Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need users to authenticate in Apache HTTP for some static resources (using mod_auth_openid. I also have a Tomcat application running. How can I accept the HTTP user as the Tomcat user, so the users don't need to login twice?

Clarification: I don't want to recheck credentials on the Tomcat side, but essentially trust that the user that has been identified by Apache HTTP is correct (whatever way that authentication happened - which is the main point: handing over username/password is *not an option since there might not be a password, actually most likely there won't).

I want this to work with the Tomcat authentication system, but some pointer how it could work with a home grown authentication wouldn't harm.

share|improve this question
Do you need to ensure that they have the correct credentials in Tomcat, or essentially just 'trust' the user as Apache received and authenticated it? And do you need for this to work with Tomcat's auth mechanisms, or just with an authentication mechanism that you implement within Tomcat? – Shane Madden Oct 18 '12 at 4:37
Hi Share Just trust / Tomcat's authentication. Clarified above – stwissel Oct 18 '12 at 14:11
up vote 1 down vote accepted

According to just set the tomcatAuthentication to false to have the authorization propagated from the native webserver and used for authorization in Tomcat.

share|improve this answer
That was the missing piece: I need to use the ajp protocol instead of http. Thx – stwissel Oct 22 '12 at 8:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.