded.
- Script and JMX privileges are separated from GUI access unless there is a documented need.
Once these checks pass, a remaining 401 is usually traceable to the Realm’s own logs or to an identity-provider policy rather than to the Manager HTML page itself. Preserve the timestamp, endpoint, username (without recording the password), source address, and Tomcat version when escalating to the team that operates the Realm.
