Details | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 771 | blopes | 1 | <!DOCTYPE html SYSTEM "about:legacy-compat"> |
| 2 | <html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.112) - Windows Authentication How-To</title></head><body><div id="wrapper"><header><div id="header"><div><div><div class="logo noPrint"><a href="https://tomcat.apache.org/"><img alt="Tomcat Home" src="./images/tomcat.png"></a></div><div style="height: 1px;"></div><div class="asfLogo noPrint"><a href="https://www.apache.org/" target="_blank"><img src="./images/asf-logo.svg" alt="The Apache Software Foundation" style="width: 266px; height: 83px;"></a></div><h1>Apache Tomcat 9</h1><div class="versionInfo"> |
||
| 3 | Version 9.0.112, |
||
| 4 | <time datetime="2025-11-06">Nov 6 2025</time></div><div style="height: 1px;"></div><div style="clear: left;"></div></div></div></div></header><div id="middle"><div><div id="mainLeft" class="noprint"><div><nav><div><h2>Links</h2><ul><li><a href="index.html">Docs Home</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ">FAQ</a></li></ul></div><div><h2>User Guide</h2><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="host-manager-howto.html">6) Host Manager</a></li><li><a href="realm-howto.html">7) Realms and AAA</a></li><li><a href="security-manager-howto.html">8) Security Manager</a></li><li><a href="jndi-resources-howto.html">9) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">10) JDBC DataSources</a></li><li><a href="class-loader-howto.html">11) Classloading</a></li><li><a href="jasper-howto.html">12) JSPs</a></li><li><a href="ssl-howto.html">13) SSL/TLS</a></li><li><a href="ssi-howto.html">14) SSI</a></li><li><a href="cgi-howto.html">15) CGI</a></li><li><a href="proxy-howto.html">16) Proxy Support</a></li><li><a href="mbeans-descriptors-howto.html">17) MBeans Descriptors</a></li><li><a href="default-servlet.html">18) Default Servlet</a></li><li><a href="cluster-howto.html">19) Clustering</a></li><li><a href="balancer-howto.html">20) Load Balancer</a></li><li><a href="connectors.html">21) Connectors</a></li><li><a href="monitoring.html">22) Monitoring and Management</a></li><li><a href="logging.html">23) Logging</a></li><li><a href="apr.html">24) APR/Native</a></li><li><a href="virtual-hosting-howto.html">25) Virtual Hosting</a></li><li><a href="aio.html">26) Advanced IO</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li><li><a href="rewrite.html">33) Rewrite</a></li><li><a href="cdi.html">34) CDI 2 and JAX-RS</a></li><li><a href="graal.html">35) AOT/GraalVM Support</a></li></ul></div><div><h2>Reference</h2><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet 4.0 Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.3 Javadocs</a></li><li><a href="elapi/index.html">EL 3.0 Javadocs</a></li><li><a href="websocketapi/index.html">WebSocket 1.1 Javadocs</a></li><li><a href="jaspicapi/index.html">JASPIC 1.1 Javadocs</a></li><li><a href="annotationapi/index.html">Common Annotations 1.3 Javadocs</a></li><li><a href="https://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul></div><div><h2>Apache Tomcat Development</h2><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/Tomcat+Versions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></div></nav></div></div><div id="mainRight"><div id="content"><h2>Windows Authentication How-To</h2><h3 id="Table_of_Contents">Table of Contents</h3><div class="text"> |
||
| 5 | <ul><li><a href="#Overview">Overview</a></li><li><a href="#Built-in_Tomcat_support">Built-in Tomcat support</a><ol><li><a href="#Domain_Controller">Domain Controller</a></li><li><a href="#Tomcat_instance_(Windows_server)">Tomcat instance (Windows server)</a></li><li><a href="#Tomcat_instance_(Linux_server)">Tomcat instance (Linux server)</a></li><li><a href="#Web_application">Web application</a></li><li><a href="#Client">Client</a></li><li><a href="#References">References</a></li></ol></li><li><a href="#Third_party_libraries">Third party libraries</a><ol><li><a href="#Waffle">Waffle</a></li><li><a href="#Spring_Security_-_Kerberos_Extension">Spring Security - Kerberos Extension</a></li><li><a href="#Jespa">Jespa</a></li><li><a href="#SPNEGO_AD_project_at_SourceForge">SPNEGO AD project at SourceForge</a></li></ol></li><li><a href="#Reverse_proxies">Reverse proxies</a><ol><li><a href="#Microsoft_IIS">Microsoft IIS</a></li><li><a href="#Apache_httpd">Apache httpd</a></li></ol></li></ul> |
||
| 6 | </div><h3 id="Overview">Overview</h3><div class="text"> |
||
| 7 | <p>Integrated Windows authentication is most frequently used within intranet |
||
| 8 | environments since it requires that the server performing the authentication and |
||
| 9 | the user being authenticated are part of the same domain. For the user to be |
||
| 10 | authenticated automatically, the client machine used by the user must also be |
||
| 11 | part of the domain.</p> |
||
| 12 | <p>There are several options for implementing integrated Windows authentication |
||
| 13 | with Apache Tomcat. They are:</p> |
||
| 14 | <ul> |
||
| 15 | <li>Built-in Tomcat support.</li> |
||
| 16 | <li>Use a third party library such as Waffle.</li> |
||
| 17 | <li>Use a reverse proxy that supports Windows authentication to perform the |
||
| 18 | authentication step such as IIS or httpd.</li> |
||
| 19 | </ul> |
||
| 20 | <p>The configuration of each of these options is discussed in the following |
||
| 21 | sections.</p> |
||
| 22 | </div><h3 id="Built-in_Tomcat_support">Built-in Tomcat support</h3><div class="text"> |
||
| 23 | <p>Kerberos (the basis for integrated Windows authentication) requires careful |
||
| 24 | configuration. If the steps in this guide are followed exactly, then a working |
||
| 25 | configuration will result. It is important that the steps below are followed |
||
| 26 | exactly. There is very little scope for flexibility in the configuration. From |
||
| 27 | the testing to date it is known that:</p> |
||
| 28 | <ul> |
||
| 29 | <li>The host name used to access the Tomcat server must match the host name in |
||
| 30 | the SPN exactly else authentication will fail. A checksum error may be reported |
||
| 31 | in the debug logs in this case.</li> |
||
| 32 | <li>The client must be of the view that the server is part of the local trusted |
||
| 33 | intranet.</li> |
||
| 34 | <li>The SPN must be HTTP/<hostname> and it must be exactly the same in all |
||
| 35 | the places it is used.</li> |
||
| 36 | <li>The port number must not be included in the SPN.</li> |
||
| 37 | <li>No more than one SPN may be mapped to a domain user.</li> |
||
| 38 | <li>Tomcat must run as the domain account with which the SPN has been associated |
||
| 39 | or as domain admin. It is <strong>NOT</strong> recommended to run Tomcat under a |
||
| 40 | domain admin user.</li> |
||
| 41 | <li>Convention is that the domain name (<code>dev.local</code>) is always used in |
||
| 42 | lower case. The domain name is typically not case sensitive.</li> |
||
| 43 | <li>Convention is that the Kerberos realm name (<code>DEV.LOCAL</code>) is always |
||
| 44 | used in upper case. The realm name <strong>is</strong> case sensitive.</li> |
||
| 45 | <li>The domain must be specified when using the ktpass command.</li> |
||
| 46 | </ul> |
||
| 47 | <p>There are four components to the configuration of the built-in Tomcat |
||
| 48 | support for Windows authentication. The domain controller, the server hosting |
||
| 49 | Tomcat, the web application wishing to use Windows authentication and the client |
||
| 50 | machine. The following sections describe the configuration required for each |
||
| 51 | component.</p> |
||
| 52 | <p>The names of the three machines used in the configuration examples below are |
||
| 53 | win-dc01.dev.local (the domain controller), win-tc01.dev.local (the Tomcat |
||
| 54 | instance) and win-pc01.dev.local (client). All are members of the |
||
| 55 | <code>dev.local</code> domain.</p> |
||
| 56 | <p>Note: In order to use the passwords in the steps below, the domain password |
||
| 57 | policy had to be relaxed. This is not recommended for production environments. |
||
| 58 | </p> |
||
| 59 | |||
| 60 | <div class="subsection"><h4 id="Domain_Controller">Domain Controller</h4><div class="text"> |
||
| 61 | <p>These steps assume that the server has already been configured to act as a |
||
| 62 | domain controller. Configuration of a Windows server as a domain controller is |
||
| 63 | outside the scope of this how-to. The steps to configure the domain controller |
||
| 64 | to enable Tomcat to support Windows authentication are as follows: |
||
| 65 | </p> |
||
| 66 | <ul> |
||
| 67 | <li>Create a domain user that will be mapped to the service name used by the |
||
| 68 | Tomcat server. In this how-to, this user is called <code>tc01</code> and has a |
||
| 69 | password of <code>tc01pass</code>.</li> |
||
| 70 | <li>Map the service principal name (SPN) to the user account. SPNs take the |
||
| 71 | form <code> |
||
| 72 | <service class>/<host>:<port>/<service name></code>. |
||
| 73 | The SPN used in this how-to is <code>HTTP/win-tc01.dev.local</code>. To |
||
| 74 | map the user to the SPN, run the following: |
||
| 75 | <div class="codeBox"><pre><code>setspn -A HTTP/win-tc01.dev.local tc01</code></pre></div> |
||
| 76 | </li> |
||
| 77 | <li>Generate the keytab file that the Tomcat server will use to authenticate |
||
| 78 | itself to the domain controller. This file contains the Tomcat private key for |
||
| 79 | the service provider account and should be protected accordingly. To generate |
||
| 80 | the file, run the following command (all on a single line): |
||
| 81 | <div class="codeBox"><pre><code>ktpass /out c:\tomcat.keytab /mapuser tc01@DEV.LOCAL |
||
| 82 | /princ HTTP/win-tc01.dev.local@DEV.LOCAL |
||
| 83 | /pass tc01pass /kvno 0</code></pre></div></li> |
||
| 84 | <li>Create a domain user to be used on the client. In this how-to the domain |
||
| 85 | user is <code>test</code> with a password of <code>testpass</code>.</li> |
||
| 86 | </ul> |
||
| 87 | <p>The above steps have been tested on a domain controller running Windows |
||
| 88 | Server 2019 Standard using the Windows Server 2016 functional level |
||
| 89 | for both the forest and the domain. |
||
| 90 | </p> |
||
| 91 | </div></div> |
||
| 92 | |||
| 93 | <div class="subsection"><h4 id="Tomcat_instance_(Windows_server)">Tomcat instance (Windows server)</h4><div class="text"> |
||
| 94 | <p>These steps assume that Tomcat and an appropriate Java JDK/JRE have already |
||
| 95 | been installed and configured and that Tomcat is running as the tc01@dev.local |
||
| 96 | user. The steps to configure the Tomcat instance for Windows authentication |
||
| 97 | are as follows: |
||
| 98 | </p> |
||
| 99 | <ul> |
||
| 100 | <li>Copy the <code>tomcat.keytab</code> file created on the domain controller |
||
| 101 | to <code>$CATALINA_BASE/conf/tomcat.keytab</code>.</li> |
||
| 102 | <li>Create the kerberos configuration file |
||
| 103 | <code>$CATALINA_BASE/conf/krb5.ini</code>. The file used in this how-to |
||
| 104 | contained:<div class="codeBox"><pre><code>[libdefaults] |
||
| 105 | default_realm = DEV.LOCAL |
||
| 106 | default_keytab_name = FILE:c:\apache-tomcat-9.0.x\conf\tomcat.keytab |
||
| 107 | default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 |
||
| 108 | default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 |
||
| 109 | forwardable=true |
||
| 110 | |||
| 111 | [realms] |
||
| 112 | DEV.LOCAL = { |
||
| 113 | kdc = win-dc01.dev.local:88 |
||
| 114 | } |
||
| 115 | |||
| 116 | [domain_realm] |
||
| 117 | dev.local= DEV.LOCAL |
||
| 118 | .dev.local= DEV.LOCAL</code></pre></div> |
||
| 119 | The location of this file can be changed by setting the |
||
| 120 | <code>java.security.krb5.conf</code> system property.</li> |
||
| 121 | <li>Create the JAAS login configuration file |
||
| 122 | <code>$CATALINA_BASE/conf/jaas.conf</code>. The file used in this how-to |
||
| 123 | contained:<div class="codeBox"><pre><code>com.sun.security.jgss.krb5.initiate { |
||
| 124 | com.sun.security.auth.module.Krb5LoginModule required |
||
| 125 | doNotPrompt=true |
||
| 126 | principal="HTTP/win-tc01.dev.local@DEV.LOCAL" |
||
| 127 | useKeyTab=true |
||
| 128 | keyTab="c:/apache-tomcat-9.0.x/conf/tomcat.keytab" |
||
| 129 | storeKey=true; |
||
| 130 | }; |
||
| 131 | |||
| 132 | com.sun.security.jgss.krb5.accept { |
||
| 133 | com.sun.security.auth.module.Krb5LoginModule required |
||
| 134 | doNotPrompt=true |
||
| 135 | principal="HTTP/win-tc01.dev.local@DEV.LOCAL" |
||
| 136 | useKeyTab=true |
||
| 137 | keyTab="c:/apache-tomcat-9.0.x/conf/tomcat.keytab" |
||
| 138 | storeKey=true; |
||
| 139 | };</code></pre></div> |
||
| 140 | The location of this file can be changed by setting the |
||
| 141 | <code>java.security.auth.login.config</code> system property. The LoginModule |
||
| 142 | used is a JVM specific one so ensure that the LoginModule specified matches |
||
| 143 | the JVM being used. The name of the login configuration must match the |
||
| 144 | value used by the <a href="config/valve.html#SPNEGO_Valve">authentication |
||
| 145 | valve</a>.</li> |
||
| 146 | </ul> |
||
| 147 | <p>The SPNEGO authenticator will work with any <a href="config/realm.html"> |
||
| 148 | Realm</a> but if used with the JNDI Realm, by default the JNDI Realm will use |
||
| 149 | the user's delegated credentials to connect to the Active Directory. If |
||
| 150 | only the authenticated user name is required then the AuthenticatedUserRealm |
||
| 151 | may be used that will simply return a Principal based on the authenticated |
||
| 152 | user name that does not have any roles.</p> |
||
| 153 | <p>The above steps have been tested on a Tomcat server running Windows Server |
||
| 154 | 2019 Standard with AdoptOpenJDK 8u232-b09 (64-bit).</p> |
||
| 155 | </div></div> |
||
| 156 | |||
| 157 | <div class="subsection"><h4 id="Tomcat_instance_(Linux_server)">Tomcat instance (Linux server)</h4><div class="text"> |
||
| 158 | <p>This was tested with:</p> |
||
| 159 | <ul> |
||
| 160 | <li>Java 1.7.0, update 45, 64-bit</li> |
||
| 161 | <li>Ubuntu Server 12.04.3 LTS 64-bit</li> |
||
| 162 | <li>Tomcat 8.0.x (r1546570)</li> |
||
| 163 | </ul> |
||
| 164 | <p>It should work with any Tomcat release although it is recommended that |
||
| 165 | the latest stable release is used.</p> |
||
| 166 | <p>The configuration is the same as for Windows but with the following |
||
| 167 | changes:</p> |
||
| 168 | <ul> |
||
| 169 | <li>The Linux server does not have to be part of the Windows domain.</li> |
||
| 170 | <li>The path to the keytab file in krb5.ini and jaas.conf should be updated |
||
| 171 | to reflect the path to the keytab file on the Linux server using Linux |
||
| 172 | style file paths (e.g. /usr/local/tomcat/...).</li> |
||
| 173 | </ul> |
||
| 174 | </div></div> |
||
| 175 | |||
| 176 | <div class="subsection"><h4 id="Web_application">Web application</h4><div class="text"> |
||
| 177 | <p>The web application needs to be configured to the use Tomcat specific |
||
| 178 | authentication method of <code>SPNEGO</code> (rather than BASIC etc.) in |
||
| 179 | web.xml. As with the other authenticators, behaviour can be customised by |
||
| 180 | explicitly configuring the <a href="config/valve.html#SPNEGO_Valve"> |
||
| 181 | authentication valve</a> and setting attributes on the Valve.</p> |
||
| 182 | </div></div> |
||
| 183 | |||
| 184 | <div class="subsection"><h4 id="Client">Client</h4><div class="text"> |
||
| 185 | <p>The client must be configured to use Kerberos authentication. For Internet |
||
| 186 | Explorer this means making sure that the Tomcat instance is in the "Local |
||
| 187 | intranet" security domain and that it is configured (Tools > Internet |
||
| 188 | Options > Advanced) with integrated Windows authentication enabled. Note that |
||
| 189 | this <strong>will not</strong> work if you use the same machine for the client |
||
| 190 | and the Tomcat instance as Internet Explorer will use the unsupported NTLM |
||
| 191 | protocol.</p> |
||
| 192 | </div></div> |
||
| 193 | |||
| 194 | <div class="subsection"><h4 id="References">References</h4><div class="text"> |
||
| 195 | <p>Correctly configuring Kerberos authentication can be tricky. The following |
||
| 196 | references may prove helpful. Advice is also always available from the |
||
| 197 | <a href="https://tomcat.apache.org/lists.html#tomcat-users">Tomcat users |
||
| 198 | mailing list</a>.</p> |
||
| 199 | <ol> |
||
| 200 | <li><a href="http://www.adopenstatic.com/cs/blogs/ken/archive/2006/10/19/512.aspx"> |
||
| 201 | IIS and Kerberos</a></li> |
||
| 202 | <li><a href="http://spnego.sourceforge.net/index.html"> |
||
| 203 | SPNEGO project at SourceForge</a></li> |
||
| 204 | <li><a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/index.html"> |
||
| 205 | Oracle Java GSS-API tutorial (Java 7)</a></li> |
||
| 206 | <li><a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html"> |
||
| 207 | Oracle Java GSS-API tutorial - Troubleshooting (Java 7)</a></li> |
||
| 208 | <li><a href="https://cwiki.apache.org/confluence/display/GMOxDOC21/Using+SPNEGO+in+Geronimo#UsingSPNEGOinGeronimo-SettinguptheDomainControllerMachine"> |
||
| 209 | Geronimo configuration for Windows authentication</a></li> |
||
| 210 | <li><a href="http://blogs.msdn.com/b/openspecification/archive/2010/11/17/encryption-type-selection-in-kerberos-exchanges.aspx"> |
||
| 211 | Encryption Selection in Kerberos Exchanges</a></li> |
||
| 212 | <li><a href="http://support.microsoft.com/kb/977321">Supported Kerberos Cipher |
||
| 213 | Suites</a></li> |
||
| 214 | </ol> |
||
| 215 | </div></div> |
||
| 216 | |||
| 217 | </div><h3 id="Third_party_libraries">Third party libraries</h3><div class="text"> |
||
| 218 | |||
| 219 | <div class="subsection"><h4 id="Waffle">Waffle</h4><div class="text"> |
||
| 220 | <p>Full details of this solution can be found through the |
||
| 221 | <a href="http://waffle.codeplex.com/" rel="nofollow">Waffle web site</a>. The |
||
| 222 | key features are:</p> |
||
| 223 | <ul> |
||
| 224 | <li>Drop-in solution</li> |
||
| 225 | <li>Simple configuration (no JAAS or Kerberos keytab configuration required) |
||
| 226 | </li> |
||
| 227 | <li>Uses a native library</li> |
||
| 228 | </ul> |
||
| 229 | </div></div> |
||
| 230 | |||
| 231 | <div class="subsection"><h4 id="Spring_Security_-_Kerberos_Extension">Spring Security - Kerberos Extension</h4><div class="text"> |
||
| 232 | <p>Full details of this solution can be found through the |
||
| 233 | <a href="http://static.springsource.org/spring-security/site/extensions/krb/index.html" rel="nofollow"> Kerberos extension web site</a>. The key features are:</p> |
||
| 234 | <ul> |
||
| 235 | <li>Extension to Spring Security</li> |
||
| 236 | <li>Requires a Kerberos keytab file to be generated</li> |
||
| 237 | <li>Pure Java solution</li> |
||
| 238 | </ul> |
||
| 239 | </div></div> |
||
| 240 | |||
| 241 | <div class="subsection"><h4 id="Jespa">Jespa</h4><div class="text"> |
||
| 242 | <p>Full details of this solution can be found through the |
||
| 243 | <a href="http://www.ioplex.com/" rel="nofollow">project web site.</a> The key |
||
| 244 | features are:</p> |
||
| 245 | <ul> |
||
| 246 | <li>Pure Java solution</li> |
||
| 247 | <li>Advanced Active Directory integration</li> |
||
| 248 | </ul> |
||
| 249 | </div></div> |
||
| 250 | |||
| 251 | <div class="subsection"><h4 id="SPNEGO_AD_project_at_SourceForge">SPNEGO AD project at SourceForge</h4><div class="text"> |
||
| 252 | <p>Full details of this solution can be found through the |
||
| 253 | <a href="http://tomcatspnegoad.sourceforge.net/" rel="nofollow">project |
||
| 254 | site</a>. The key features are:</p> |
||
| 255 | <ul> |
||
| 256 | <li>Pure Java solution</li> |
||
| 257 | <li>SPNEGO/Kerberos Authenticator</li> |
||
| 258 | <li>Active Directory Realm</li> |
||
| 259 | </ul> |
||
| 260 | </div></div> |
||
| 261 | </div><h3 id="Reverse_proxies">Reverse proxies</h3><div class="text"> |
||
| 262 | |||
| 263 | <div class="subsection"><h4 id="Microsoft_IIS">Microsoft IIS</h4><div class="text"> |
||
| 264 | <p>There are three steps to configuring IIS to provide Windows authentication. |
||
| 265 | They are:</p> |
||
| 266 | <ol> |
||
| 267 | <li>Configure IIS as a reverse proxy for Tomcat (see the |
||
| 268 | <a href="https://tomcat.apache.org/connectors-doc/webserver_howto/iis.html"> |
||
| 269 | IIS Web Server How-To)</a>.</li> |
||
| 270 | <li>Configure IIS to use Windows authentication</li> |
||
| 271 | <li>Configure Tomcat to use the authentication user information from IIS by |
||
| 272 | setting the tomcatAuthentication attribute on the <a href="config/ajp.html"> |
||
| 273 | AJP connector</a> to <code>false</code>. Alternatively, set the |
||
| 274 | tomcatAuthorization attribute to <code>true</code> to allow IIS to |
||
| 275 | authenticate, while Tomcat performs the authorization.</li> |
||
| 276 | </ol> |
||
| 277 | </div></div> |
||
| 278 | |||
| 279 | <div class="subsection"><h4 id="Apache_httpd">Apache httpd</h4><div class="text"> |
||
| 280 | <p>Apache httpd does not support Windows authentication out of the box but |
||
| 281 | there are a number of third-party modules that can be used. These include:</p> |
||
| 282 | <ol> |
||
| 283 | <li><a href="http://sourceforge.net/projects/mod-auth-sspi/" rel="nofollow">mod_auth_sspi</a> for use on Windows platforms.</li> |
||
| 284 | <li><a href="http://adldap.sourceforge.net/wiki/doku.php?id=mod_auth_ntlm_winbind" rel="nofollow">mod_auth_ntlm_winbind</a> for non-Windows platforms. Known to |
||
| 285 | work with httpd 2.0.x on 32-bit platforms. Some users have reported stability |
||
| 286 | issues with both httpd 2.2.x builds and 64-bit Linux builds.</li> |
||
| 287 | </ol> |
||
| 288 | <p>There are three steps to configuring httpd to provide Windows |
||
| 289 | authentication. They are:</p> |
||
| 290 | <ol> |
||
| 291 | <li>Configure httpd as a reverse proxy for Tomcat (see the |
||
| 292 | <a href="https://tomcat.apache.org/connectors-doc/webserver_howto/apache.html"> |
||
| 293 | Apache httpd Web Server How-To)</a>.</li> |
||
| 294 | <li>Configure httpd to use Windows authentication</li> |
||
| 295 | <li>Configure Tomcat to use the authentication user information from httpd by |
||
| 296 | setting the tomcatAuthentication attribute on the <a href="config/ajp.html"> |
||
| 297 | AJP connector</a> to <code>false</code>.</li> |
||
| 298 | </ol> |
||
| 299 | </div></div> |
||
| 300 | |||
| 301 | </div></div></div></div></div><footer><div id="footer"> |
||
| 302 | Copyright © 1999-2025, The Apache Software Foundation |
||
| 303 | <br> |
||
| 304 | Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo |
||
| 305 | are either registered trademarks or trademarks of the Apache Software |
||
| 306 | Foundation. |
||
| 307 | </div></footer></div></body></html> |