Propagating Security Context between Managed Servers

Question

I'm using WLS 8.1 SP2. I have one domain, two managed servers, each on a separate
hardware server. Each managed server hosts a different web application. I want
to authenticate to Web App "A" and be able to invoke Web App "B" (from "A") without
having to re-authenticate. Is this possible via configuration and, if so, how?
Thanks.

Answer 1

"K Northey" <[email protected]> wrote in message
news:[email protected]...
>
I'm using WLS 8.1 SP2. I have one domain, two managed servers, each on aseparate
hardware server. Each managed server hosts a different web application.I want
to authenticate to Web App "A" and be able to invoke Web App "B" (from"A") without
having to re-authenticate. Is this possible via configuration and, if so,how?
>
Does the following do what you want?
http://e-docs.bea.com/wls/docs81/security/thin_client.html#1039551
Multiple Web Applications, Cookies, and Authentication
By default, WebLogic Server assigns the same cookie name (JSESSIONID) to all
Web applications. When you use any type of authentication, all Web
applications that use the same cookie name use a single sign-on for
authentication. Once a user is authenticated, that authentication is valid
for requests to any Web Application that uses the same cookie name. The user
is not prompted again for authentication.
If you want to require separate authentication for a Web application, you
can specify a unique cookie name or cookie path for the Web application.
Specify the cookie name using the CookieName parameter and the cookie path
with the CookiePath parameter, defined in the WebLogic-specific deployment
descriptor weblogic.xml <session-descriptor> element. For more information,
see session-descriptor in Assembling and Configuring Web Applications.
If you want to retain the cookie name and still require independent
authentication for each Web application, you can set the cookie path
parameter (CookiePath) differently for each Web application.
As of Service Pack 1, BEA Systems added a new capability to WebLogic Server
that allows a user to securely access HTTPS resources in a session that was
initiated using HTTP, without loss of session data. To enable this new
feature, add AuthCookieEnabled="true" to the WebServer element in
config.xml:
<WebServer Name="myserver" AuthCookieEnabled="true"/> Setting
AuthCookieEnabled to true causes the WebLogic Server instance to send a new
secure cookie to the browser when authenticating via an HTTPS connection.
Once the secure cookie is set, the session is allowed to access other
security-constrained HTTPS resources only if the cookie is sent from the
browser.