Similar to the content of the basic article, the difference is that the process uses the Digest certification:
Tomcat configuration:
1 Create a new directory under Tomcat WebApps Authen, then create a subdirectory subdir, below a index.jsp
2 Set up the Web-inf directory under the Authen directory, and devolve the Web. xml file as follows
XML code <security-constraint> <web-resource-collection> <web-resource-name> My App </web-resource-name> <url-pattern>/subdir/*</url-pattern> </ web-resource-collection> <auth-constraint> <role-name>test</role-name> </auth-constraint> </security-constraint> <login-config > <auth-method>DIGEST</auth-method> <!-- digest here --> <realm-name>My Realm</realm-name> </ login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>
My App
</web-resource-name>
<url-pattern>/subdir/*</url-pattern>
</ web-resource-collection>
<auth-constraint>
<role-name>test</role-name>
</ auth-constraint>
</security-constraint>
<login-config>
<auth-method>digest </auth-method> <!--DIGEST here--
<realm-name>my realm</realm-name>
</ Login-config>
3 in the Tomcat Tomcat-users.xml file, add a user name password of test,test user, role test.
Client Access:
Visit http://localhost:port/authen/subdir/index.jsp
A dialog box prompts for authentication, enter test test to log in.
Workflow (can view request headers via Firebug)
1 The client first sends the request (does not know to certify, the head does not contain any special information)
2 server sends a 401 return, and contains the following header
3 Client Authentication, contains the following header
Response= "..." is the part that the client uses to sign.
Disadvantages:
An attacker who hears a message can use this message to submit a request.
implementation in the HttpClient
View the Authenticate method for the Digestscheme class of the Org.apache.commons.httpclient.auth package.
RFC2617 describes the calculation method:
A valid response contains a checksum (by default, the MD5 checksum) of the username, the password, the given nonce value, The HTTP method, and the requested URI.
