Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: domain of lajatca@gmail.com designates
 209.85.217.10 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject
         :content-type:content-transfer-encoding;
        b=CTr30etfPRToBKMRN/RR/OoyWx7gNZHkXCFNE/s8ANIGE9Cbn+DYH/IXFe0fTK4WN8
         QNu/k1Bg3xdZa1cQV5SD027p0AEOsdOl4e8ITq3Zbr946+YAClOV9FV6bnw+JxtqtlzU
         gkK86c2HodOfoZ29WsuzFUhxTGnJ/GUnfc2Y4=
Message-ID: <48FE2EFB.2000807@gmail.com>
Date: Tue, 21 Oct 2008 15:35:23 -0400
From: Louis <lajatca@gmail.com>
User-Agent: Thunderbird 2.0.0.17 (Windows/20080914)
MIME-Version: 1.0
To: Tomcat Users <users@tomcat.apache.org>
Subject: Announce: PrincipalAuthenticator 1.0 (for NTLM Authorization behind
 IIS)
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

PrincipalAuthenticator is an implementation of a Tomcat Authenticator 
that allows transparent authorization to happen for corporate Windows users.

The JKConnector provides Tomcat the ability to sit behind an instance of 
IIS and have requests passed to it for java applications. If NTLM 
(Integrated Windows Authentication) is enabled on IIS and 
tomcatAuthentication="false" on the tomcat side AJP connector, then IIS 
will provide each request into tomcat with a Principal container the 
user's DOMAIN\USERNAME. ie: javax.security.Principal(HOME\ME). This is a 
fully authenticated credential when used in a trusted domain.

This is usefull for identifying users in java applications without 
forcing them to sign-in. Unfortunately, this short circuits the rest of 
tomcat's normal authentication sequence (where it asks the SecurityRealm 
what the user's roles are. eg: authorization).

The PrincipalAuthenticator uses the Principal supplied by IIS to make 
Tomcat ask the SecurityRealm what roles the user should have. It closes 
the JAAS loop. Once the server is configured with an appropriate source 
of permissions (SecurityRealm or LoginModule) developers can use the 
typical 'request.isUserInRole("role")' calls and declarative security to 
perform checks on users' permissions.

All an application must do to use this is declare their login-config as 
such in the web.xml (on top of whatever binding is required to their 
security config on the server)

|<login-config>
	<auth-method>PRINCIPAL</auth-method>
</login-config>


The PrincipalAuthenticator is available as either ASF or LGPL licensed code (your choice).

http://www.laj.ca/projects/PrincipalAuthenticator/
|


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org