User Authorization

[John Coonrod <jc...@thp.org>]

This is another question that a lot of people have asked in the past week 
and I don't feel has been answered...

Does the tomcat webserver support user login and - if so - how exactly do I 
get it to work? I'm willing to live with the simplest possible login, but I 
want the server to require it, not each servlet or jsp.

Thanks.

----------------
Dr. John Coonrod, Vice President, jc@thp.org
The Hunger Project, 15 East 26th Street, NY, NY 10010 www.thp.org

Re: User Authorization

[Costin Manolache <co...@eng.sun.com>]

If you use Apache ( or IIS, NES ) as a web server and set up authentication
using the web server native system, the username will be forwarded to tomcat
and available.

Support for declarative security is new, we are testing the code - there is no
automatic generation of server config files or any other help - but it can be
done.

If you use tomcat standalone - it should work using the minimal
tomcat-users.xml, but again it's new code, with little testing.

Costin


John Coonrod wrote:

> This is another question that a lot of people have asked in the past week
> and I don't feel has been answered...
>
> Does the tomcat webserver support user login and - if so - how exactly do I
> get it to work? I'm willing to live with the simplest possible login, but I
> want the server to require it, not each servlet or jsp.
>
> Thanks.
>
> ----------------
> Dr. John Coonrod, Vice President, jc@thp.org
> The Hunger Project, 15 East 26th Street, NY, NY 10010 www.thp.org
>
> --------------------------------------------------------------------------
> To unsubscribe, email: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commmands, email: tomcat-user-help@jakarta.apache.org

Re: User Authorization

["Craig R. McClanahan" <Cr...@eng.sun.com>]

John Coonrod wrote:

> This is another question that a lot of people have asked in the past week
> and I don't feel has been answered...
>
> Does the tomcat webserver support user login and - if so - how exactly do I
> get it to work? I'm willing to live with the simplest possible login, but I
> want the server to require it, not each servlet or jsp.
>

Tomcat 3.0 does not support user authentication.

Tomcat 3.1beta1 (well, at least the most recent nightly builds, but I'm pretty
sure it was there in the beta) has *experimental* support for user
authentication.  What you do is set up users in the "conf/tomcat-users.xml"
file, and then define your security constraints in the web application
deployment descriptor, as described in the Servlet API Specification.  This has
not been extensively tested, and there's no further docs at this point.
Experimentation and bug reports are welcome!

Craig