Tomcat Authentication and integrated JBoss/Tomcat

[panelspace]

Sorry for such a basic question, but can you use "normal" Tomcat authentication in exactly the same way in the integrated JBoss/Tomcat configuration ?
I had thought that JAAS was for EJB security ?
Thanks very much in advance.
John

[petertje]

I don't know about "normal Tomcat authentication", but if you mean whether you can use standard web authentication, the short answer is yes. The long answer is that you need to add a jboss-web.xml file to your war that contains the following lines:
<jboss-web>
<security-domain>java:/jaas/your-domain</security-domain>
</jboss-web>
and 'your-domain' should be setup in the login-config.xml file in the jboss/server/default/conf directory. See that file for many examples. The name of the application policy should be 'your-domain' of course.

Hth
Peter

[tassilo]

I guess you want to know wether editing the same tomcat files is sufficient. The answer is no. The tomcat-users.xml for the MemoryRealm does not apply anymore. Instead use the UserRolesLoginModule and add a security domain as described by petertje.

[panelspace]

Thanks very much.

So those the only additional things that are required compared to when doing web authentication using JDBC realms with standalone Tomcat ?

Also what is the application policy ?

Regards
Paul

[panelspace]

I want to authenticate using jdbc realms.
What is UserRolesLoginModule, is it part of JAAS ?
Thanks very much.
Cheers

[petertje]

Paul,
I suggest you read the QuickStart guide. It is downloadable from sourceforge (and it's free). I think it contains good explanation on this subject.
UsersRolesLoginModule is a Jaas compliant login module from JBoss.
If you view the login-config.xml file, as i suggested before, you'll find out pretty quick what a application policy is.

Cheers,
Peter.

[pm]

Thanks