Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Content-return: allowed
Date: Thu, 13 Feb 2003 17:01:22 +0000
From: "Whitley, Michael T." <Michael.Whitley@WCOM.Com>
Subject: SimpleRealm and digested passwords in Tomcat 3.3
To: 'Tomcat Users List' <tomcat-user@jakarta.apache.org>
Message-id: <6EFD2D8565069542A1029F2D17B54625DA50@ripexch001.wcomnet.com>
MIME-version: 1.0
Content-type: text/plain; charset=iso-8859-1

>From the Tomcat 3.3 readme under "6.2 Container Managed Security" it says:

	"DIGEST authentication ... [is] not supported in this release."

	http://jakarta.apache.org/tomcat/tomcat-3.3-doc/readme

I am assuming this means digest authentication is not supported for
SimpleRealms in 3.3 as the documentation clearly states that it is supported
for JDBCRealms in 3.3. My question is this:

Why is it not supported? The Class necessary to encrypt passwords is in 3.3
() and if I place digested passwords in my tomcat-users.xml file and place
digest="MD5" as an attribute of the SimpleRealm tag the SimpleRealm class is
able to translate the digested password. 

So if it works in 3.3 why is it not supported or documented? 
Was it put in, but just not tested in this release?
For reasons I will not detail, I can not move to 4.0 yet, and I want to use
this feature. Other than the fact that the developers say it shouldn't be
used, why can't I? I guess I am trying to find out if the feature buggy in
3.3 or if it was ready before the 4.0 release and put in but not announced
until the 4.0 release for logistics reasons.

Any insight would be greatly appreciated.

Thanks,
Michael Whitley

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org