org.apache.catalina.realm.CombinedRealm should implement backgroundProcess() by calling this method on each of the Realms it manages e.g. @Override public void backgroundProcess() { for( Realm r: realms ) r.backgroundProcess(); // for Tomcat9 ;-) // realms.forEach( r -> r.backgroundProcess() ); } Without this, the backgroundProcess() of a Realm that is wrapped by CombinedRealm or LockOutRealm (which extends CombinedRealm) is not called. Aidan.
Thanks for the patch, which I modified slightly. Please let me know if you'd prefer a name other than "Aidan" for your patch credit in the changelog. Fixed in trunk in r1712617. Will be in Tomcat 9.0.0. Back-ported to Tomcat 8 branch in r1712618. Will be in Tomcat 8.0.29.
Fixed in Tomcat 7 and Tomcat 6 as well, will be in 7.0.66, 6.0.45.
Wow! - a very impressive response - keep up the good work guys! Yep, Aidan is fine for patch credit but please feel free to use your own name.
BTW, I have a simple enhancement patch for org.apache.catalina.realm.MemoryRealm that uses backgroundProcess() to reload conf/tomcat-users.xml when it's modified - would you be interested in that ?
Yes, in a new bugzulla enhancement please.