Tomcat Standard Security Realms

Tomcat comes out of the box with the following security realms, i.e. modules that does Authentication and Authorization.

Name	CIS Tomcat 8 Benchmark Note *
JDBCRealm	NOT for Production
DataSourceRealm
JNDIRealm (LDAP)
UserDatabaseRealm	NOT for Large-Scale Installations
MemoryRealm	NOT for Production
JAASRealm	NOT widely used and therefore the code is not as mature as the other realms.

*) CIS_Apache_Tomcat_8_Benchmark_v1.0.1.pdf

This leaves us with only two production ready realms: DataSourceRealm and JNDIRealm (LDAP)

There are two other Realms (CombinedRealm and LockOutRealm), but they do not do authentication and authorization.