Servlet creates LoginContext, should be used by Web-Containe

[dumbledore]

Hi,

javas.security.auth.login.LoginContext lc;
AppCallbackHandler ach; // just like in Scott's Jaas-Tutorial...

ach = new AppCallbackHandler(composedUserName, password.toCharArray());

lc = new LoginContext("plebs", ach);

lc.login();

This code works well in a servlet. The login-context (last line) contains data for the principal and its roles. Is it possible to let the web-container further on use these principal-data to authenticate the user? I don't think so, because I can't give the login-context or principals to the web-container. Or am I wrong?

[starksm64]

This is not supported as it cannot be made to work in general. With CLIENT-CERT authentication that requires authentication at both the SSL transport level and the web container level, how are we going to push back the client cert neccessary? The problem with web authentication is that in general its the browser/user agent that has to provide the security context via http headers.

[dumbledore]

Thanks Scott!