Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Message-ID: <3A311940.DF321C6@eng.sun.com>
Date: Fri, 08 Dec 2000 09:24:16 -0800
From: "Craig R. McClanahan" <Craig.McClanahan@eng.sun.com>
MIME-Version: 1.0
To: tomcat-user@jakarta.apache.org
Subject: Re: NT authentication
References: 
 <32A27D619DB0154C963D55F14552019D175C1F@windlord.worldwidepackets.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Josh Knowles wrote:

>  Is there any way that you can set up a page to tap into NT authentication?  I
> dont know if this would be something that gets set in tomcat or if it is
> something that is non-tomcat related so I thought I would just try this
> list.Thanks,JoshJosh Knowles
> Web Developer
> World Wide Packets
> josh.knowles@worldwidepackets.com
> 509.242.9247

It would be technically feasible to accomplish this, by creating a custom Realm
implementation for Tomcat that interfaced to NT's authentication mechanisms via
native code and JNI.

However, unless you run across an SSL connection (or on an Intranet that is not
exposed to the outside world), doing so would be a pretty incredible security
risk, because the username and password are communicated across the network in
an unencrypted form when you use BASIC or FORM-BASED authentication in your web
application.

Craig McClanahan