Detect user logged on a computer using Java web app

Question

Hi!

I want to develop an Java application that can detect the user logged on a Window Domain. These credentials are going to be used to logging on the Java application running on Tomcat.

How can I do this? I want to know the remote user accessing my web app. This user is logged on a active directory

Thanks!

Answer 1

+1 Though question!

There is an answer to this question here (still on stack overflow) when using IIS. So I guess it is possible on a servlet container to fool the client into presenting some kind of signed token as proof of authentication. Then I guess you will need some windows magic to validate the thing.

Is there any "Integrated Windows Authentication" specification somewhere?. Did anybody implemented this? JCIFS, Samba?.

I would use tcpmon to see the interaction between the browser and a IIS if the recipe given above works. I suspect It is fairly complicated though. If there is not some crypto involved I would be very disappointed.

Tomcat has already support for LDAP authentication sources (see here). Maybe extending this and add a custom Realm implementation.

Answer 2

In general, you can hook into the local authorization service using Java Authentication and Authorization Service. That might do what you want.

That said, are you sure this is the right way to go? What do you want to accomplish? Are you looking for a single-signon solution for the webapp?

Then this: http://stackoverflow.com/questions/439120/how-to-configure-tomcat-to-use-windows-ntlm-authentication might be what you are looking for, as proposed by Steve Read in the comment above.

Answer 3

I recall using mod_ntlm for apache did the trick for me, but that was few years ago, so I don't know what had changed since.

Answer 4

Jcifs liabrary will be surely of your help. This library can be used for performing NTLM authentication.

Answer 5

This is my solution:

Put jcifs-1.2.7.jar on [TOMCAT_HOME]/common/lib directory.

Modify application's web.xml adding the followin text to section webapp:

<filter>
    <filter-name>NtlmHttpFilter</filter-name>
    <filter-class>jcifs.http.NtlmHttpFilter</filter-class>
    <init-param>
        <param-name>jcifs.http.domainController</param-name>
        <param-value>xx.xx.xx.xxx</param-value>  --> Domain Controller IP
    </init-param>
    <init-param>
        <param-name>jcifs.util.loglevel</param-name>
        <param-value>2</param-value>
    </init-param>
  </filter>
  <filter-mapping>
       <filter-name>NtlmHttpFilter</filter-name>
       <url-pattern>/*</url-pattern>
  </filter-mapping>

And the you can get the remote user using request.getRemoteUser() whithout prompt.

See you.