I need users to authenticate in Apache HTTP for some static resources (using mod_auth_openid. I also have a Tomcat application running. How can I accept the HTTP user as the Tomcat user, so the users don't need to login twice?
Clarification: I don't want to recheck credentials on the Tomcat side, but essentially trust that the user that has been identified by Apache HTTP is correct (whatever way that authentication happened - which is the main point: handing over username/password is *not an option since there might not be a password, actually most likely there won't).
I want this to work with the Tomcat authentication system, but some pointer how it could work with a home grown authentication wouldn't harm.