具有Android应用程序的Java / Tomcat服务器中的Windows身份验证

Question

My project is an Android application that communicates with a server. The server is written in Java, deployed in Tomcat, and running on a Windows Server host.

I need to provide authentication against Windows domain accounts. Basically I need to ask the user of the app to type in their username and password; send this data to the Tomcat server; and have the server authenticate it.

I'm having trouble finding a straight answer as to how to do this. Since my app is not a web site, I don't have the option to do browser redirects or anything like that, and obviously the Android device on which the app runs is not a Windows machine and will most likely not even be on the local network.

I don't really need to execute anything as the Windows user, I just need to know that they are who they say they are. Hopefully there is a simple way to do this?

Thanks.

Answer 1

Assuming you want to use Java EE container-based form authentication, on the server you'll have to:

• secure your web application
• configure Tomcat to use Windows authentication

On the client, you can:

• POST application/x-www-form-urlencoded login data with the special keys in the web form ( j_password , etc.)
• retain the session cookies in the response for subsequent interactions with the server

I haven't tested the specifics with these exact technologies but approach is sound.