Set Up Tomcat Server Authentication

We support vulnerability and compliance scans for tomcat servers. Simply create a Tomcat Server record with details about your Tomcat installation and instance. The same record may include details for both Windows and Unix installations.


System created authentication records

Did you know? You can allow the system to create Tomcat Server authentication records for auto discovered instances and scan them. This is supported for Unix installations only.

Learn how to set this up >>

Which technologies are supported?


- Apache Tomcat 7.x, 8.x and 9.x


- Apache Tomcat 6.x, 7.x, 8.x and 9.x

- VMware vFabric tc Server 2.9.x

- Pivotal tc Server 3.x

How do I get started?

- Go to Scans > Authentication.

- Check that you already have a record defined for each host running a tomcat server. For Windows hosts, a Windows record is required. For Unix hosts, a Unix record is required.

- Create a Tomcat Server record for the same host (IP). Go to New > Applications > Tomcat Server.

- Before launching a vulnerability scan, pick Windows, Unix and Tomcat Server authentication in your option profile. (All authentication options are used automatically for compliance scans.)

Tell me about user permissions

Windows Installation

When the installation directory and the instance directory are the same (typically the case), enter the path to the installation directory and leave the instance directory blank. When different, you'll also need to provide the path to the instance directory.

Enter the Windows service name if you plan to run compliance scans. This is required for certain controls.

Unix Installation

You'll need to tell us where the tomcat server is installed. You may also need to tell us where the tomcat server instance(s) are installed (applies to VMware vFabric and Pivotal).

I'm using Apache Tomcat

I'm using VMware vFabric or Pivotal

I'm not sure which tomcat servers are installed