Can IIS perform SSO for Java webapp?

Hi,

I've got a Java web application that is running on Tomcat and supports
Single Sign-On (SSO) by detecting a specific HTTP header with the
authenticated user id (e.g., SSO_USER: bsmith). On IIS, I've installed the
ISAPI_Redirect.dll filter to connect IIS to Tomcat so the user can execute
the Java web app through IIS.

I configured IIS V6.0 on Windows Server 2003 to enable "Integrated Windows
authentication" and disable "Anonymous access", and I've configured my IE web
browser with the "Automatic logon with current username and password" setting
in the User Authentication Security Settings section.

The integrated Windows authentication is working well from IE to IIS, but my
Java webapp is not detecting the authenticated user and I don't know how to
configure IIS to pass the user's login id as an HTTP header to the Java
webapp. Can this behavior be configured in IIS natively, or even with a
third-party utility?

One HTTP header I noticed while monitoring the HTTP exchanges between the
browser and Tomcat server was the following:
authorization = Negotiate <long string>

I'm assuming that the <long string> text (which appears to be base64
encoded, e.g., TIRMTVNTUAADAAA.....) would contain the authentication
information of the current user, but may also be encrypted or be in a
specific format that my Java webapp does not understand.

Thanks,
Daniel

PS I've also got a Firefox web browser to be able to authenticate to the
IIS server by configuring it's "network.negotiate-auth.trusted-uris"
preference.

Integrated Windows Auth is NTLM does not support multi-hop authentication -
meaning that authenticating with the front-end will not proxy authentication
down stream. Basic Authentication will make the IIS server the
authenticated user (Basic Auth requires a log-in local permission) which can
be handled by a form-based login or a pop-up and passed downstream. This is
why OWA has a login screen.


Pat


"Daniel Borlean" <Daniel Borlean RemoveThis @discussions.microsoft.com> wrote in message
news:0C4BD7AE-4657-4F75-B6EF-2DABB32641B8@microsoft.com...
> Hi,
>
> I've got a Java web application that is running on Tomcat and supports
> Single Sign-On (SSO) by detecting a specific HTTP header with the
> authenticated user id (e.g., SSO_USER: bsmith). On IIS, I've installed
> the
> ISAPI_Redirect.dll filter to connect IIS to Tomcat so the user can execute
> the Java web app through IIS.
>
> I configured IIS V6.0 on Windows Server 2003 to enable "Integrated Windows
> authentication" and disable "Anonymous access", and I've configured my IE
> web
> browser with the "Automatic logon with current username and password"
> setting
> in the User Authentication Security Settings section.
>
> The integrated Windows authentication is working well from IE to IIS, but
> my
> Java webapp is not detecting the authenticated user and I don't know how
> to
> configure IIS to pass the user's login id as an HTTP header to the Java
> webapp. Can this behavior be configured in IIS natively, or even with a
> third-party utility?
>
> One HTTP header I noticed while monitoring the HTTP exchanges between the
> browser and Tomcat server was the following:
> authorization = Negotiate <long string>
>
> I'm assuming that the <long string> text (which appears to be base64
> encoded, e.g., TIRMTVNTUAADAAA.....) would contain the authentication
> information of the current user, but may also be encrypted or be in a
> specific format that my Java webapp does not understand.
>
> Thanks,
> Daniel
>
> PS I've also got a Firefox web browser to be able to authenticate to the
> IIS server by configuring it's "network.negotiate-auth.trusted-uris"
> preference.