JAAS - Web SSO integration on Tomcat

Question

I'm trying to integrate Web SSO via JAAS in my web application under Apache Tomcat. I've worked through Apache documentation and other stuff to get inside.

Common approach is to implement login module, configure web application (web.xml to be exact), configure server (jaas.config, server.xml) as described at http://jakarta.apache.org/slide/howto-jaas.html. On my company environment I've faced issue with configuring server. Configuring environment variables as proposed by Apache is even worse.

Is there any way to make all configuration inside my web application?

PS. I do know about Spring security framework.
Thanks.

Answer 1

You are looking for http://spnego.sourceforge.net. There is a filter which does true SSO and JAAS.

Answer 2

There is a way to implement all security inside web app, except the security realm properties files (or LDAP / DB if you prefer). Read up on Java security. Also about tomcat's SSO valve