David
Wed Oct 12 20:29:42 CDT 2005
Read the following blog entries to understand what is going on:
http://blogs.msdn.com/david.wang/archive/2005/07/06/SSO_ISAPI_Considerations_2.aspx
SSO can only be achieved by using a uniform authentication protocol that
supports it. Either you standardize on a public standard, or you use some
proprietary implementation. To do otherwise is to sacrifice security, by
definition.
It is not clear to me what role IIS is playing in your current setup. No
standard public authentication scheme requires IIS to provide a username --
it directly comes from the user using the browser.
For example, secure authentication schemes that IIS supports, like Kerberos
(public standard), can delegate and SSO by itself when given proper
configuration. If you are passing usernames around, it sounds like you are
just using some proprietary solution that isn't exactly secure...
Believe me, authentication can happen without passing the username around,
even if you cannot fathom it right now. NTLM, Kerberos are examples of
authentication protocols that do NOT pass the username around -- it passes
hash values around.
--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"engineer" <denginere@hotmail.com> wrote in message
news:1129115917.051651.254480@g44g2000cwa.googlegroups.com...
We have a Tomcat application in which each request is routed via IIS
(isapi-redirect)
IIS populates a parameter with the
active directory account name.
This is then available in Tomcat to authenticate via a call
to Active Directory.
Without the account name I cannot see how we can authenticate.
I am hoping someone can suggest an alternative way to providing
the account name without using IIS?
I have seen 3rd party products that support single sign on such as
Vintela
but these would appear to depend on the account name being
provided in the request.