Is it possible to have the reverse proxy (Apache HTTP 2.2) handle authentication (HTTP Basic) and then still use the container managed security of the Java application server (GlassFish 3.1 or JBoss 7.0.2) for authorization?
I've got GlassFish doing container managed security (both authentication and authorization together) just fine using both declarative and programmatic container security with form based authentication and a custom GlassFish authentication module. I've even got this working through an Apache HTTP web server reverse proxy using mod_proxy_ajp. Now I'm just trying to find a way to offload the authentication piece to Apache while maintaining the container managed security authorization piece. Maybe there is a single-sign-on interface in the Java application server which would facilitate this (since this is like SSO - Apache requires authentication for everything behind it)?