You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Andreas Schildbach <an...@schildbach.de> on 2006/12/23 13:22:17 UTC
Basic Auth without modification to web.xml?
Hi everyone,
Is it possible with Tomcat to "hide" an application behind a Basic
Authentication (or something similar), without modifying the web
application itself (also not modifying web.xml)?
I am thinking about adding a Valve or something to the context.xml. The
content to be protected would just be the whole application, and there
is only one user/role needed that has access. Is there something like
this possible?
Regards,
Andreas
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Basic Auth without modification to web.xml?
Posted by Martin Gainty <mg...@hotmail.com>.
+1
with regards to implementing users in cookies you may want to look at SSO
http://tomcat.apache.org/tomcat-5.5-doc/config/host.html#Single%20Sign%20On
HTH
M-
---------------------------------------------------------------------------
This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary , confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited.
---------------------------------------------------------------------------
Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire.
----- Original Message -----
From: "Leon Rosenberg" <ro...@googlemail.com>
To: "Tomcat Users List" <us...@tomcat.apache.org>
Sent: Saturday, December 23, 2006 9:48 AM
Subject: Re: Basic Auth without modification to web.xml?
> On 12/23/06, Gregor Schneider <rc...@googlemail.com> wrote:
>> Yes, there is something similar:
>>
>> http://tomcat.apache.org/tomcat-5.5-doc/config/valve.html
>>
>> Take a look at RemoteAdressFilter and RemoteHostFilter. They grant
>> access depending on the IP / adress.
>>
>> However, you will have to write your own filter to accomplish what you
>> want. Taking a look ath the source-code of this filter might help.
>>
>> BUT:
>>
>> Since a filter can only evaluate information stored in the
>> http-request, I'm not sure if it can be done, since the user is IMHO
>> not part of the http-request.
>
> The "user" maybe not, but cookies or any kind of information stored in
> the session are.
> Leon
>
>>
>> Just take a look at the sources, maybe they give you some ideas.
>>
>> Happy holidays!
>>
>> Greg
>> --
>> what's puzzlin' you, is the nature of my game
>> gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
>> gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
>>
>> ---------------------------------------------------------------------
>> To start a new topic, e-mail: users@tomcat.apache.org
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Basic Auth without modification to web.xml?
Posted by Leon Rosenberg <ro...@googlemail.com>.
On 12/23/06, Gregor Schneider <rc...@googlemail.com> wrote:
> Yes, there is something similar:
>
> http://tomcat.apache.org/tomcat-5.5-doc/config/valve.html
>
> Take a look at RemoteAdressFilter and RemoteHostFilter. They grant
> access depending on the IP / adress.
>
> However, you will have to write your own filter to accomplish what you
> want. Taking a look ath the source-code of this filter might help.
>
> BUT:
>
> Since a filter can only evaluate information stored in the
> http-request, I'm not sure if it can be done, since the user is IMHO
> not part of the http-request.
The "user" maybe not, but cookies or any kind of information stored in
the session are.
Leon
>
> Just take a look at the sources, maybe they give you some ideas.
>
> Happy holidays!
>
> Greg
> --
> what's puzzlin' you, is the nature of my game
> gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
> gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Basic Auth without modification to web.xml?
Posted by Gregor Schneider <rc...@googlemail.com>.
Yes, there is something similar:
http://tomcat.apache.org/tomcat-5.5-doc/config/valve.html
Take a look at RemoteAdressFilter and RemoteHostFilter. They grant
access depending on the IP / adress.
However, you will have to write your own filter to accomplish what you
want. Taking a look ath the source-code of this filter might help.
BUT:
Since a filter can only evaluate information stored in the
http-request, I'm not sure if it can be done, since the user is IMHO
not part of the http-request.
Just take a look at the sources, maybe they give you some ideas.
Happy holidays!
Greg
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Basic Auth without modification to web.xml?
Posted by Andrew Miehs <an...@2sheds.de>.
Hi Andreas,
Why not just pack an Apache Httpd out front, and use access rules?
Regards,
Andrew
On 23/12/2006, at 1:22 PM, Andreas Schildbach wrote:
> Hi everyone,
>
> Is it possible with Tomcat to "hide" an application behind a Basic
> Authentication (or something similar), without modifying the web
> application itself (also not modifying web.xml)?
>
> I am thinking about adding a Valve or something to the context.xml.
> The
> content to be protected would just be the whole application, and there
> is only one user/role needed that has access. Is there something like
> this possible?
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org