1

I am attempting to get a web application, running in Tomcat 6, to authorize a user that was authenticated by Apache.

I have configured Apache 2.4 to use Active Directory for user authentication (using a module from Centrify) and ProxyPass / ProxyPassReverse requests to Tomcat.

Now I am trying to figure out how to use those credentials in an application. Taking the Tomcat 6 manager app as an example, how do I go about changing it to recognize the authenticated user and check for a suitable role?

I'm assuming I have to change the Realm in server.xml, probably to JNDIRealm or JAASRealm, however, the documentation talks about a realm being 'a "database" or usernames and passwords.' Is that the right way to go?

I'm also assuming that I need to change login-config in web.xml, although I've no idea what values to use yet.

If someone could steer me in the right direction or suggest other avenues to explore, I would appreciate that.

BTW, I am also looking at trying to authenticate the user directly in Tomcat but was asked to look at the Apache proxy route for preference.

Improve this question

2 Answers 2

Reset to default
1

I assume you are using AJP connector.

It should be enough to set tomcatAuthentication="false" in the AJP Connector stanza and then the user principal from apache will be forwarded to tomcat6.

According to documentation, the user will be role-less, which can arise some trouble depending on the application.

tomcatAuthentication: If set to true, the authentication will be done in Tomcat. Otherwise, the authenticated principal will be propagated from the native webserver and used for authorization in Tomcat. Note that this principal will have no roles associated with it. The default value is true.

Improve this answer
4
  • I am not using AJP at the moment. I was planning to look at that once authentication and authorization works. (The main benefit of AJP seems to be performance from what I've read.)I'm not sure it will be helpful, though, since I need role based authorization. I assume that, without role information, I will still get a 403 forbidden result.
    – Sarah Phillips
    Oct 19, 2015 at 13:12
  • Your roles are at tomcat level or at application level?
    – Francesco Malvezzi
    Oct 20, 2015 at 6:34
  • The roles are currently in a database referenced through the JDBCRealm. I don't know whether that makes them tomcat or application.
    – Sarah Phillips
    Oct 20, 2015 at 10:31
  • Confirm you can't use apache2 forwarded authentication with web.xml tomcat authorization.
    – Francesco Malvezzi
    Oct 23, 2015 at 10:53
1

It's not possible to mix Tomcat role base authorization with authentication done in Apache.

Either you do all in tomcat (authentication and authorization) or -- a lot more sensible -- stage authorization in your webapp taking in account infos you find in server variables (shipped from apache to tomcat).

In the latter scenario, you skip all tomcat security part, and focus on:

  1. send env variables from apache (setenv directives, to collect for example group memberships);
  2. collect them in your webapp.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .