tomcat realm with database logins - tomcat9

Question

Summary:
How would you validate a tomcat user providing the database(!) login credentials?
Details:
One thing I don't understand with tomcat is the realm config in combination with a relational database. It is clear what the JDBCRealm implementation does: Login to the database with a technical user, read the users table to find the login/password combination and these are the allowed logins. So the database has one technical user and a table.
But for a pure database frontend, the login should be validated by the database login mechanisms. In other words, the user provides the database username/password, then a new jdbc connection with this provided information is created and if successful, the provided login data is obviously correct. No technical database user, no table with a list of users.
Before I write that from scratch, is there something I overlooked? Does such a thing exist already?
Thanks in advance!
PS: Of course there are many cases where the database is just used as a directory of data. In my case I use the tomcat as frontend for a database application, with database users, database row level security, database permissions, database stored procedures, database...everything.
PPS: The follow up question will be connection pooling per-user. I have seen some hints on how to do that but any early input is greatly appreciated.

Answer 1

A few questions still but a REALM it is:
public class DBRealm extends RealmBase {
private static final Log log = LogFactory.getLog(DBRealm.class);
private String DBjdbcurl;
private Map<String, DBPrincipal> userdirectory = new HashMap<>();
public DBRealm() {
}
#Override
public DBPrincipal authenticate(String username, String credentials) {
log.info("Authenticating user \"" + username +
"\" with database \"" + DBjdbcurl + "\"");
try {
DBPrincipal principal = new DBPrincipal(username, credentials, DBjdbcurl);
// this does throw a SQLException in case the login data is invalid
userdirectory.put(username, principal);
return principal;
} catch (SQLException e) {
log.error("failed to login with the provided credentials for \"" +
username + "\" with database \"" + DBjdbcurl +
"\" and exception " + e.getMessage());
return null;
}
}
#Override
protected String getPassword(String username) {
return null;
// Do not expose the password. What is the side effect of that with md5 digest???
}
#Override
protected DBPrincipal getPrincipal(String username) {
return userdirectory.get(username);
}
/*
* Properties
*/
public String getDBJDBCURL() {
return DBjdbcurl;
}
public void setDBJDBCURL(String DBjdbcurl) {
this.DBjdbcurl = DBjdbcurl;
}
}