I am currently developing a web application which is hosted on a Tomcat server (with a small backend with database access and request forwarding to bypass CORS-problems).
Now the client wants the application secured with basic authentication. The web application itself uses an API which already has an authentication (Basic and Bearer/Token). I managed to add the basic authentication to Tomcat by changing the web.xml and tomcat-users.xml like this:
web.xml:
.
.
.
<security-constraint>
<web-resource-collection>
<web-resource-name>Web Resource - Allow method</web-resource-name>
<url-pattern>/request/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
</web-app>
tomcat-users.xml:
.
.
.
<role rolename="admin"/>
<user username="realusername" password="realpassword" roles="admin"/>
<user username="otherrealusername" password="otherrealpassword" roles="admin"/>
</tomcat-users>
My problem now is, that it would be impossible to manually put all the users into the tomcat-users.xml, especially since they are authenticated against the API the web application uses and their passwords might change and have to be updated. The only alternative I found was to use a database to store the userdata which I can't do either, because I don't have direct access to the APIs database and would therefore need to update my database manually, too.
Is there a way I can tell tomcat to take the userdata that is entered into the browsers prompt and try to log into the API with that? Or is there even a more elegant way to solve this?
Thanks in advance.