You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by js...@cs.wayne.edu on 2005/10/14 19:11:56 UTC
secure application using Tomcat
Hello!
I am a newbie to Tomcat.
I have configured Tomcat as a standalone web server for HTTP and HTTPS.
and now I am trying to develop a secure aplication (using SSL) which will
do user authentication and perform user specific actions.
I need some help/tutorial (JAVA) which can guide me to authneticate user
using symmetric keys. For instance how to generate/exchange symmetric key
and how to authenticate user etc.
Thanks a lot in advance
Jawwad
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: secure application using Tomcat
Posted by Mark <el...@gmail.com>.
I would recommend placing Apache in front of Tomcat. You can also use
mod_security on Apache to further lock down your application. I have found
that if you want security, do not use Tomcat by itself. I never liked the
idea of placing keystore passwords in XML files. At least Apache prompts you
for a password when it starts up. As far as authenticating users based on
their key(s), you would have to enforce mutually authenticated SSL, get the
certificate and validate it against a CA inside of Tomcat. This all is
fairly easy to do.
On 10/14/05, jshamsi@cs.wayne.edu <js...@cs.wayne.edu> wrote:
>
> Hello!
> I am a newbie to Tomcat.
> I have configured Tomcat as a standalone web server for HTTP and HTTPS.
> and now I am trying to develop a secure aplication (using SSL) which will
> do user authentication and perform user specific actions.
>
> I need some help/tutorial (JAVA) which can guide me to authneticate user
> using symmetric keys. For instance how to generate/exchange symmetric key
> and how to authenticate user etc.
>
> Thanks a lot in advance
>
> Jawwad
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: secure application using Tomcat
Posted by Mark <el...@gmail.com>.
I would recommend placing Apache in front of Tomcat. You can also use
mod_security on Apache to further lock down your application. I have found
that if you want security, do not use Tomcat by itself. I never liked the
idea of placing keystore passwords in XML files. At least Apache prompts you
for a password when it starts up. As far as authenticating users based on
their key(s), you would have to enforce mutually authenticated SSL, get the
certificate and validate it against a CA inside of Tomcat. This all is
fairly easy to do.
On 10/14/05, jshamsi@cs.wayne.edu <js...@cs.wayne.edu> wrote:
>
> Hello!
> I am a newbie to Tomcat.
> I have configured Tomcat as a standalone web server for HTTP and HTTPS.
> and now I am trying to develop a secure aplication (using SSL) which will
> do user authentication and perform user specific actions.
>
> I need some help/tutorial (JAVA) which can guide me to authneticate user
> using symmetric keys. For instance how to generate/exchange symmetric key
> and how to authenticate user etc.
>
> Thanks a lot in advance
>
> Jawwad
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: secure application using Tomcat
Posted by Mark <el...@gmail.com>.
I would recommend placing Apache in front of Tomcat. You can also use
mod_security on Apache to further lock down your application. I have found
that if you want security, do not use Tomcat by itself. I never liked the
idea of placing keystore passwords in XML files. At least Apache prompts you
for a password when it starts up. As far as authenticating users based on
their key(s), you would have to enforce mutually authenticated SSL, get the
certificate and validate it against a CA inside of Tomcat. This all is
fairly easy to do.
On 10/14/05, jshamsi@cs.wayne.edu <js...@cs.wayne.edu> wrote:
>
> Hello!
> I am a newbie to Tomcat.
> I have configured Tomcat as a standalone web server for HTTP and HTTPS.
> and now I am trying to develop a secure aplication (using SSL) which will
> do user authentication and perform user specific actions.
>
> I need some help/tutorial (JAVA) which can guide me to authneticate user
> using symmetric keys. For instance how to generate/exchange symmetric key
> and how to authenticate user etc.
>
> Thanks a lot in advance
>
> Jawwad
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>