In Tomcat 9.0.13 and earlier, the following code:

package tomcat.embedded.test;

import org.apache.catalina.users.MemoryUserDatabase;

public class Main {

	public static void main(String[] args) throws Exception {
		MemoryUserDatabase database = new MemoryUserDatabase("foo");
		database.setPathname("file:///tmp/users.xml");
		database.open();
		System.out.println(database.findUser("both"));
		database.close();
	}

}

... with a standard/valid users.xml, runs without error, producing:

$ ./gradlew build run

> Task :run
User username="both", roles="tomcat,role1"
Dec. 16, 2019 10:14:01 PM org.apache.catalina.users.MemoryUserDatabase save
SEVERE: User database has been configured to be read only. Changes cannot be saved

BUILD SUCCESSFUL in 852ms

In the next version 9.0.14, the new ConfigFileLoader API is introduced.  In many parts of Tomcat this seems to be optional, but for the MemoryUserDatabase loaded from file, it is insisted-on ... failing to statically set first, the above code yields:

$ ./gradlew build run

> Task :run FAILED
Exception in thread "main" java.lang.IllegalStateException: No configuration source has been set using ConfigFileLoader.setSource.
        at org.apache.tomcat.util.file.ConfigFileLoader.getSource(ConfigFileLoader.java:40)
        at org.apache.catalina.users.MemoryUserDatabase.open(MemoryUserDatabase.java:426)
        at tomcat.embedded.test.Main.main(Main.java:10)

FAILURE: Build failed with an exception.

The above code is the minimal, trivial example to demonstrate the change, but similar code will run e.g. when a MemoryUserDatabase is loaded with naming enabled, from a resources file.

This seems like a regression, since code working in 9.0.13 no longer works in 9.0.14.  Was it intentional to make the ConfigFileLoader static set mandatory for some parts of Tomcat, or is this a bug?

This was found when revving Tomcat test version in Gretty https://github.com/gretty-gradle-plugin/gretty - an integration test starts failing due to the above problem.  In Gretty we need to decide whether we will have for forcibly adopt ConfigFileLoader for latest Tomcat (only, no good prior to 9.0.13), or whether this can be fixed in Tomcat.

Related commit https://github.com/apache/tomcat/commit/4a86837bcb25b3c3812577c63213b12209a96e1a