JSP+Tomcat: Single Sign-On

Question

How the best way to create a single sign-on for many JSP applications using Tomcat server?

Answer 1

One possibility is to use Tomcats build in SSO mechanism: http://tomcat.apache.org/tomcat-5.5-doc/config/host.html#Single_Sign_On

A more generic, but still easy to use approach is CAS (Central Authentication Service): http://www.jasig.org/cas It's also open source.

Kerberos is the perfect fit if you want to do Integrated Windows SSO within a corporate environment. (Means, user authenticated to a Microsoft Windows system are automatically logged in to kerberized web applications). For a lot of other use cases it doesn't fit at all.

There is no general "best way" when it comes to SSO for web applications, but maybe one that fits best for your specific requirements. Maybe you can explaing them in a bit more detail?

btw why the heck are you still using Tomcat 5.5?