Re: Basic and Form Authentication

[Anthony Jay <an...@fastmail.fm>]

Thanks all for your comments, I do appreciate the expert assistance.
As I suspected I will have to split the webapp into seperate apps based
on the authentication method required.
Seems like a funny way to arrange an application but such is life.
As for cross application communication I will have to revisit our own
code to see if there are static/singleton services that can be
re-engineered and decoupled.
In terms of hacking code to fudge application access, this would be low
on my list, I would not like to alter or maintain security related code. 
Many thanks again.
(Much head scratching to continue)
Tony

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anthony,

On 11/30/2009 4:53 AM, Anthony Jay wrote:
>   Is is possible to have an application that serves content protected by
>   BASIC and FORM based auth?

As Mark points out, the servlet spec says "not in the same webapp."
Tomcat implements the servlet specification and no more, so you are out
of luck, there.

> I could deploy seperate apps for each type but I would then lose access
> to application specific information e.g. Singletons and Statics, which
> will cause big problems.

I would strongly advise you to separate your webapps: one webapp for
your XML-based API and the other for human interaction. Don't forget
that your human UI could make use of the XML API behind the scenes. This
is typically called "drinking your own Cool-Aid".

If it's possible for you to do so, you could put your shared
singleton/static classes into a shared ClassLoader. What kinds of things
are you using that you would need to share across webapps? Could those
things be converted into services that both webapps could share?

Note that an XML service whose URL contains a jsessionid parameter will
be associated with the indicated session. You could use such a URL to
avoid the FORM authentication (but getting the session id is, of course,
an issue unresolved by this).

Finally, you could go out on your own and implement your own
authentication mechanism. Securityfilter is a simple, filter-based
authentication and authorization mechanism that you could hack-up to do
this type of thing. Actually, you could use it out-of-the-box and just
use a Filter configured /in front/ of it to trick sf into trusting a
Principal configured by your Filter (which comes from the request's HTTP
AUTH data).

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAksUHsEACgkQ9CaO5/Lv0PD/jACeKCyBSKRnZtnso5EzEPROUMXO
i74An09m3QZY0GTl47KplbdCSu/NG1wr
=t+z3
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[André Warnier <aw...@ice-sa.com>]

Hi.
I got some (as yet partial) answers on this on the Apache httpd forum.
Check out this :
http://httpd.apache.org/docs/trunk/mod/mod_auth_form.html

In summary, and subject to more confirmation by the Apache developers :
A series of new Apache modules is due to appear in Apache 2.4 (the next 
"production" release version).  They include mod_session and 
mod_auth_form, which should provide a generic form-based authentication 
framework.
These modules are currently available in the "test" version of Apache 
(2.34).  I do not know yet if they are, or can be, back-ported for 
Apache 2.2.14, the current "production" version.

But all in all, it seems that this provides the as-yet missing standard 
form-based authentication framework which would be needed by the 
original poster on this thread, if he wanted to resolve his issue by 
using an httpd front-end (which he uses anyway for other purposes right 
now).

Well, at least it would be a start.  It remains to be seen in detail how 
one would set this up under Apache httpd.



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[André Warnier <aw...@ice-sa.com>]

Pid wrote:
> On 02/12/2009 17:34, Christopher Schultz wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> André,
>>
>> On 12/1/2009 6:57 AM, André Warnier wrote:
>>> Peter Crowther wrote:
>>>> 2009/12/1 Anthony Jay<an...@fastmail.fm>:
>>>>> As for cross application communication I will have to revisit our own
>>>>> code to see if there are static/singleton services that can be
>>>>> re-engineered and decoupled.
>>>>
>>>> This may be one of the few appropriate times where you may want to put
>>>> code for the singletons (and all the classes that might be referenced
>>>> by your singletons) in common/lib.  It's not an ideal solution, but it
>>>> may save you considerable effort as those classes will then be loaded
>>>> by a single classloader, rather than the per-webapp classloaders.
>>>>
>>> Or then, this may be a case where you want to explore front-ending these
>>> applications with an Apache httpd server, linked to Tomcat via an AJP
>>> connector.
>>> There is considerably more flexibility in Apache httpd regarding AAA
>>> (since for one it is not bound by the servlet spec), and once a request
>>> is authenticated, Apache and the connector will happily pass this
>>> authenticated id to Tomcat.  And you would have to change nothing to
>>> your servlet-engine side code, singletons and all.
>>
>> Yeah, the problem is that AFAICT there is no standard way to do
>> form-based authentication with Apache httpd. HTTP BASIC AUTH works
>> wonderfully, but how would one implement form-based credential
>> gathering? Is a custom module required for this, or does httpd come
>> packaged with something that would work, even if a custom form /page/
>> would have to be developed that POSTs to a special URL?
> 
> The only HTTPD module that supports form auth that I've heard of is 
> mod_auth_cookie, but it's not included with the distribution & has had, 
> I believe, varying levels of support during its life.
> 
At the last ApacheCON Europe in Amsterdam, there was I believe also talk 
about a new Apache mod_session module.  But I've never seen any mention 
of it since.
I'll ask about that too.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[Pid <pi...@pidster.com>]

On 02/12/2009 17:34, Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> André,
>
> On 12/1/2009 6:57 AM, André Warnier wrote:
>> Peter Crowther wrote:
>>> 2009/12/1 Anthony Jay<an...@fastmail.fm>:
>>>> As for cross application communication I will have to revisit our own
>>>> code to see if there are static/singleton services that can be
>>>> re-engineered and decoupled.
>>>
>>> This may be one of the few appropriate times where you may want to put
>>> code for the singletons (and all the classes that might be referenced
>>> by your singletons) in common/lib.  It's not an ideal solution, but it
>>> may save you considerable effort as those classes will then be loaded
>>> by a single classloader, rather than the per-webapp classloaders.
>>>
>> Or then, this may be a case where you want to explore front-ending these
>> applications with an Apache httpd server, linked to Tomcat via an AJP
>> connector.
>> There is considerably more flexibility in Apache httpd regarding AAA
>> (since for one it is not bound by the servlet spec), and once a request
>> is authenticated, Apache and the connector will happily pass this
>> authenticated id to Tomcat.  And you would have to change nothing to
>> your servlet-engine side code, singletons and all.
>
> Yeah, the problem is that AFAICT there is no standard way to do
> form-based authentication with Apache httpd. HTTP BASIC AUTH works
> wonderfully, but how would one implement form-based credential
> gathering? Is a custom module required for this, or does httpd come
> packaged with something that would work, even if a custom form /page/
> would have to be developed that POSTs to a special URL?

The only HTTPD module that supports form auth that I've heard of is 
mod_auth_cookie, but it's not included with the distribution & has had, 
I believe, varying levels of support during its life.


p


> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAksWpSEACgkQ9CaO5/Lv0PD+jQCgm7QDsfdi+cfwF/n4mlo1ZHus
> bO0An1qrEFK3doN0l6D4zSkRREJ33YZ8
> =vnb7
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[André Warnier <aw...@ice-sa.com>]

Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> André,
> 
> On 12/1/2009 6:57 AM, André Warnier wrote:
>> Peter Crowther wrote:
>>> 2009/12/1 Anthony Jay <an...@fastmail.fm>:
>>>> As for cross application communication I will have to revisit our own
>>>> code to see if there are static/singleton services that can be
>>>> re-engineered and decoupled.
>>> This may be one of the few appropriate times where you may want to put
>>> code for the singletons (and all the classes that might be referenced
>>> by your singletons) in common/lib.  It's not an ideal solution, but it
>>> may save you considerable effort as those classes will then be loaded
>>> by a single classloader, rather than the per-webapp classloaders.
>>>
>> Or then, this may be a case where you want to explore front-ending these
>> applications with an Apache httpd server, linked to Tomcat via an AJP
>> connector.
>> There is considerably more flexibility in Apache httpd regarding AAA
>> (since for one it is not bound by the servlet spec), and once a request
>> is authenticated, Apache and the connector will happily pass this
>> authenticated id to Tomcat.  And you would have to change nothing to
>> your servlet-engine side code, singletons and all.
> 
> Yeah, the problem is that AFAICT there is no standard way to do
> form-based authentication with Apache httpd. HTTP BASIC AUTH works
> wonderfully, but how would one implement form-based credential
> gathering? Is a custom module required for this, or does httpd come
> packaged with something that would work, even if a custom form /page/
> would have to be developed that POSTs to a special URL?

Yes, the OP already hit that wall too.
There exist a plethora of Apache/mod_perl modules that do that, 
available on CPAN, and being myself a mod_perl guy and using such 
modules all the time, I never throught it could be an issue.
But strangely enough indeed, it does not appear that there exists a 
standard Apache module, part of the standard distribution, which handles 
form-based logins.
I find that quite puzzling, and cannot quite believe this.  I will 
enquire on the Apache forum about it.





---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[Christopher Schultz <ch...@christopherschultz.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

André,

On 12/1/2009 6:57 AM, André Warnier wrote:
> Peter Crowther wrote:
>> 2009/12/1 Anthony Jay <an...@fastmail.fm>:
>>> As for cross application communication I will have to revisit our own
>>> code to see if there are static/singleton services that can be
>>> re-engineered and decoupled.
>>
>> This may be one of the few appropriate times where you may want to put
>> code for the singletons (and all the classes that might be referenced
>> by your singletons) in common/lib.  It's not an ideal solution, but it
>> may save you considerable effort as those classes will then be loaded
>> by a single classloader, rather than the per-webapp classloaders.
>>
> Or then, this may be a case where you want to explore front-ending these
> applications with an Apache httpd server, linked to Tomcat via an AJP
> connector.
> There is considerably more flexibility in Apache httpd regarding AAA
> (since for one it is not bound by the servlet spec), and once a request
> is authenticated, Apache and the connector will happily pass this
> authenticated id to Tomcat.  And you would have to change nothing to
> your servlet-engine side code, singletons and all.

Yeah, the problem is that AFAICT there is no standard way to do
form-based authentication with Apache httpd. HTTP BASIC AUTH works
wonderfully, but how would one implement form-based credential
gathering? Is a custom module required for this, or does httpd come
packaged with something that would work, even if a custom form /page/
would have to be developed that POSTs to a special URL?

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAksWpSEACgkQ9CaO5/Lv0PD+jQCgm7QDsfdi+cfwF/n4mlo1ZHus
bO0An1qrEFK3doN0l6D4zSkRREJ33YZ8
=vnb7
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[André Warnier <aw...@ice-sa.com>]

Peter Crowther wrote:
> 2009/12/1 Anthony Jay <an...@fastmail.fm>:
>> As for cross application communication I will have to revisit our own
>> code to see if there are static/singleton services that can be
>> re-engineered and decoupled.
> 
> This may be one of the few appropriate times where you may want to put
> code for the singletons (and all the classes that might be referenced
> by your singletons) in common/lib.  It's not an ideal solution, but it
> may save you considerable effort as those classes will then be loaded
> by a single classloader, rather than the per-webapp classloaders.
> 
Or then, this may be a case where you want to explore front-ending these 
applications with an Apache httpd server, linked to Tomcat via an AJP 
connector.
There is considerably more flexibility in Apache httpd regarding AAA 
(since for one it is not bound by the servlet spec), and once a request 
is authenticated, Apache and the connector will happily pass this 
authenticated id to Tomcat.  And you would have to change nothing to 
your servlet-engine side code, singletons and all.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Basic and Form Authentication

[Peter Crowther <pe...@melandra.com>]

2009/12/1 Anthony Jay <an...@fastmail.fm>:
> As for cross application communication I will have to revisit our own
> code to see if there are static/singleton services that can be
> re-engineered and decoupled.

This may be one of the few appropriate times where you may want to put
code for the singletons (and all the classes that might be referenced
by your singletons) in common/lib.  It's not an ideal solution, but it
may save you considerable effort as those classes will then be loaded
by a single classloader, rather than the per-webapp classloaders.

- Peter

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org