Propagation of security between appplications and servers

Question

It appears that WebLogic propagates security between applications and
domains using a cookie. So as long as all applications use the same
cookie id (JSESSIONID) then a single sign-on is enabled between
applications.
Is it correct this would apply to propagation between portal and
non-portal applications in the same clustered environment?
In a different vein, is there a way of propagating security
information between different servers or different clusters?
Say, for example, server1 (or cluster1) allows a user to sign-in and
presents a page with a link to server2 (or cluster2). We would like to
be able to propagate transparently the security information gathered
at the sign-in on server1 to the application on server2.
I'm assuming the cookie placed in the browser from server1 would not
be passed to server2. Is there a way, programmatically or otherwise,
to enable this to occur in a secure way?

Answer 1

try this...as a test..
take a simple Contact ejb (as simple as you can make it, just a name and email address). In the ejb-jar.xml set up a role, for example, user, and restrict the access to only this role for all methods.
try to access the ejb from a jsp, and you should get the login form identified in your web.xml file.
make sure that the ejb is noted in the web.xml file, also.
this should work...
no try this...identify a role in your web.xml file, (user, for example) and restrict the access to the a particular jsp which is not calling the ejb. IF you navigate to this jsp, you should get the login prompt...
this should work....
now the tough part
in your application.xml create a role with the same name, user. By doing this, you have created a global role, and connect the two together.
Now point your browser to the restricted jsp with no calls to the ejb...you should get the login, so login in.
now navigate to your jsp which is unrestricted, but calls the restricted ejb...
there should now be no login prompt.
This should work.