views:

410

answers:

1

Here is the situation I'd like to create:

  • www.blah.com/priv - protected by Apache HTTP Basic Auth, realm "foo"
  • www.blah.com/application - protected by Tomcat/Servlet HTTP Basic Auth, realm "foo"
  • User access /priv, apache requests login info, they provide and are given access
  • Same user then requests /application. Since they have authenticated to the "foo" realm in the previous step, I would like them to be let in directly.
  • If another users accesses /application without first going to /priv, Tomcat requires authentication (and then they could also later access /priv without having to re-authenticate)

Basically, I want apache and tomcat to share authentication realms and, ideally, user databases.

How could this be best achieved?

+2  A: 

Have you already tried to do this and failed? I ask because HTTP Basic authentication takes place purely by adding an HTTP header to a request; that is to say, once you're authenticated against a given realm on a given server, your browser adds an additional header to your request (e.g., "Authorization: Basic amxldmludnskZXZsaW4="), and the server acknowledges that you're authenticated because of that header. So given your example, and given some ad-hoc testing I just did, I suspect that the setup you describe will just work without any additional effort on your part.

delfuego