Possible to have two login configs in same web app?

Question

Sorry for not having tried this first, my server and webapp are in a state
of flux at this moment, but I wanted to see what the consensus is out there,
not just whether I can or cannot make something work quickly.
If I have two types of things that might be called in my Web App (WAR) in
different ways (eg, browser accessing via HTTP by users that want to login
via pretty forms, and SOAP clients that may access functionality through the
same servlets (but with alternate Servlet Path Info after the servlet name
in the URL)), is there ANY way I can have multiple login configs, each tied
to a different security constraint within that web app?
In other words, with a servlet of /frazzleblitz and security constraints
like:
<security-constraint>
<web-resource-collection>
<web-resource-name>Foo</web-resource-name>
<url-pattern>/frazzleblitz/doFooBar</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>FoobarBrowserUsers</role-name>
</auth-constraint>
</security-constraint>
and the SOAP constraint (for all users of incoming SOAP requests):
<security-constraint>
<web-resource-collection>
<web-resource-name>Foo</web-resource-name>
<url-pattern>/frazzleblitz/doFooBar</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>FoobarBrowserUsers</role-name>
</auth-constraint>
</security-constraint>
where my frazzleblitz controller knows whether the incoming request is
browser vs SOAP based by the path info after the servlet name
Can I associate the first security constraint with a FORM based login
config, and the second security constraint with a BASIC AUTH login config
since I could in theory require SOAP clients to send in credentials in a
HTTP BasicAuth header, but I can't expect a SOAP client to be HTTP
Redirected to a login form and then to enter the right credentials into a
user type form and then be redirected back to an app...
Seems to me the J2EE Security spec is really lacking in the area of
programmatic authentication (allowing my SOAP code to get credentials out of
the request envelope and call an API to login myself). Yeah, WebLogic has
the ServletAuthentication weak() API, but these apps need to be J2EE
compliant and work across J2EE servers... Anybody know of any improvements
coming in the J2EE security space to address such functionality needs?
Thanks in advance
Mike

Answer 1

Sorry, hit send accidentally before finishing the second security
constraint - I've fixed it up below to reflect what I meant...
"Mike" <[email protected]> wrote in message
news:[email protected]...
Sorry for not having tried this first, my server and webapp are in a state
of flux at this moment, but I wanted to see what the consensus is outthere,
not just whether I can or cannot make something work quickly.
If I have two types of things that might be called in my Web App (WAR) in
different ways (eg, browser accessing via HTTP by users that want to login
via pretty forms, and SOAP clients that may access functionality throughthe
same servlets (but with alternate Servlet Path Info after the servlet name
in the URL)), is there ANY way I can have multiple login configs, eachtied
to a different security constraint within that web app?
In other words, with a servlet of /frazzleblitz and security constraints
like:
<security-constraint>
<web-resource-collection>
<web-resource-name>Foo</web-resource-name>
<url-pattern>/frazzleblitz/doFooBar</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>FoobarBrowserUsers</role-name>
</auth-constraint>
</security-constraint>
and the SOAP constraint (for all users of incoming SOAP requests):
<security-constraint>
<web-resource-collection>
<web-resource-name>Bar</web-resource-name>
<url-pattern>/frazzleblitz/doSOAPRequest</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>SOAPUsers</role-name>
</auth-constraint>
</security-constraint>
where my frazzleblitz controller knows whether the incoming request is
browser vs SOAP based by the path info after the servlet name
Can I associate the first security constraint with a FORM based login
config, and the second security constraint with a BASIC AUTH login config
since I could in theory require SOAP clients to send in credentials in a
HTTP BasicAuth header, but I can't expect a SOAP client to be HTTP
Redirected to a login form and then to enter the right credentials into a
user type form and then be redirected back to an app...
Seems to me the J2EE Security spec is really lacking in the area of
programmatic authentication (allowing my SOAP code to get credentials outof
the request envelope and call an API to login myself). Yeah, WebLogic has
the ServletAuthentication weak() API, but these apps need to be J2EE
compliant and work across J2EE servers... Anybody know of anyimprovements
coming in the J2EE security space to address such functionality needs?
Thanks in advance
Mike