Performing Usermapping towards Basic Authentication Sites (e.g. SLD or DTR)

Hi,
I want to create a role for our maintenance people for checkin misc stuff, and some of the iviews will point to our SLD and NWDI servers. Currently they, require Basic Authentication and I'd like to have usermapping here (not SSO / Loginticket). I've had problems with this before, and was wondering if anyone would like to give a detailed list of how to perform this? The example using DTR and SLD could (I think) relate to any other site using basic authentication.
What I've done so far is (for DTR iview)
- define a URL iview (with fields "AUTH_USER" and "AUTH_PASSWORD" as Mapped User and Mapped Password types respectively)
- created a HTTP system with reference to the 2 fields in the iview, authenticationlink (http:///dtr) and authtype "basic authentication".
- usermapping is maintained in a group where I'm a member
Can anyone give me a general list of things to do to perform usermapping towards basic authentication sites?
Please help! Points will be awarded!
Regards,
Hans Petter Bjørn

Hello Hans,
i think you have to write your own abstract portal component to achieve this. Pls see this weblog
Accessing a web page protected by BASIC authentication
kind regards
Andreas

Similar Messages

  • PROXY BASIC AUTHENTICATION

    Hello.
    I'm facing problem during client connection throungth proxy.
    The error messagge is:
    java.io.IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 302 Moved Temporarily"
         at sun.net.www.protocol.http.HttpURLConnection.doTunneling(HttpURLConnection.java:923)
         at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(DashoA6275)
         at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:615)
         at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(DashoA6275)
         at updateAuto.getInputStream(updateAuto.java:494)
         at updateAuto.downloadFile(updateAuto.java:422)
         at updateAuto.start(updateAuto.java:263)
         at Avvio.main(Avvio.java:8)
    The question is: how i set the basic authentication? I found two example:
    URL url= new URL(fileName);
    URLConnection connection= url.openConnection();
    connection.setRequestProperty("Proxy-Authorization","Basic " + new sun.misc.BASE64Encoder().encode(proxyUser + ":" + proxyPassword).getBytes()));
    URL url= new URL(fileName);
    URLConnection connection= url.openConnection();
    connection.setRequestProperty("Proxy-Authorization", new sun.misc.BASE64Encoder().encode(proxyUser + ":" + proxyPassword).getBytes()));
    So, i MUST specify the Basic before the user-password or not?
    I'm in the rigth direction or i miss something?
    Best regards
    Gianluca Chiodaroli

    I was also struggled to get this thing done for long time and finally mangaged to got through. Following code would demonstrate how you could connect to a https url through a proxy sever. You have to replace your proxy server, port, userid/password and your https URL in the appropriate places.
    Also follow the instructions given in the java comments blocks to download the deigital certifactes of your https sites and configure them in the filestores.
    I have tested this code with JDK 1.4
    Good luck. Dushan Karawita
    import com.sun.net.ssl.*;
    import javax.commerce.util.BASE64Encoder;
    import java.net.*;
    import java.io.*;
    import java.util.*;
    * Title: HttpsPrototye
    * Description: This will demonstrate how to connect to a https url through
    * a proxy server. It is very difficult to find a proper documentation
    * describing how to implement this feature.
    * @auther : Dushan Karawita ([email protected])
    public class HttpsPrototype {     
         * Performs the proxy tunneling to access the https url.
        public static void testHttps() {
            HttpsURLConnection httpsCon = null;
            DataInputStream dis = null;
            InputStream is = null;
            String response = null;
            String cookieString = null;
            URL sslUrl = null;
            try {
                 * Sets the https proxy server and the https proxy port.
                 * @todo: Replace the <proxy.server.com> with your proxy server's
                 * IP address and replace with the correct port.
                System.setProperty("https.proxyHost", "<proxy.server.com>");
                System.setProperty("https.proxyPort", "80");
                 * Add the route to your cacerts filestore (or a filestore of
                 * your choice) you'll find ca certs at java_home$/jre/lib/security
                 * Seems that if you dont add this java will not always find the
                 * certificate required for to trust the SSL connection.
                 * Note if you still get a CertificateException "could not find
                 * trusted certificate" then you will need to import the public
                 * certificate of the website you are connecting  to into the
                 * keystore using,
              keytool -import -keystore cacerts -file thecert.cer -alias thecertname
                 * This command will add the "thecert.cer" file to the "cacerts"
                 * filestore (if not available, it will create it). Make sure you go
                 * to the place where you want to place the filestore (cacerts) and
                 * run the command since it will create it in the location it's been
                 * run. You can use IE to download the certificate and save it in the
                 * hard disk with following steps.
                 * Tools -> Internet Options -> Content -> Certificates
                 * -> Immediate Certification Autherities
                 * and select the certificate from the list and select "Export" and
                 * follow the wizard to install it into the local hard drive. If the
                 * relavent certificate is not available in the list, try to import
                 * the certificate by clicking on the padlock sign of the IE when
                 * you go into the secure link.
                 * Following is the example of how to import the certificate in your
                 * filestore.
                 * try the password as "changeit"
       E:\jdk1.4.1\jre\lib\security>keytool -import -keystore cacerts -file doit.cer
                 * Enter keystore password:  changeit
                 * Owner: CN=*.doit.com, OU=Domain Control Validated, OU=See
                 * www.ffffssl.com/cps (c)04, OU=https://services.my-choicepoint.net
                 * /getit.jsp?126600646, O=*.doit.com, C=NL
                 * Issuer: CN=ChainedSSL CA, O=FreeSSL, C=US
                 * Serial number: 2899e49
                 * Valid from: Thu Jan 29 15:14:20 GST 2004 until: Sat Jan 29
                 * 15:14:20 GST 2005
                 * Certificate fingerprints:
                 * MD5:  44:C5:AC:10:4A:34:6E:19:0D:3A:8A:32:B5:4F:A3:C4
                 * SHA1: DA:D8:11:74:B6:BA:EB:D9:98:F2:12:AF:E9:4C:73:0B:4B:FA:1D:CF
                 * Trust this certificate? [no]:  y
                 * Certificate was added to keystore
                 * E:\jdk1.4.1\jre\lib\security>
                 * You have to set the filestore where you have imported your site's
                 * certificates. Here we're setting the defualt jdk filestore since
                 * we have imported the ncessary certificates into the same filestore.
                 * You can give different filestore if you have created your
                 * filestore in a different place.
                System.setProperty("javax.net.ssl.trustStore",
                        "E:/jdk1.4.1/jre/lib/security/cacerts");
                 * Before connecting with a secure URL, we must do this first :
                java.security.Security.addProvider(
                        new com.sun.net.ssl.internal.ssl.Provider());
                System.setProperty("java.protocol.handler.pkgs",
                        "com.sun.net.ssl.internal.www.protocol");
                 * The https URL which you want to access.
                 * If you are using the JDK defualt filestore, it is a good idea to
                 * test with the https://www.sun.com url
                 * @todo: Replace your https url.
                sslUrl = new URL("https://www.sun.com");
                 * Opens the https URL connection.
                httpsCon = (HttpsURLConnection) sslUrl.openConnection();
                httpsCon.setFollowRedirects(true);
                 * Set the Proxy user id and password for the basic proxy
                 * authorization.
                 * @todo: Replace the <user:password> with your proxy user id and
                 * the password.
                httpsCon.setRequestProperty("Proxy-Authorization", "Basic "
                        + new BASE64Encoder()
                        .encodeBuffer("<user:password>".getBytes()));
                 * Sets the normal authorization if the site itself is required to be
                 * authenticated before access.
                 * @todo: Replace the <user:password> with your sites user id and
                 * the password.
                httpsCon.setRequestProperty("Authorization", "Basic "
                        + new BASE64Encoder().encodeBuffer("<user:password>"
                        .getBytes()));
                 * Reads the coockie from the header field, so we can bind this
                 * coockie with the next request header if we want to maintain our
                 * session so we would be able to traverse through multiple pages
                 * with the same session.
                cookieString = httpsCon.getHeaderField("Set-Cookie");
                cookieString = cookieString.substring(0, cookieString.indexOf(";"));
                System.out.println(cookieString);
                 * get the input stream and creates a DataInputStream.
                is = httpsCon.getInputStream();
                dis = new DataInputStream(new BufferedInputStream(is));           
                 * Reads the input stream through the DataInputStream and print the
                 * response line by line.
                while ((response = dis.readLine()) != null) {
                    System.out.println(response);
                dis.close();
                is.close();
                httpsCon.disconnect();
            } catch (MalformedURLException mfue) {
                mfue.printStackTrace();
            } catch (IOException ioe) {
                ioe.printStackTrace();
         * main method to test the code.
         * @param args
        public static void main(String args[]) {
            new HttpsPrototype().testHttps();
    }

  • Forms based authentication + Basic authentication = no way to use the basic auth!!!!

    Hi,
    I setup a test sharepoint site, claims mode, with both the forms and basic authentication  enabled.
    I expect to see the page asking me which authentication method I want to use, but I never see this page!!!
    I have to select the windows authentication (NTLM or Kerberos) to see this page!
    why using only the Basic authentication did not prompt the user?
    and how to be authenticated using the basic authentication rather than the forms auth when both are enable for the same site?
    >I do NOT want to extend my site to have 2 zones... my question is ONLY with 1 zone configured.

    What is the business purpose for using Basic Auth over NTLM/Kerberos?
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Ignoring Http basic authentication header in wls 7.0.sp2 web service servlet (weblogic.webservice.server.servlet.WebServiceServlet)

    Hi!
    We need to implement authentication using our own methods, and the authentication
    information is provided to the web service implementation in a basic authentication
    header. The problem is, that the servlet
    weblogic.webservice.server.servlet.WebServiceServlet, which handles web services
    in
    wls 7.0.sp2, always attempts to perform authentication, if the header is present.
    Is there any way to circumvent this, because we want to implement authentication
    on our own?
    I already know two workarounds:
    The best would of course be to implement a custom security realm for our own
    authentication system. This is not an option, implementing an own security
    realm is overkill for this specific web service.
    The other way would be to route the requests by way of a custom servlet, which
    would
    remove the basic authentication header, and put the authentication info in custom
    headers, such as x-auth: <user:password>, or smthng similar, and after successful
    authentication, make a call to bea's servlet weblogic.webservice.server.servlet.WebServiceServlet.
    But still, I'd like to know if there is any way to tell bea's servlet to ignore
    the basic
    authentication header?
    Oh yeah, by the way, this is URGENT, as always. (really!! ;)
    Toni Nykanen

    Currently there is no option to turn off security check.
    I think you can use a servlet filter mapped to the URL
    of your service, instead of a proxy servlet?
    Regards,
    -manoj
    http://manojc.com
    "Toni Nykanen" <[email protected]> wrote in message
    news:3ef1577b$[email protected]..
    >
    Hi!
    We need to implement authentication using our own methods, and theauthentication
    information is provided to the web service implementation in a basicauthentication
    header. The problem is, that the servlet
    weblogic.webservice.server.servlet.WebServiceServlet, which handles webservices
    in
    wls 7.0.sp2, always attempts to perform authentication, if the header ispresent.
    Is there any way to circumvent this, because we want to implementauthentication
    on our own?
    I already know two workarounds:
    The best would of course be to implement a custom security realm for ourown
    authentication system. This is not an option, implementing an own security
    realm is overkill for this specific web service.
    The other way would be to route the requests by way of a custom servlet,which
    would
    remove the basic authentication header, and put the authentication info incustom
    headers, such as x-auth: <user:password>, or smthng similar, and aftersuccessful
    authentication, make a call to bea's servletweblogic.webservice.server.servlet.WebServiceServlet.
    >
    But still, I'd like to know if there is any way to tell bea's servlet toignore
    the basic
    authentication header?
    Oh yeah, by the way, this is URGENT, as always. (really!! ;)
    Toni Nykanen

  • How do I get around a limitation of Basic Authentication

    Dear all,
    your input on the following problem would be appreciated:
    We have encountered a problem with both the "logout" and "timeout" functionality used in eCRM, due to the use of basic authentication.
    Following a users logout and/or timeout period expiring, we are invalidating the user's session, so any user info will be removed from the server memory, and if the user attempts to access the site again there will be a security challenge.
    But since basic authentication is being used and the browser already has your authentication information, it just sends it again transparently.
    Whether users will notice will depend on how many windows they have open, and which browser they're using.
    For example, in IE 5, if you open the secure site in a browser window, and close that window (using the close button on the logout confirmation page), it will "forget" the authentication information. But if I open other windows while connected to the secure site, it remembers the authentication info. Even if the users don't notice, there is a security issue associated with this behaviour.......
    Any thoughts/ideas on getting around this problem (other than the obvious - not using basic authentication!!)
    Regards,
    Chris Adianto

    Chris Adianto wrote:
    Dear all,
    your input on the following problem would be appreciated:
    We have encountered a problem with both the "logout" and "timeout" functionality used in eCRM, due to the use of basic authentication.
    Following a users logout and/or timeout period expiring, we are invalidating the user's session, so any user info will be removed from the server memory, and if the user attempts to access the site again there will be a security challenge.
    But since basic authentication is being used and the browser already has your authentication information, it just sends it again transparently.
    Whether users will notice will depend on how many windows they have open, and which browser they're using.
    For example, in IE 5, if you open the secure site in a browser window, and close that window (using the close button on the logout confirmation page), it will "forget" the authentication information. But if I open other windows while connected to the secure site, it remembers the authentication info. Even if the users don't notice, there is a security issue associated with this behaviour.......
    Any thoughts/ideas on getting around this problem (other than the obvious - not using basic authentication!!)Send HttpServletResponse.SC_UNAUTHORIZED (401) in the response header: http://www.tapsellferrier.co.uk/Servlets/FAQ/authentication.html has more info.
    Cheers,
    Alex

  • Basic authentication in client on WLS

    Hello all,
    I've been breaking my head over an issue with a webgui that I am creating with Java servlets involving a web service.
    I am accessing this service using JAX-WS, but the issue is that the service requires basic authentication on both the WSDL and the methods. There are many resources online describing how you can solve this using a default authenticator and using Sun's http handler, but I cannot get it working on Weblogic Server 10.3.6.0.
    If I create a unit test in my project with the mentioned solutions applied it runs like a charm, but as soon as I deploy it to WLS I get 401 unauthorized messages.
    A small example:
    Authenticator.setDefault(new Authenticator() {
         @Override
         protected PasswordAuthentication getPasswordAuthentication() {
         return new PasswordAuthentication(
              "username",
              "password".toCharArray());
    URL url = new URL(null, "http://myhost:5301/myservice?wsdl", new sun.net.www.protocol.http.Handler());
    QName qname = new QName("http://myhost", "myservice", XMLConstants.DEFAULT_NS_PREFIX);
    MyService service = new MyService(url, qname);
    The 401 is thrown at the last line (creation of the service), which does not yet make an actual call. Most other solutions mention to add the username and password to the requestcontext, but that is only applicable after you create the service-object and get a port from it.
    Does anybody have any idea?
    Regards,
    Ramon
    Edited by: Ramon on 7-jun-2013 11:44

    Hi Danish,
    Basic authentication is supported on Exchange 2013, you can use the following cmdlet to set it.
    Set-OutlookAnywhere -Identity "servername\Rpc (Default Web Site)" -InternalClientAuthenticationMethod Basic
    What's more, it is recommended to set the IISAuthenticationMethods to: {Basic, Ntlm, Negotiate}.
    For your reference:
    Set-OutlookAnywhere
    https://technet.microsoft.com/en-us/library/bb123545(v=exchg.150).aspx
    Hope this can be helpful to you.
    Best regards,
    Amy Wang
    TechNet Community Support

  • Fiori Launchpad - Basic authentication popup

    Hi,
    I have used the std. class /UI2/CL_SRA_LOGIN for Fiori launchpad log in screen. When there is no user action for long time and the session cookie gets expired; any operation performed(like selecting an app) in this case is bringing a browser basic authentication popup.
    How to avoid this by either taking the user to initial login screen instead of the authentication popup ?
    Tags edited by: Michael Appleby

    Hi Aakash,
    Please upload the screenshot. Is it critical issue or just a nice to have?
    From end user point of view, I prefer popup because I can continue the work from the last point. The best is IT sets up SSO.
    Regards, Masa
    SAP Customer Experience Group - CEG

  • [Solved] Username case sensitivity when logging in via BASIC authentication

    Hi,
    Quick question... where the web.xml file defines BASIC authentication for an app, can a change be made somewhere to make the username case INsensitive ?
    .. such that passwords remain case sensitive but usernames can be upper/lower regardless of how they are stored (in the database in this case, via DBTableOraDataSourceLoginModule).
    I was thinking I could add an upper(supplied_username) function wrapper somewhere before the supplied username / stored username are compared.. what class/file would I need to edit to try that solution?
    If not possible.. would form authentication be a better option for case insensitivity, and if so would it be difficult to hookup a custom login form to the DBTableOraDataSourceLoginModule instead of the BASIC login window ?
    Thanks..

    Hi,
    by default all username and password is cases sensitive - no matter how the logon is performed. The DBTableOraDataSourceLoginModule provides an option to handle passwords case insensitive (as explained in the documentation !)
    http://download-uk.oracle.com/docs/cd/B32110_01/web.1013/b28957/loginmod.htm#BABHDJAH
    casing
    =====     
    The case-sensitivity when comparing login user names to names in the database. Use sensitive to require case-sensitive comparisons, toupper to convert the login user name to all-uppercase, or tolower to convert the login user name to all-lowercase. (If anything other than these three values is specified, the default value will be used.)
    Default: sensitive
    Example: toupper
    Frank

  • Basic Authentication and Signout

    Hi All
     I am trying to isolate a problem where signout doesn;t display signout page in browser and again logs in user to site in browser.
    I have Basic authentication enabled and  default domain is set.
    when I use WIndows auth NTLMS signout page works fine.

    Did you close the browser in between log out/log in to destroy the cookie?
    Trevor Seward, MCC
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Basic authentication when calling a web service

    I am attempting to call a web service using ActionScript. The
    web service provider requires that I use HTTP Basic Authentication
    to communicate my SOAP requests. I cannot seem to get this done in
    ActionScript. If I instantiate a WebService object and call its
    SetCredentials method, I get an error "Authentication not supported
    on DirectHTTPChannel (no proxy)". I have the WebService object's
    useProxy property set to true. HELP!

    I know this is five years later on this forum but there's no solution here or on any other forum.  So after two day's of hammering this out I was able to produce a workable solution.  Create a new user account for testing.
    Wu_Xiao's explanation of the issue was dead on.  The WebService does a GET then a POST and for the GET we are unable to supply the Authorization in the header and this is why we get the popup. The POST has the Authorization but it already to late. 
    Take these actions
    1 Create a new user on the machine with the web services. Start with a simple name and password (text only)  I had issues with different users. Start clean and simple.
    2 Copy your web services a second usable service.  You'll see in my example below i have Ive copied  ServicesSECURE/Services1.asmx?WSDL to ServicesDEFINITION/Services1.asmx?WSDL
    3 Remove all of the code inside of your services making the new set of service like a definition service. Make sure all of the inputs and outputs are the same. ServicesDEFINITION will have no coding and empty returns.
    Example  
    [WebMethod]
            public String CountUsers(string group)
                return "";
    4 Implement the code below. Call the init() right away to instantiate the web service and wait until it loads to use any of the services.  I use a button event to test.
    private var testws:WebService = new WebService;
      private function init():void
      testws.wsdl="http://test.com/ServicesDEFINITION/Services1.asmx?WSDL";
      var encoder:Base64Encoder= new Base64Encoder();
      encoder.insertNewLines = false; // see below for why you need to do this
      encoder.encode("USERNAME:PASSWORD");
      testws.httpHeaders = {Authorization:" Basic " + encoder.toString()};
      testws.loadWSDL();
      testws.addEventListener("load", wsdlLoadHandler);
      protected function test_clickHandler(event:MouseEvent):void
      testws["CountUsers"].addEventListener(mx.rpc.events.FaultEvent.FAULT,testFaultHandler);
      testws["CountUsers"].addEventListener(mx.rpc.events.ResultEvent.RESULT,testResultHandler) ;
      testws.endpointURI="http://test.com/ServicesSECURE/Services1.asmx?WSDL";
      testws.getOperation("CountUsers").send("Test");
      protected function wsdlLoadHandler (event:LoadEvent) : void
      //the service has to load before using the getOperation function
      //you could try using mx.core.UIComponent.callLater from
      //this listener and call the gettestws.getOperation("Co....
    So you'll see that the ServicesDEFINITION (GET) is called and grabs the definition of the Service1 service but this unsecured services is useless because we've removed all of the code.  After the definition GET is called we can change the end point using endpointURI and perform the POST against our secure ServicesSECURE.

  • Basic Authentication in Exchange 2013

    Dear All,
    I am facing issue regarding basic authentication in exchange 2013 I run all the command and from Server setting I set the outlook anywhere on Basic Authentication but when I configure outlook client after successfully run the wizard the setting
    of outlook in Exchange proxy setting its show NTLM. I run all the below commands and done with the srver setting but outlook will configured only on NTLM. Externally and Internally both are same through autodiscover.
    Set-OutlookAnywhere -Identity: "servername\rpc (Default Web Site)" -ExternalClientAuthenticationMethod Basic
    Set-OutlookAnywhere -Identity "servername\rpc (Default Web Site)" -SSLOffloading $false
    Set-OutlookAnywhere -Identity "servername\rpc (Default Web Site)" -IISAuthenticationMethods Basic
    Set-OutlookAnywhere -Identity "servername\rpc (Default Web Site)" -IISAuthenticationMethods Basic,NTLM
    I just need to confrim that there is no more Basic Authentication support in Exchange 2013 or is there any work around ?
    Danish Khan DK

    Hi Danish,
    Basic authentication is supported on Exchange 2013, you can use the following cmdlet to set it.
    Set-OutlookAnywhere -Identity "servername\Rpc (Default Web Site)" -InternalClientAuthenticationMethod Basic
    What's more, it is recommended to set the IISAuthenticationMethods to: {Basic, Ntlm, Negotiate}.
    For your reference:
    Set-OutlookAnywhere
    https://technet.microsoft.com/en-us/library/bb123545(v=exchg.150).aspx
    Hope this can be helpful to you.
    Best regards,
    Amy Wang
    TechNet Community Support

  • Safari 6.0.1 cannot load video or audio that requires basic authentication

    When I browse to a URL for a .mp3 requiring basic authentication (username and password), the player does not load it.  An unprotected .mp3 on the same site loads and plays fine.  When inspecting the page containing the player, I see an HTML5 <video> element with the correct source URL and MIME type.  When I do the Bad Thing (TM) of putting the username and password into the URL, as in http://username:password@site... , the src URL in the <video> element contains the username and password, but the audio file still fails to load.
    This is occurring on the latest update of Safari and Mountain Lion on a Macbook Pro.
    Is there some workaround for this problem, besides using Chrome, which works fine on these audio URLs?

    I've seen reports of this problem going all the way back to Safari version 5.0.5 and it's still present in 6.0.4. How is this not fixed by now? Does anyone have a workaround that doesn't require putting the video in an unprotected directory?
    -Terry

  • API Call For Basic Authentication

    Hi,
    Does anyone know whats the API call that WebLogic makes internally to
    perform basic authentication. Is ServletAuthentication the only way to
    programmatically log in a user.
    Thanks
    Sameer

    If the target node for your operation is a sibling, I believe you're going to have to pass the parent node of the sibling into the AddNode() API call when this operation occurs within a version. Note that copyNodesAcrossVersions is a new method that has a copyAsSibling parameter, but AddNode() does not.
    Edited by: Naren Truelove on Nov 12, 2012 3:12 PM
    ...grammatical correction...

  • Pleeeaaseeee Help - Basic authentication with Servlet

    All,
    A user from my site is allowed to access another site that requires Basic Authentication(apache). This is what I have done in my servlet, but does not work:
    String userpwd = "username:pwd";
    response.setHeader("Authorization", "Basic " + userpwd);
    response.sendRedirect("http://155......." + "username=" + userID);
    Both IE and netscape browsers still prompt for username and pwd window. Is this correct???
    --Kawthar                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

    I'm assuming that you are attempting to bypass the sign-on prompt from the other site. What you will have to do is access the other site from within your servlet and foward the content to the user. In other words, you would be setting your servlet(s) up as a proxy. This can become rather complex as you may run into the need to handle cookies and such from your servlet. Another alternative, if you can modify the remote site, is to set up the other site to accept some sort of keyword or password that your servlet can include in the URL string which would bypass the initial signon.

  • (JAAS) Getting LoginContext when using BASIC authentication

    I am using basic authentication in JAAS to authenticate users for JSF web resources. My web.xml is configured as follows:
    <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>eccgroup</realm-name>
    </login-config>
    How can I get hold of the LoginContext that (I assume) was created in order to logout?
    The Principal is available on the HTTPRequest but I cannot find where the LoginContext is stored?

    As far as I know, vendors are not required to rely on a JAAS LoginContext to perform BASIC auth. Different vendor implementations may do different things. So you may have to rely on a programmatic logout API, but I'm not personally aware of any standard API for this.

Maybe you are looking for