0

Currently I have got a specific problem finding a solution and I am hoping you are able to provide some light on the matter.

The Structure of the problem:

The task at hand is to gather a client's login credentials (token) and pass this to the servlet. However I cannot seem to find a good resource to do this. I have researched a wide variety of ways. I.e SPNEGO, WAFFLE etc..., However, these seem to require some sort of active directory by my understanding, I am trying to gather the credentials from the users local machine. A clear explanation or guidance to how I can gather the windows credentials to the servlet for my specific request would be appreciated.

Diagrams are always a better way of explaining so I will provide one if you are still confused:

Windows PC (Client) ------------------------> Java Servlet -------------------------------------> IIS Server

(windows authentication) --------------> (Get Credentials) -------------------- (Check Credentials & Authenticate)

                   (token)               (pass credentials)

Thank you in advanced to anyone who replies, I really appreciate it!.

1 Answer 1

0

You are wasting your time. If you only take the credentials from the users local machine then you have no way of knowing if those credentials can be trusted. You might as well just give every user administrative access to your web application.

The reason active directory (or something like it) is required is that it is not under the control of the client and is trusted by the server. For example, when using SPNEGO, the client authenticates itself to the windows domain, the client gets a token from the windows domain that it can only get if it is authenticated, the client passes the token to the server, the server can then validate that token with the Windows domain to confirm that the client is indeed who they claim to be. (Not quite that simple but you get the idea.)

There are other ways to do this - e.g. with PKI - but they all have in common a central, trusted authentication system that the server can use to validate credentials provided by the client.

1
  • Thank you very much for the explanation. I now have a clear understanding.
    – TWelch
    Oct 10, 2013 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.