RE: Security Constraints

Depends on what realm you are using. Assuming you are using the default MemoryRealm, users are defined in $TOMCAT_HOME/conf/tomcat-users.xml If you are using JDBCRealm then it is presumably assumed that there is an existing mechanism to manage users/passwords for your database. If you are usign

single login form for single sign on

, which gives a maintenance problem. So in essense the question is: Is there a way to specify a "global" login and error page that will be used by all webapps? Many thanks Tim ---- Tim Dudgeon [EMAIL

RE: Form based login: protected against password snooping?

I think your understanding is correct. BASIC, DIGEST and FORM are altenatives. You can't combine them. To use FORM or BASIC securely you need SSL. Tim -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: 13 March 2001 17:42 To: [EMAIL PROTECTED] Subject: Form

form based auth broken - no cookie sent?

snapshots it is not. On processing the login page a 400 error is returned. This also happens with 4.0-b1 if you refuse the cookie. The user is being authenticated succesfully (as seen in the access log). Any ideas? Tim - Tim Dudgeon [EMAIL PROTECTED

MyRealm - cannot instantiate class exception

K1.3 Linux many thanks Tim ----- Tim Dudgeon [EMAIL PROTECTED] -- DISCLAIMER: This message contains proprietary information some or all of which may be confidential and/or legally privileged. It is for the intended recipient only who may use