Tomcat Basic Authentication using API

Viewed 178

I am currently developing a web application which is hosted on a Tomcat server (with a small backend with database access and request forwarding to bypass CORS-problems).

Now the client wants the application secured with basic authentication. The web application itself uses an API which already has an authentication (Basic and Bearer/Token). I managed to add the basic authentication to Tomcat by changing the web.xml and tomcat-users.xml like this:

web.xml:

.
.
.
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Web Resource - Allow method</web-resource-name>
            <url-pattern>/request/*</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
    </login-config>
</web-app>

tomcat-users.xml:

.
.
.
  <role rolename="admin"/>
  <user username="realusername" password="realpassword" roles="admin"/>
  <user username="otherrealusername" password="otherrealpassword" roles="admin"/>
</tomcat-users>

My problem now is, that it would be impossible to manually put all the users into the tomcat-users.xml, especially since they are authenticated against the API the web application uses and their passwords might change and have to be updated. The only alternative I found was to use a database to store the userdata which I can't do either, because I don't have direct access to the APIs database and would therefore need to update my database manually, too.

Is there a way I can tell tomcat to take the userdata that is entered into the browsers prompt and try to log into the API with that? Or is there even a more elegant way to solve this?

Thanks in advance.

0 Answers
Related