Running Tomcat for/as different users

Hello,

I've got a question about Tomcat/Apache integration:

On my host, there are different virtual hosts, each serving as a different
user (User and Group directive) so that every vhost runs cgi and php scripts
(with the help of suPHP) as a dedicated user. It works fine.

Is there a possibility to do the same with Tomcat? I did not succeed, so
far.

Some information about the software being used:
- SuSE 8.2
- JDK 1.4.1
- Tomcat 4.1.18
- Apache 1.3.x

Thanks in advance!


Carsten

Carsten Heesch <mail@cheesch.de> wrote:
> each serving as a different user (User and Group directive)
> Is there a possibility to do the same with Tomcat?

Since you can deploy new applications while the system is
running the first answer should be No, you can't. Besides, in the
user documentation of TomCat there is no trace of a similar
user/group directive. If you find something different, please
let us know.

Davide

So - as a workaround - the only possibility would be to start multiple
tomcat instances, one for each vhost as a different user?

That would lead to a great overhead and a possibly even to a bigger
performance loss.


Carsten


(PS: sorry for my bad English)

Carsten Heesch <mail@cheesch.de> wrote:
> So - as a workaround - the only possibility would be to start multiple
> tomcat instances, one for each vhost as a different user?

Hu... that's a possibility, but isn't a little an overkill? Like
shooting a mouse with a ICBM? And you have to run each different
instance on a different port, making things waaaaaay difficult to
handle.

Davide

> Hu... that's a possibility, but isn't a little an overkill?

It is. But for security reasons, I don't want to run tomcat as the typical
httpd-user (wwwrun, apache or whatever). Users should have access to the
filesystem like they do using cgi or php. But only their virtual hosts'
directories should be accessible.
Is there any other way to fulfil this requirement?


Carsten

Carsten Heesch <mail@cheesch.de> wrote:
> Is there any other way to fulfil this requirement?

No that I know about.
Davide

>> Is there any other way to fulfil this requirement?
> No that I know about.

What a pitty!

Thanks,
Carsten