Well, I'm not exactly sure how that would be implimented. Anyone else?
However, I do have a comment about your authentication. Make sure that you
use either an SSL protected page, or applet to servlet comm. that employs
some sort of encryption. You mentioned a "dialog" for the purposes of user
authent. Generally, this means that you are going to allow the web server to
authenticate with the standard dialog prompt box via teh browser. The
problem with this is that it's "encrypted" using base64 encryption and
therefore is VERY vulnerable to a crack. In fact MANY public domain cracks
have been released for this specfic purpose.
Just thought you'd want to know since your going through the hassle of
physically seperating data.
John D. McDonald
CipherStream Systems
email: [EMAIL PROTECTED]
web: www.cipherstream.com
-------------------------------------------------------
Secure E-Business Is Our Business
-------------------------------------------------------
----- Original Message -----
From: Mike Fontenot <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 17, 1999 12:24 PM
Subject: Authorization Question - can I do this?
> All,
>
> I have a situation like this:
>
> Web Server A has protected content, I dont have control of Server A,
but...
> the owners of server A would like me to provide a level of password
> protection on my web servers (Server B), that when a user successfully
logs
> into my Server B, can redirect to the protected content of Server A.
>
> The owners of Server A want the password dialog to pop up only once, when
> the online user first hits my Server B. If all is hunky dory there, I'd
like
> to redirect that user to the protected content on Server A.
>
> Something like:
>
> 1. online user tries to load protected resource on Server B (possibly a
> servlet).
>
> 2. user gets login dialog. User enters userid/password. This is verified
on
> Server B, if OK, then redirect to the Server A protected content. Do this
> without forcing another authorization dialog to popup from Server B.
>
> Is there a away I can use a servlet to negotiate the authorization to
Server
> A based on the successful access to Server B?
>
> Any ideas, suggestion, even if it is not servlet based, would be
> appreciated. Thanks,
> Mike
>
> ========================================
> Mike Fontenot - Object Systems Architect
> Polygon Network, Inc.
> Golden, CO
> ========================================
>
>
___________________________________________________________________________
> To unsubscribe, send email to [EMAIL PROTECTED] and include in the
body
> of the message "signoff SERVLET-INTEREST".
>
> Archives: http://archives.java.sun.com/archives/servlet-interest.html
> Resources: http://java.sun.com/products/servlet/external-resources.html
> LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
>
___________________________________________________________________________
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff SERVLET-INTEREST".
Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
