Limiting Access based on Requesting Application

[Frank Beck]

Hopefully, this is the right forum and there is no thread on this already (I did a search).
We have developed simple "services" using servlets that query databases based on supplied parameters and return relevant data in XML format. The servlets run under WAS on a Solaris box. The clients of the services will be web application (mostly ASP and CF on NT boxes). We have taken the simply approach of locking down access to some of the services by the requesting IP address, but we want the ability to lock down access by the requesting application. That is there may be multiple web applications on a given server, but we want to limit access to a given service by the requesting application. Anyone have the answer or any ideas? Thanks!

[Kyle Brown]

Sure, it should be easy. Just use the WAS security to lock the application down to specific user id's. Then set up the WAS security domain to use HTTP basic-auth; If you communicate via HTTP you just need to make sure you set the basic-auth headers on the client side, which is usually not hard (both the Apache SOAP client and the MS client allow this, and it's not hard when doing direct HTTP Request programming either -- check google...)
Kyle