migrate a TOMCAT web project to WAS, authentication problem

[Former Member]

Now there's a migration task from TOMCAT to SAP WAS, no EJB stuff, all under J2EE specs except the connection between form-based authentication and database.

A Realm is a "database" of usernames and passwords that identify valid users of a web application (or set of web applications), plus an enumeration of the list of roles associated with each valid user.

In many cases, it is desireable to "connect" a servlet container to some existing authentication database or mechanism that already exists in the production environment.

In Tomcat, you can configure Realm in server.xml to enable this function with its own implementation, a <Realm> element and an implementation of org.apache.catalina.realm.Realm which is an interface.

I would like to know how's this situation realized in SAP WAS enviroment, a pluggable login modules or something else

[Former Member]

Hello William,

I need to do the same thing as you have done.

I have an J2EE application running under Tomcat and using realm authentication defined in server.xml of Tomcat.

Do you manage to integrate this in the SAP WAS ?

How do you replace/adapt the 'TOMCAT' authentication ?

Thanks,

Fabien

[Rudi_Held]

Hi William,

the user/group-to-role mapping can be done at runtime on the server using the policy configurations mentioned above.

To define these mappings at design time have a look at the dtd of web-j2ee-engine.xml. This should correspond to the feature in Tomcat.

Bye,

Rudi

[Rudi_Held]

Hi William,

have a look at the documentation about login modules in SAP NetWeaver.

It describes how to create and integrate your own login module. There's a example login module as well.

In addition have a look at how to configure login module stacks and policy configurations for an application on SAP Web AS.

http://help.sap.com/saphelp_nw04/helpdata/en/46/3ce9402f3f8031e10000000a1550b0/frameset.htm

http://help.sap.com/saphelp_nw04/helpdata/en/8c/f03541c6afd92be10000000a1550b0/frameset.htm

Hope that helps,

best regards,

Rudi

[Former Member]

Hi Rudi,

Thank you for you concern.

Now I know clearer about the pluggable login model, that means the login model you defined just do this thing, whether the given user is valid or not, the authority action is not included in the login model. Then on J2EE engine, there should be a place to maintain the mapping of a user to a role, the autority action happens on J2EE engine after the login successful, right?

This is different from the manner of TOMCAT, in a Realm you have to provide the mapping table(user-role)

Have you ever worked on this kind of stuff, now I would like to know if my thought is right and if it is where can I get more reference about how to maintain such user-role mapping on J2EE engine.

Thank you again.

Yours sincerely

William