Zhiyong Li

Tomcat is a widely popular lightweight application server. When securing Tomcat web applications, Valve, JAAS and Filter are used in various scenarios. The challenges for developers are when to use each of these methods and how to integrate them together if more than one method is chosen. For example, the WebSeal agent discussed in the article [1] uses Valve. If a customer needs to integrate WebSeal and its own JAAS-based authentication module, they will need to know how to configure Tomcat to use both the WebSeal Agent Valve and the JAAS module and how to pass information between them. In this article, we will explain the concepts of Valve, JAAS and Filter, and their relationships such as the order that they get called. Through an example application, we will explain how you can use them together and pass information among them for an authentication process. How t... (more)

IWA for a Spring Desktop and Web Application

Integrated Windows Authentication (IWA) provides a user-friendly interface for single sign-on. IWA uses ‘Simple and Protected GSSAPI Negotiation Mechanism' (SPNEGO) to allow the initiators and acceptors to negotiate the underlying protocol to be used for authentication. In this article, we will discuss how to enable SPENGO to support single sign-on for a two-tier web based application using the popular Spring framework. Even though we only focus on a two-tier application, there are multiple places in these two tiers that SPNEGO needs to be enabled. At the client side, we need th... (more)