Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of alecswan@gmail.com designates
 209.85.221.111 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=PoLQZ6sYH06byPqG+BB4hUf1GiA8uqF6OIKre1tcDu/m5R01JvVLSjl7p0mDqq+Xw/
         uiOqEFdONM6a72MW5oJQOAIWQo9H8JGkWpsGG2fAByUfh9ubBo074Hi5DVl4Rlee/UrY
         opJigDOzdFYCGm8JjQTDJ9+3OK2t09xMlGXDw=
MIME-Version: 1.0
In-Reply-To: <4eedb92a0906021122k66e023amd99cd2841cbd25d3@mail.gmail.com>
References: <34abb48b0906021022w77fa5ef2yd3b0e3d1dc7e614d@mail.gmail.com>
	 <4eedb92a0906021037h6506eeb6yf3e219929cde0266@mail.gmail.com>
	 <34abb48b0906021103w7fab5541uf1f6c8123696ac0f@mail.gmail.com>
	 <4eedb92a0906021122k66e023amd99cd2841cbd25d3@mail.gmail.com>
Date: Tue, 2 Jun 2009 14:01:53 -0600
Message-ID: <34abb48b0906021301r2ee0964fjd5da3b50992e1027@mail.gmail.com>
Subject: Re: Authentication from the browser
From: Alec Swan <alecswan@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=001e680f0bcc9ac45d046b6303cf

--001e680f0bcc9ac45d046b6303cf
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

I may not be explaining it clearly.

We have one corporate customer who is putting a link to our servlet on their
intranet web page. Therefore, we know the domain name of the users who need
custom authentication. We can also tell the customer to put whatever we need
in the link, such as HTTP headers.

Does this give you enough information to propose a solution?


On Tue, Jun 2, 2009 at 12:22 PM, Hassan Schroeder <
hassan.schroeder@gmail.com> wrote:

> On Tue, Jun 2, 2009 at 11:03 AM, Alec Swan <alecswan@gmail.com> wrote:
> > Hassan, I don't think that the goals are contradictory, because each goal
> > applies to its own group of users: our customer users and everybody else.
> > Customer users should not have to enter user name and password, but
> > everybody else should.
>
> IOW, you want it protected, and you want it openly accessable.
> Sorry, that sounds contradictory to me :-)
>
> If you have "a customer who would like to put a link on a web page"
> to your servlet, that servlet's URL is now "in the wild" -- anyone who
> finds it can access it.
>
> > I am glad that you made me think about this, because maybe it is possible
> to
> > extend Tomcat authentication to also use client IP address or domain?
>
> How would you know a priori the IP or domain of the clients?
>
> --
> Hassan Schroeder ------------------------ hassan.schroeder@gmail.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

--001e680f0bcc9ac45d046b6303cf--