Version 3

    Tomcat Single Sign On


    The tomcat4.1.x single sign-on behavior has been updated to allow for propagation of the web app security context to the ejb container and other secured resources.


         Configuration: In the jbossweb-tomcat41.sar/META-INF/jboss-service.xml file,

          inside the element of any virtual hosts for which you want

          single sign-on support, add a element:


        < Valve className="org.jboss.web.tomcat.tc4.authenticator.SingleSignOn" debug="0"/ >


          The "debug" attribute specifies the detail level of debugging messages created by this component.

          By default, this is set to zero (0), which means no debug output. A value of two (2) produces

          a large amount of output, similar to DEBUG or TRACE level logging with Log4j.


         Please note the Tomcat SingleSignOn valve stores SSO keys in a map maintained in the

          local JVM; it is not shared across a cluster. This release does not deal with that limitation;

          it allows SSO between multiple webapps deployed on one server, but it isn't cluster-aware.


         Notes on mixing different authentication schemes in webapps under the same virtual host:

          There are some differences between the way this valve works and the way the standard Tomcat valve

          works in a situation where different webapps under the same virtual host use different authentication

          schemes. This is because JBoss requires that each request from the user be reauthenticated; therefore

          when each request comes in, the SingleSignOn valve needs to have available in its cache sufficient

          security information to reauthenticate the user.


          If when accessing a virtual host the user first visits a webapp that uses FORM or BASIC authentication, and then they visit another webapp that requires DIGEST, the cached username/password from the FORM/BASIC authentication will not be sufficient information to do a digest authentication, so the user will be prompted for a digest login. Once a digest login succeeds, the browser automatically sends authentication information with each request, so thereafter the user can switch between DIGEST and FORM/BASIC webapps without issue