Chapter 11: Working with User Authentication

Overview

This chapter and the next deal with Tomcat security, though this chapter deals exclusively with access to the server’s resources. Chapter 12 covers securing data transfer and securing the machine on which the server runs. When users attempt to access a restricted resource on the server, Tomcat challenges them to produce user details to confirm that they are who they say they are. This is authentication.

Once a user is authenticated, the server must then determine whether this user is authorized to view the restricted resource requested. This is authorization. Both of these concepts make up the security policy of a server.

Tomcat uses realms to implement and enforce specific security policies, some of which developers specify, but all of which you administer. A realm itself doesn’t enforce security policies; it’s a depository of user information that allows the server, or sometimes an application, to enforce a security policy.