Re: http-request authentication missing realm?

Toman_Vojtech@emc.com writes:
> Providing p:http-request with an explicit realm option would only make
> sense to me if p:http-request contained some logic for determining which
> username/password to pick for a particular authentication realm.

Well, the c:request object provides options for specifying a username
and password and telling the processor to attempt to authorize on the
first attempt, skipping the challenge.

But this request:

  <c:request username="myname" password="mypsw" auth-method="Digest"
             send-authorization="true" .../>

is bound to fail because the digest can't be computed without the
realm. (For basic authentication, the realm doesn't really matter.)

OTOH, digest authentication involves some sort of nonce, so maybe you
can't succeed w/o the challenge anyway. Yeah. Nevermind. Ignore me.

I think the bottom line is, send-authorization=true is useless if
you're doing digest auth, but that's just the way it is.

                                        Be seeing you,
                                          norm

-- 
Norman Walsh <ndw@nwalsh.com> | The condition of an enlightened mind is
http://nwalsh.com/            | a surrendered heart.--Alan Redpath