Confidential Login

[Simon Funnell <si...@propositum.biz>]

Hi,

I have not been able to implement the following so I was wondering if it 
was possible or would I need a custom Realm/Authenticator implementation?

I have some content that is restricted by role but not over a secure 
connection, however, if a user tries to access the content and is 
presented with the credentials/authentication form the form is also not 
over a secure connection and it needs to be.

I tried applying a confidential transport security restraint on just the 
form but this seems to be bypassed when the form is actually used in a 
context without the transport constraint.

I am thinking that some sort of redirect will be required instead to 
make the transition from non-secure to secure (for authentication) and 
back to non-secure.

Will tomcat do this out of the box or will I need a need a 
custom/additional authentication package?

Regards,

Simon



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

RE: Confidential Login

["Caldarale, Charles R" <Ch...@unisys.com>]

> From: Simon Funnell [mailto:simon.funnell@propositum.biz] 
> Subject: Confidential Login

> I have some content that is restricted by role but not over
> a secure connection, however, if a user tries to access the
> content and is presented with the credentials/authentication
> form the form is also not over a secure connection and it
> needs to be.

Let's think about this.  You want the authentication dialog to be encrypted, but not any subsequent traffic that uses the token that results from the authentication.  If the subsequent traffic isn't encrypted, anyone with access to the traffic can hijack the session by using the token - you have no security.  Is that really what you want?

The general rule is that once you start with encryption, you stay with it for anything dependent on the authentication.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org