It appears that starting in version 7.0.16, HexUtils.class exists in tomcat-coyote.jar instead of its previous home, catalina.jar. On page: http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html Under Common Features > Digested Passwords Current text: To use either of the above techniques, the following jar files will need to be on your class path to make the RealmBase class available: $CATALINA_HOME/bin/tomcat-juli.jar $CATALINA_HOME/lib/catalina.jar $CATALINA_HOME/lib/tomcat-util.jar Needs to be updated to also include: $CATALINA_HOME/lib/tomcat-coyote.jar
or move HexUtils into tomcat-util.jar If making any change, note, that HexUtils is referenced by SecurityClassLoad (r1144031). Apparently this was caused by removing duplicate HexUtils class in r1132702. Sorry for that.
Or use digest.sh|bat which handles this correctly. I'll update the docs to reference digest.bat|sh.
This has been fixed in 7.0.x and will be included in 7.0.20 onwards.