Tomcat Single Sign On


The tomcat4.1.x single sign-on behavior has been updated to allow for propagation of the web app security context to the ejb container and other secured resources.


     Configuration: In the jbossweb-tomcat41.sar/META-INF/jboss-service.xml file,

      inside the element of any virtual hosts for which you want

      single sign-on support, add a element:


    < Valve className="org.jboss.web.tomcat.tc4.authenticator.SingleSignOn" debug="0"/ >


      The "debug" attribute specifies the detail level of debugging messages created by this component.

      By default, this is set to zero (0), which means no debug output. A value of two (2) produces

      a large amount of output, similar to DEBUG or TRACE level logging with Log4j.


     Please note the Tomcat SingleSignOn valve stores SSO keys in a map maintained in the

      local JVM; it is not shared across a cluster. This release does not deal with that limitation;

      it allows SSO between multiple webapps deployed on one server, but it isn't cluster-aware.


     Notes on mixing different authentication schemes in webapps under the same virtual host:

      There are some differences between the way this valve works and the way the standard Tomcat valve

      works in a situation where different webapps under the same virtual host use different authentication

      schemes. This is because JBoss requires that each request from the user be reauthenticated; therefore

      when each request comes in, the SingleSignOn valve needs to have available in its cache sufficient

      security information to reauthenticate the user.


      If when accessing a virtual host the user first visits a webapp that uses FORM or BASIC authentication, and then they visit another webapp that requires DIGEST, the cached username/password from the FORM/BASIC authentication will not be sufficient information to do a digest authentication, so the user will be prompted for a digest login. Once a digest login succeeds, the browser automatically sends authentication information with each request, so thereafter the user can switch between DIGEST and FORM/BASIC webapps without issue