For user authentication, the PAS for OpenEdge comes configured for use with Tomcat MemoryRealm. The MemoryRealm accesses user authentication information stored in instance-name/conf/tomcat-users.xml. You should replace the MemoryRealm with a different type of realm such as JDBC or LDAP in a production instance. You can have multiple realms of different types configured at the same time.

PAS for OpenEdge retains the roles defined in the default Tomcat MemoryRealm, but PAS for OpenEdge also includes a new set of roles that include the Tomcat roles. The following table lists the new roles and what existing Tomcat roles they map to, if any:

Table 1. PAS for OpenEdge roles mapped to Tomcat roles
PAS for OpenEdge role Includes Tomcat Manager and Host Manager roles Description
ROLE_PSCAdmin

admin-gui

admin-script

manager-gui

manager-script

manager-jmx

manager-status

 Unrestricted administration access.
  • The Tomcat admin roles allow access to the HTML GUI and text interfaces of the Host Manager application
  • The manager roles allow access to the HTML GUI, text interface, JMX proxy, and status pages of the Manager application.
ROLE_PSCOper

admin-script

manager-script

manager-status

 Restricted operator administration access. The Tomcat roles allow access to the text interfaces of the Host Manager and Manager applications as well as the status pages in the Manager application.
ROLE_PSCUser

none

 Non-priviliged access
ROLE_PSCNone

none

 No access, for user account authorization testing
Note: If you use a realm(s) other than the default MemoryRealm, that realm must have the roles listed in the table above.

PAS for OpenEdge comes with three default test accounts configured in instance-name/conf/tomcat-users.xml, as described in the following table:

Table 2. PAS for OpenEdge default user accounts
Username Password Role(s)
tomcat

tomcat

 ROLE_PSCAdmin, ROLE_PSCOper, ROLE_PSCUser
Note: Replace the ROLE_PSCUser in production.
tcuser1

tcuser

 ROLE_PSCUser
Note: Remove the ROLE_PSCUser in production.
tcuser2

tcuser

 ROLE_PSCNone
Note: Remove the ROLE_PSCNone in production.
The format for users entries in instance-name/conf/tomcat-users.xml is shown in the following example:
<user username="tomcat" password="tomcat" 
   roles="ROLE_PSCAdmin,ROLE_PSCOper,ROLE_PSCUser"/>
Note: The default username and password should be changed or removed in a production instance.