Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <4A2687D4.1020609@christopherschultz.net>
Date: Wed, 03 Jun 2009 10:25:24 -0400
From: Christopher Schultz <chris@christopherschultz.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US;
 rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: Authentication from the browser
References: <34abb48b0906021022w77fa5ef2yd3b0e3d1dc7e614d@mail.gmail.com>
	 <4eedb92a0906021037h6506eeb6yf3e219929cde0266@mail.gmail.com>
 <34abb48b0906021103w7fab5541uf1f6c8123696ac0f@mail.gmail.com>
In-Reply-To: <34abb48b0906021103w7fab5541uf1f6c8123696ac0f@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alec,

On 6/2/2009 2:03 PM, Alec Swan wrote:
> Hassan, I don't think that the goals are contradictory, because each goal
> applies to its own group of users: our customer users and everybody else.
> Customer users should not have to enter user name and password, but
> everybody else should.

What authentication mechanism are you using already? FORM? BASIC?

With BASIC or DIGEST authentication, it's easy enough to put the
credentials into the request that the remote server sends to you.

If you're using FORM authentication, it's more complicated because
Tomcat's authentication /requires/
request->challenge->credentials->repeat-request. If you use
securityfilter (http://securityfilter.sourceforge.net), you can do
drive-by logins by just calling j_security_check directly (without an
initial request).

Another option (which I prefer) is to provide a service that is oriented
toward these clients which accepts credentials in a different form.
Don't use container-managed security for this service. Instead, accept
credentials in some other way. You can accept username and password, or
you could even accept a single token which is encrypted using a
pre-shared key.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkomh9QACgkQ9CaO5/Lv0PB/wwCfdVDhW0QEwL4psZmLz2ff1JM+
EwQAnjjeCbAPtHbiJBvGJV1HVpwdkl0r
=8h+o
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org