Allowing the internal users and authenticating the external users.

[Ganesh Subrahmanya]

I have a web application running on Tomcat ( version 5 ). My requirement is that I need to allow internal users without any authentication and need to authenticate the external users. We know the IP Address range for internal users ( say something like 152.186.192.* ).

I tried using the Valve -- RemoteAddrValve and Memory Realm together, but then I don't get the intended functionality.

Is there a way in which I can achieve this requirement of allowing internal users and forcing the external users to enter username and password.

[Ganesh Subrahmanya]

Can anybody suggest me a solution for this ?

Well!, as I said, I need to allow internal users ( I know the IP address range like 152.168.192.* for internal users ) and force the external users to login.

Does writing a custom Valve help me in this case ?

Can somebody help me with this ???

[Ulf Dittmer]

Not sure how to use valves to do this, but HttpServletRequest.getRemoteAddr() gives you the IP address, so for outsiders you can do something like:

response.setHeader("WWW-Authenticate", "Basic realm=\"MyRealm\"");
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");

which will cause the client to be challenged for authentication.