非Java Web应用程序以针对Java servlet进行身份验证

Question

We have a Java EE web application deployed to JBoss . This web application is used for authentication purposes.

Now we would like to have other web applications that are not written in Java to communicate and authenticate against this web application. The reason we want to do this is: Suppose we have a small web application that does a simple task for the user. This web application could be implemented purely with the plain HTML stack plus a little bit of JavaScript, hence we would like to not introduce the complexity of Java EE into it.

Is there a good way of doing this both secured and efficiently?

---

More information:

The web application used for authentication is a huge Java EE program with other functionalities. We'd like to slowly get rid of it, and part of this process involves moving some of its functionalities outside the stack.

At this phase, we are leaving the authentication module as is, and start with other parts of the program (hence why we don't want to bundle these small web applications with the main program and uses Java EE).

Answer 1

You can put static HTML and JavaScript code inside a Java EE web application. Why not just put it there since you have the application anyway (and need it for authentication I assume) and then add appropriate mappings to your web.xml so you can only access those pages if you're logged in.

It's a little difficult to answer, because I'm not sure exactly what these other pages will be doing, how they will relate to the Java web application and so on.

Answer 2

If all you need is authentication, here's a small and lightweight open source library, http://spnego.sourceforge.net , that is installed as a servlet filter.

They also have examples on how to use a SOAP client with a protected web service.