Win a copy of Node.js Design Patterns: Design and implement production-grade Node.js applications using proven patterns and techniques this week in the Server-Side JavaScript and NodeJS forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
  • Campbell Ritchie
  • Ron McLeod
  • Rob Spoor
  • Tim Cooke
  • Junilu Lacar
  • Henry Wong
  • Liutauras Vilda
  • Jeanne Boyarsky
Saloon Keepers:
  • Jesse Silverman
  • Tim Holloway
  • Stephan van Hulst
  • Tim Moores
  • Carey Brown
  • Al Hobbs
  • Mikalai Zaikin
  • Piet Souris

Limiting Access based on Requesting Application

Posts: 4
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hopefully, this is the right forum and there is no thread on this already (I did a search).
We have developed simple "services" using servlets that query databases based on supplied parameters and return relevant data in XML format. The servlets run under WAS on a Solaris box. The clients of the services will be web application (mostly ASP and CF on NT boxes). We have taken the simply approach of locking down access to some of the services by the requesting IP address, but we want the ability to lock down access by the requesting application. That is there may be multiple web applications on a given server, but we want to limit access to a given service by the requesting application. Anyone have the answer or any ideas? Thanks!
Posts: 3892
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Sure, it should be easy. Just use the WAS security to lock the application down to specific user id's. Then set up the WAS security domain to use HTTP basic-auth; If you communicate via HTTP you just need to make sure you set the basic-auth headers on the client side, which is usually not hard (both the Apache SOAP client and the MS client allow this, and it's not hard when doing direct HTTP Request programming either -- check google...)
You showed up just in time for the waffles! And this tiny ad:
Building a Better World in your Backyard by Paul Wheaton and Shawn Klassen-Koop
    Bookmark Topic Watch Topic
  • New Topic