Java servlet - Windows Authentication Token / IIS Server

Question

Currently I have got a specific problem finding a solution and I am hoping you are able to provide some light on the matter.

The Structure of the problem:

The task at hand is to gather a client's login credentials (token) and pass this to the servlet. However I cannot seem to find a good resource to do this. I have researched a wide variety of ways. Ie SPNEGO, WAFFLE etc..., However, these seem to require some sort of active directory by my understanding, I am trying to gather the credentials from the users local machine. A clear explanation or guidance to how I can gather the windows credentials to the servlet for my specific request would be appreciated.

Diagrams are always a better way of explaining so I will provide one if you are still confused:

Windows PC (Client) ------------------------> Java Servlet -------------------------------------> IIS Server

(windows authentication) --------------> (Get Credentials) -------------------- (Check Credentials & Authenticate)

                   (token)               (pass credentials)

Thank you in advanced to anyone who replies, I really appreciate it!.

Answer 1

You are wasting your time. If you only take the credentials from the users local machine then you have no way of knowing if those credentials can be trusted. You might as well just give every user administrative access to your web application.

The reason active directory (or something like it) is required is that it is not under the control of the client and is trusted by the server. For example, when using SPNEGO, the client authenticates itself to the windows domain, the client gets a token from the windows domain that it can only get if it is authenticated, the client passes the token to the server, the server can then validate that token with the Windows domain to confirm that the client is indeed who they claim to be. (Not quite that simple but you get the idea.)

There are other ways to do this - eg with PKI - but they all have in common a central, trusted authentication system that the server can use to validate credentials provided by the client.