httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From André Warnier ...@ice-sa.com>
Subject Re: [users@httpd] Using Apache to secure Tomcat Manager App
Date Tue, 17 Jun 2008 21:15:50 GMT

Jorge Medina wrote:
> Hi, 
> 
>    I have Apache 2.2 in front of Tomcat 6 using the mod_jk module. 
>    I disabled the HTTP connector in Tomcat, therefore, all my requests
> go through Apache.
>    My Apache web server is configured to authenticate users using an
> LDAP server.
>    I would like to keep access to the Tomcat Manager application, but
> right now I am getting asked for two set of credentials when accessing
> the manager application: the first set is asked by Apache (the LDAP
> credentials) and the second time is Tomcat  (using the credentials in
> tomcat-users.xml). 
>    I would like to only be asked once for credentials, the LDAP
> credentials.
  > a)       Is there a way to disable in Tomcat 6 the security built-in
> around the manager application and let Apache manage the access to  it?
[...]

You may be able to use this :
http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html
and look at the end of the page for the "tomcatAuthentication" attribute 
of the <Connector> element (which is in Tomcat's server.xml).  If I 
understand this correctly, by explicitly setting the attribute
tomcatAuthentication="false"
, it should be so that the user-id, as already authenticated by Apache, 
should be carried over to Tomcat via the mod_jk connector.
Thus Tomcat should no longer ask for user authentication, but "believe" 
what the front-end Apache tells it.

Now, Tomcat will receive the user-id from Apache (the "authentication" 
part).  But you should still handle the "role" part in Tomcat (the 
"authorisation" part).

This is what I infer from the documentation, but I have not tried it 
yet, so could maybe a Tomcat/mod_jk/AJP expert confirm this ?


André

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message