From: markt Date: Sat, 26 Mar 2011 16:45:26 +0000 (+0000) Subject: Add some Windows authentication notes to the docs X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=c11f552222e2f16676dd09e3b18927570334f125;p=tomcat7.0 Add some Windows authentication notes to the docs git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1085764 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/webapps/docs/project.xml b/webapps/docs/project.xml index 56ea43669..42ad12b80 100644 --- a/webapps/docs/project.xml +++ b/webapps/docs/project.xml @@ -67,6 +67,9 @@ + + diff --git a/webapps/docs/windows-auth-howto.xml b/webapps/docs/windows-auth-howto.xml new file mode 100644 index 000000000..914eb05f3 --- /dev/null +++ b/webapps/docs/windows-auth-howto.xml @@ -0,0 +1,118 @@ + + + +]> + + + &project; + + + Windows Authentication How-To + + + + +
+ +
+ +
+

Integrated Windows authentication is most frequently used within intranet +environments since it requires that the server performing the authentication and +the user being authentication are part of the same domain. For the user to be +authenticated automatically, the client machine used by the user must also be +part of the domain.

+

There are several options for implementing integrated Windows authentication +with Apache Tomcat. They are: +

    +
  • Built-in Tomcat support (work in progress, not yet available).
    • +
  • Use a third party library such as Waffle.
    • +
  • Use a reverse proxy that supports Windows authentication to perform the +authentication step such as IIS or httpd.
    • +
+The configuration of each of these options is discussed in the following +sections.

+
+ +
+

TBD.

+
+ +
+ + +

Full details of this solution can be found on the + Waffle site. The edited highlights + are: +

    +
  • Drop-in solution
    • +
  • Simple configuration (no JAAS or Kerberos keytab configuration required) +
    • +
+

+ + +
+ +
+ + +

There are three steps to configuring IIS to provide Windows authentication. + They are: +

    +
  1. Configure IIS as a reverse proxy for Tomcat (see the + + IIS Web Server How-To).
    2. +
  2. Configure IIS to use Windows authentication
    3. +
  3. Configure Tomcat to use the authentication user information from IIS by + setting the tomcatAuthentication attribute on the + AJP connector to false.
    4. +
+

+ + + +

Apache httpd does not support Windows authentication out of the box but + there are a number of third-party modules that can be used. These include: +

    +
  1. mod_auth_sspi + for use on Windows platforms
    2. +
  2. mod_ntlm for non-Windows + platforms (NTLM v1 only)
    3. +
  3. + mod_auth_ntlm_winbind for non-Windows platforms (NTLM v2)
    4. +
+ There are three steps to configuring httpd to provide Windows + authentication. They are: +
    +
  1. Configure httpd as a reverse proxy for Tomcat (see the + + Apache httpd Web Server How-To).
    2. +
  2. Configure httpd to use Windows authentication
    3. +
  3. Configure Tomcat to use the authentication user information from httpd by + setting the tomcatAuthentication attribute on the + AJP connector to false.
    4. +
+

+ + +
+ + +