I know that my this question is more specific to JAVA application with less involvement of Tridion. But I personally, being a Tridion developer, would like to involve our community in this discussion. It will not be point of any concern if I or someone move this question to Stack Overflow later but my humble request to keep it with Tridion people for some moment because they also have JAVA(.net) knowledge.
I have to develop some secure JSP pages which are not linked anywhere in the website which is almost at their support stage. There is no authentication functionality implemented anywhere in this website. Requirements and challenges are as below -
(a) When any concern person will hit the URL of any JSP page. Page will ask for login Credentials.
(b) If credentials are correct, content of the Page will be displayed otherwise Error message “User id or password is wrong” will be shown to the person in the same login popup.
(c) Each JSP page will have a user id and password which should be manageable by Editors so that they can reset the credentials at any given time.
(d) Client does not have any database apart from Tridion and we cannot use Tridion databases for this.
Below are the implementation approaches and their individual limitations in my head:
2. HTTP BASIC authentication on the particular JSP page
We cannot publish the
tomcat-users.xml file to provide the ability to reset the credentials by the Editors. or is it possible, please suggest here?
3. Secure folder which contains these pages using .htaccess
Even though we are running Apache we cannot secure folders using
.htaccess as I found on Google that it works with .HTML pages only and here I have .JSP pages.
I do not have enough knowledge on this point so please correct me if I am wrong here.