tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From <>
Subject RE: Do any of the Tomcat LDAP-type realms support "no password" authentication?
Date Thu, 01 Jan 1970 00:00:00 GMT

---- "Caldarale wrote: 
> > From: [] 
> > Subject: Re: Do any of the Tomcat LDAP-type realms support "no password" authentication?
> > In other words, even though my valve code can assert a user 
> > into Tomcat, and even if that same user already exists in the
> > Tomcat realm, the asserted user seems to be 'disassociated'
> > from the same user in the Tomcat realm?  
> Need to get some terminology correct here.  A Realm does not normally contain users,
roles, or any other authentication or authorization _data_; rather, it is a Java class that
embodies rules for examining the credentials supplied by a login attempt and comparing them
to credentials and roles stored in some external location.  By default (and never meant to
be used in production), the external location is the file tomcat-users.xml, and the Realm
is UserDatabaseRealm (augmented by LockOutRealm to discourage probing).  Several other Realm
classes are supplied with Tomcat, to allow access to credentials from LDAP servers, relational
databases, JAAS, etc.
> I think what you need is essentially a Realm that does no authentication of its own (trusting
httpd to do that), but does perform the authorization function.  It can then map the userid
to whatever set of roles are appropriate for that user, and return the appropriate response
when queried.  See the doc for details:
> It would seem likely that someone out there has written a Realm that performs the above
functions in conjunction with httpd authentication.  (Note: you keep using the word "Apache"
- which is a software organization with many products - when you're referring to httpd, a
specific Apache product, as is Tomcat.)
>  - Chuck

Hi Chuck,

Corrections understood, and I'll try to be more careful.  As you point out, and as I mentioned
earlier in the thread, it seems like I've come all the way around to the original subject
"...Tomcat LDAP-type realms support "no password" authentication?".

I've been and still am looking around for something like that, but haven't found it yet.

I'm still puzzled by something though.  Even if I did find (or implement) a realm that was
a "no password realm", how do I tie the two pieces that I end up with, the valve and the no-password
realm, together?

In other words, I can pull the userID from the incoming header in the valve, but then I think
that the valve code then needs to authenticate against the no-password realm.  Is that correct?

And, if so, how to do that?  

I've been looking for a way (API?) to programmatically "authenticate the user" against Tomcat,
so that I could add that into my valve code, but haven't been find anything yet.


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message